kayg/calternal
Watch
1
0
Fork
You've already forked calternal
 0
Code Issues 803 Pull requests Projects Releases Packages Wiki Activity Actions 430

Voice recordings go to Documents/Voice Memos (Title Case); migrate the existing 'Voice memos' folder and links #618

New issue
Open
opened 2026-10-01 10:10:20 +00:00 by kayg · 34 comments
kayg commented 2026-10-01 10:10:20 +00:00
Owner
Copy link

Owner request (2026-10-01): "attachments should go to Documents > Voice Memos (not small m)"

Today: crates/calternal-notes-core/src/attachments.rs (lines ~28, ~87) and DESIGN line ~1881 use Documents/Voice memos.
Fix:

  • Use Documents/Voice Memos (Title Case, like Apple's Voice Memos) everywhere: the attachment router, DESIGN, CONTEXT, tests.
  • Migrate existing Homes: if Documents/Voice memos/ exists, rename it to Documents/Voice Memos/ through calternal-fs (case-only rename: rename via a temporary name so case-insensitive WebDAV/Finder clients and APFS-backed sync see one consistent move). Rewrite existing attachment links in Log entries and Notes so nothing breaks. Do it idempotently, logged, with a merge if both folders exist.
  • Keep the stable item IDs, so deep links survive (§33).
    Test: a Rust test for the new path; a migration test with an existing Voice memos folder and linked attachments → renamed + links rewritten + idempotent second run. Per-crate gates.
## Owner request (2026-10-01): "attachments should go to Documents > Voice Memos (not small m)" **Today:** `crates/calternal-notes-core/src/attachments.rs` (lines ~28, ~87) and DESIGN line ~1881 use `Documents/Voice memos`. **Fix:** - Use **`Documents/Voice Memos`** (Title Case, like Apple's Voice Memos) everywhere: the attachment router, DESIGN, CONTEXT, tests. - **Migrate existing Homes:** if `Documents/Voice memos/` exists, rename it to `Documents/Voice Memos/` through `calternal-fs` (case-only rename: rename via a temporary name so case-insensitive WebDAV/Finder clients and APFS-backed sync see one consistent move). Rewrite existing attachment links in Log entries and Notes so nothing breaks. Do it idempotently, logged, with a merge if both folders exist. - Keep the stable item IDs, so deep links survive (§33). **Test:** a Rust test for the new path; a migration test with an existing `Voice memos` folder and linked attachments → renamed + links rewritten + idempotent second run. Per-crate gates.
round3-files-focused.log
1.9 KiB
round3-calternal-plugin-files-clippy.log
13 KiB
round3-calternal-plugin-files-test.log
16 KiB
round3-calternal-plugin-notes-clippy.log
4.9 KiB
round3-web-check.log
579 B
unicode-red.log
2.2 KiB
p1-red-behavior.log
1.2 KiB
p1-scan-red.log
824 B
p2-red.log
879 B
unicode-green.log
1.4 KiB
storm-focused.log
54 B
round3-calternal-plugin-notes-test.log
8.5 KiB
round3-server-build.log
17 KiB
voice-memo-jobs-macos.mjs.txt
11 KiB
macos-screenshot-round3-retry.log
454 B
macos-screenshot-round3-canonical.log
726 B
macos-screenshot-round3-final.log
460 B
kayg commented 2026-10-02 01:22:26 +00:00
Author
Owner
Copy link

Starting work on job/voicememos-618, based on 9a6c38c3b7c8bbbdad9919cd2419f773d9c34b6e (origin/dev, currently seven commits ahead of the branch). I am tracing the Files API, WebDAV provider, calternal-fs rename journal, and Notes link-rewrite paths before implementing the Title Case migration and case-twin repair.

Starting work on `job/voicememos-618`, based on `9a6c38c3b7c8bbbdad9919cd2419f773d9c34b6e` (`origin/dev`, currently seven commits ahead of the branch). I am tracing the Files API, WebDAV provider, `calternal-fs` rename journal, and Notes link-rewrite paths before implementing the Title Case migration and case-twin repair.
kayg commented 2026-10-02 01:27:39 +00:00
Author
Owner
Copy link

Finding: crates/plugins/files/src/uploads.rs::create_impl takes the exact folder returned by attachment_folder() and calls mkdir_p on its parent. After a client renames Documents/Voice memos to Documents/Voice Memos, the old spelling is not resolved before the next recording, so Linux can create a second sibling folder. Both the Files API rename route and WebDAV MOVE call move_indexed, which performs one Index subtree update after the filesystem move. calternal-fs::Root::move_path currently journals one direct rename, with no intermediate name for case-only moves. I will fix these shared points and add a startup, retry-safe merge for voice memo case twins.

Finding: `crates/plugins/files/src/uploads.rs::create_impl` takes the exact folder returned by `attachment_folder()` and calls `mkdir_p` on its parent. After a client renames `Documents/Voice memos` to `Documents/Voice Memos`, the old spelling is not resolved before the next recording, so Linux can create a second sibling folder. Both the Files API rename route and WebDAV MOVE call `move_indexed`, which performs one Index subtree update after the filesystem move. `calternal-fs::Root::move_path` currently journals one direct rename, with no intermediate name for case-only moves. I will fix these shared points and add a startup, retry-safe merge for voice memo case twins.
kayg commented 2026-10-02 03:22:35 +00:00
Author
Owner
Copy link

Post-merge gate finding: cargo test -p calternal-plugin-notes reports 166 passed and one failure in tests::daily_and_composer_preserve_unrelated_bytes (from origin/dev). Its GET /journal/2026-09-24 assertion receives 404 instead of 200 at crates/plugins/notes/src/lib.rs:9502. The merged snapshot-backed journal_snapshot returns “Daily note not indexed” when its snapshot table has no row. The test expectation is unchanged; I am continuing the requested gates and will report this as a known gap.

Post-merge gate finding: `cargo test -p calternal-plugin-notes` reports 166 passed and one failure in `tests::daily_and_composer_preserve_unrelated_bytes` (from `origin/dev`). Its GET `/journal/2026-09-24` assertion receives 404 instead of 200 at `crates/plugins/notes/src/lib.rs:9502`. The merged snapshot-backed `journal_snapshot` returns “Daily note not indexed” when its snapshot table has no row. The test expectation is unchanged; I am continuing the requested gates and will report this as a known gap.
kayg commented 2026-10-02 04:18:06 +00:00
Author
Owner
Copy link

Local Voice Memos profile result (shared host; no Voice Memos baseline exists in docs/perf/baseline.json):

  • A 1,000-file fixture and then a 256-file fixture with 64 conflicts did not log migration completion within 300 seconds.
  • The completed reduced run used two 64-file samples, then 128 old-folder files plus 8 conflict files and 16 linked Notes, followed by 16 uploads at concurrency 8.
  • Average migration: p50 6,645 ms, p95 6,875 ms; mean server CPU 3.43 s; mean RSS 121,956,270 bytes; peak RSS 176,627,712 bytes.
  • Reduced worst merge: 136 moved paths, 8 conflict copies, 16 linked Notes; migration 134,307 ms; server CPU 12.35 s; mean RSS 230,617,587 bytes; peak RSS 243,101,696 bytes.
  • Upload burst: p50 6,916.52 ms, p95 11,787.37 ms; CPU 1.61 s; mean RSS 251,385,362 bytes; peak RSS 255,242,240 bytes.
  • Load average (1/5/15 minutes) moved from 23.59/23.42/19.85 to 27.75/25.42/21.35. Results are local debug measurements on the shared host and are not a baseline comparison.

The larger fixture timeouts and completed measurements are being recorded in docs/perf/2026-10-02-voice-memos.md.

Local Voice Memos profile result (shared host; no Voice Memos baseline exists in `docs/perf/baseline.json`): - A 1,000-file fixture and then a 256-file fixture with 64 conflicts did not log migration completion within 300 seconds. - The completed reduced run used two 64-file samples, then 128 old-folder files plus 8 conflict files and 16 linked Notes, followed by 16 uploads at concurrency 8. - Average migration: p50 6,645 ms, p95 6,875 ms; mean server CPU 3.43 s; mean RSS 121,956,270 bytes; peak RSS 176,627,712 bytes. - Reduced worst merge: 136 moved paths, 8 conflict copies, 16 linked Notes; migration 134,307 ms; server CPU 12.35 s; mean RSS 230,617,587 bytes; peak RSS 243,101,696 bytes. - Upload burst: p50 6,916.52 ms, p95 11,787.37 ms; CPU 1.61 s; mean RSS 251,385,362 bytes; peak RSS 255,242,240 bytes. - Load average (1/5/15 minutes) moved from 23.59/23.42/19.85 to 27.75/25.42/21.35. Results are local debug measurements on the shared host and are not a baseline comparison. The larger fixture timeouts and completed measurements are being recorded in `docs/perf/2026-10-02-voice-memos.md`.
kayg commented 2026-10-02 04:25:05 +00:00
Author
Owner
Copy link

#618 complete — branch job/voicememos-618, HEAD df30c35a487a0a3eb9aedacbf102beec79e0050a.

Built

  • Voice memo attachments now use Documents/Voice Memos. The router reuses an existing case-folded folder spelling.
  • calternal-fs journals case-only moves as one replayable operation through a temporary sibling.
  • Files startup repair merges case-twin folders, preserves stable Item IDs, keeps a conflict copy, updates the Files Index and rewrites Notes and Log attachment links. Pending move recovery completes link rewrites after a crash.
  • Added Files web and WebDAV case-only move tests, migration/idempotence and conflict tests, router lookup tests, a real-server adversarial probe, and a benchmark profile.

Files

CONTEXT.md; apps/web/e2e/composer.mjs; bench/voice-memo-migration-618.py; crates/calternal-fs/src/{file_ops.rs,journal.rs,lib.rs,path.rs}; crates/calternal-fs/tests/storage.rs; crates/calternal-notes-core/src/{attachments.rs,lib.rs,links.rs}; crates/plugins/files/src/{index.rs,lib.rs,uploads.rs}; crates/plugins/notes/src/lib.rs; docs/DESIGN.md; docs/perf/{README.md,2026-10-02-voice-memos.md}; tests/adversarial/{run.sh,voice_memos.py}.

Gates

cargo fmt --check passed with no output.

Clippy passed for each changed Rust crate and calternal-server:

calternal-fs:     Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.86s
calternal-notes-core: Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.38s
calternal-plugin-files: Finished `dev` profile [unoptimized + debuginfo] target(s) in 19.33s
calternal-plugin-notes: Finished `dev` profile [unoptimized + debuginfo] target(s) in 18.90s
calternal-server: Finished `dev` profile [unoptimized + debuginfo] target(s) in 2m 21s

Rust test output:

calternal-fs: test result: ok. 52 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 14.57s
test result: ok. 44 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.82s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
calternal-notes-core: test result: ok. 521 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.17s
test result: ok. 19 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.38s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.04s
test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.52s
test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
calternal-plugin-files: test result: ok. 153 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 138.12s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
calternal-plugin-notes: test result: FAILED. 166 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 74.25s
calternal-server: test result: ok. 107 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 11.43s

The Notes failure is tests::daily_and_composer_preserve_unrelated_bytes: the merged origin/dev snapshot-backed daily route returned HTTP 404 where the existing test expects 200 (crates/plugins/notes/src/lib.rs:9502). That test is present on origin/dev; I kept its expectation unchanged and reported the finding earlier.

Web gates passed:

svelte-check found 0 errors and 0 warnings
 Test Files  153 passed (153)
      Tests  1053 passed (1053)

bun run build and cargo build -p calternal-server passed. The single local real-server adversarial round passed:

Voice Memos adversarial checks passed: Files rename, WebDAV MOVE, uploads, Index rows, bytes, malformed metadata, and 16 concurrent recordings

Cleanup output:

Removed 18590 files, 10.4GiB total

Performance

The completed reduced local profile is recorded in docs/perf/2026-10-02-voice-memos.md. On the shared host, load averages (1/5/15 minutes) were 23.59/23.42/19.85 before and 27.75/25.42/21.35 after. Two 64-file samples measured migration p50/p95 6,645/6,875 ms, mean CPU 3.43 s, mean RSS 121,956,270 bytes, and peak RSS 176,627,712 bytes. The reduced merge used 136 moved paths, 8 conflict copies and 16 linked Notes; migration took 134,307 ms, CPU 12.35 s, mean RSS 230,617,587 bytes, peak RSS 243,101,696 bytes. A 16-upload burst at concurrency 8 measured p50/p95 6,916.52/11,787.37 ms, CPU 1.61 s, and peak RSS 255,242,240 bytes.

The 1,000-file fixture and a 256-file fixture with 64 conflicts did not reach the migration log within 300 seconds. The successful measurements use the reduced conflict set and are not a quiet-host baseline. docs/perf/baseline.json has no matching Voice Memos scenario.

Decisions not specified in DESIGN

  • If the exact Voice Memos directory exists, it remains primary and keeps its Item ID. If it does not exist, the newest case-folded candidate directory becomes primary.
  • For file conflicts, filesystem modification time with nanosecond precision chooses the winner. At an exact tie, the existing canonical target wins. The other file remains under a deterministic conflict-copy name derived from its stable Item ID; a number handles a name collision.

No issue was closed. No push or deploy was performed.

#618 complete — branch `job/voicememos-618`, HEAD `df30c35a487a0a3eb9aedacbf102beec79e0050a`. ## Built - Voice memo attachments now use `Documents/Voice Memos`. The router reuses an existing case-folded folder spelling. - `calternal-fs` journals case-only moves as one replayable operation through a temporary sibling. - Files startup repair merges case-twin folders, preserves stable Item IDs, keeps a conflict copy, updates the Files Index and rewrites Notes and Log attachment links. Pending move recovery completes link rewrites after a crash. - Added Files web and WebDAV case-only move tests, migration/idempotence and conflict tests, router lookup tests, a real-server adversarial probe, and a benchmark profile. ## Files `CONTEXT.md`; `apps/web/e2e/composer.mjs`; `bench/voice-memo-migration-618.py`; `crates/calternal-fs/src/{file_ops.rs,journal.rs,lib.rs,path.rs}`; `crates/calternal-fs/tests/storage.rs`; `crates/calternal-notes-core/src/{attachments.rs,lib.rs,links.rs}`; `crates/plugins/files/src/{index.rs,lib.rs,uploads.rs}`; `crates/plugins/notes/src/lib.rs`; `docs/DESIGN.md`; `docs/perf/{README.md,2026-10-02-voice-memos.md}`; `tests/adversarial/{run.sh,voice_memos.py}`. ## Gates `cargo fmt --check` passed with no output. Clippy passed for each changed Rust crate and `calternal-server`: ```text calternal-fs: Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.86s calternal-notes-core: Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.38s calternal-plugin-files: Finished `dev` profile [unoptimized + debuginfo] target(s) in 19.33s calternal-plugin-notes: Finished `dev` profile [unoptimized + debuginfo] target(s) in 18.90s calternal-server: Finished `dev` profile [unoptimized + debuginfo] target(s) in 2m 21s ``` Rust test output: ```text calternal-fs: test result: ok. 52 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 14.57s test result: ok. 44 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.82s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s calternal-notes-core: test result: ok. 521 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.17s test result: ok. 19 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.38s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.04s test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.52s test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s calternal-plugin-files: test result: ok. 153 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 138.12s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s calternal-plugin-notes: test result: FAILED. 166 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 74.25s calternal-server: test result: ok. 107 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 11.43s ``` The Notes failure is `tests::daily_and_composer_preserve_unrelated_bytes`: the merged `origin/dev` snapshot-backed daily route returned HTTP 404 where the existing test expects 200 (`crates/plugins/notes/src/lib.rs:9502`). That test is present on `origin/dev`; I kept its expectation unchanged and reported the finding earlier. Web gates passed: ```text svelte-check found 0 errors and 0 warnings Test Files 153 passed (153) Tests 1053 passed (1053) ``` `bun run build` and `cargo build -p calternal-server` passed. The single local real-server adversarial round passed: ```text Voice Memos adversarial checks passed: Files rename, WebDAV MOVE, uploads, Index rows, bytes, malformed metadata, and 16 concurrent recordings ``` Cleanup output: ```text Removed 18590 files, 10.4GiB total ``` ## Performance The completed reduced local profile is recorded in `docs/perf/2026-10-02-voice-memos.md`. On the shared host, load averages (1/5/15 minutes) were `23.59/23.42/19.85` before and `27.75/25.42/21.35` after. Two 64-file samples measured migration p50/p95 `6,645/6,875 ms`, mean CPU `3.43 s`, mean RSS `121,956,270 bytes`, and peak RSS `176,627,712 bytes`. The reduced merge used 136 moved paths, 8 conflict copies and 16 linked Notes; migration took `134,307 ms`, CPU `12.35 s`, mean RSS `230,617,587 bytes`, peak RSS `243,101,696 bytes`. A 16-upload burst at concurrency 8 measured p50/p95 `6,916.52/11,787.37 ms`, CPU `1.61 s`, and peak RSS `255,242,240 bytes`. The 1,000-file fixture and a 256-file fixture with 64 conflicts did not reach the migration log within 300 seconds. The successful measurements use the reduced conflict set and are not a quiet-host baseline. `docs/perf/baseline.json` has no matching Voice Memos scenario. ## Decisions not specified in DESIGN - If the exact `Voice Memos` directory exists, it remains primary and keeps its Item ID. If it does not exist, the newest case-folded candidate directory becomes primary. - For file conflicts, filesystem modification time with nanosecond precision chooses the winner. At an exact tie, the existing canonical target wins. The other file remains under a deterministic conflict-copy name derived from its stable Item ID; a number handles a name collision. No issue was closed. No push or deploy was performed.
kayg commented 2026-10-02 05:50:29 +00:00
Author
Owner
Copy link

Independent review started on job/voicememos-review, base and review target df30c35a487a0a3eb9aedacbf102beec79e0050a. Scope: tests and code review only; no product edits. I will check byte and identity retention, link rewrite and replay, confinement, and startup cost. Findings and exact validation output will go in review-findings.md.

Independent review started on `job/voicememos-review`, base and review target `df30c35a487a0a3eb9aedacbf102beec79e0050a`. Scope: tests and code review only; no product edits. I will check byte and identity retention, link rewrite and replay, confinement, and startup cost. Findings and exact validation output will go in `review-findings.md`.
kayg commented 2026-10-02 06:04:03 +00:00
Author
Owner
Copy link

Blocking finding at review target df30c35a487a0a3eb9aedacbf102beec79e0050a: a twin merge with a newer legacy recording and an older canonical recording redirects both Note links to the older conflict copy. The newer recording survives at the shared path with its original file ID, but its Note link no longer points to it.

Evidence: review_twin_merge_redirects_newer_recording_link_to_older_copy runs the production migration. It verifies both byte contents and IDs, then compares the entire Note against the incorrect observed output. CRLF, frontmatter order and unrelated UTF-8 text remain exact. The test passed (it is explicitly a defect characterization, not an acceptance test).

Cause: move_indexed rewrites each move immediately. migrate_voice_memo_home then rewrites the collected mappings again. The canonical shared path → conflict-copy mapping catches the link that the later legacy shared path → canonical shared path move just produced. This blocks GO before the owner's Home is touched. No product code changed in this review.

Blocking finding at review target `df30c35a487a0a3eb9aedacbf102beec79e0050a`: a twin merge with a newer legacy recording and an older canonical recording redirects both Note links to the older conflict copy. The newer recording survives at the shared path with its original file ID, but its Note link no longer points to it. Evidence: `review_twin_merge_redirects_newer_recording_link_to_older_copy` runs the production migration. It verifies both byte contents and IDs, then compares the entire Note against the incorrect observed output. CRLF, frontmatter order and unrelated UTF-8 text remain exact. The test passed (it is explicitly a defect characterization, not an acceptance test). Cause: `move_indexed` rewrites each move immediately. `migrate_voice_memo_home` then rewrites the collected mappings again. The canonical shared path → conflict-copy mapping catches the link that the later legacy shared path → canonical shared path move just produced. This blocks GO before the owner's Home is touched. No product code changed in this review.
kayg commented 2026-10-02 06:07:55 +00:00
Author
Owner
Copy link

Further evidence at the same review target:

  • review_older_source_leaves_legacy_folder_until_second_run confirms that an older legacy recording's conflict copy remains in the legacy folder. First repair returns Directory not empty (os error 39) after removing that folder's Index row. A second run finishes; recording bytes survive.
  • review_two_legacy_twins_without_canonical_cannot_start confirms that Voice memos + VOICE MEMOS, without Voice Memos, returns name_conflict_case on both attempts. Bytes survive; repair cannot start.
  • review_encoded_and_reference_destinations_remain_stale confirms that percent-encoded destinations and reference-style Markdown destinations remain unchanged when the folder moves.
  • SIGKILL at the three durable case-rename namespace boundaries recovers recording bytes and inode identity. The partial Note/Log write fixture also recovers through a reopened Root and retains item IDs.

Per-crate fs and notes-core tests pass. These are distinct from a claim that every multi-file merge crash point has been tested. Final gate output and performance measurements will follow in the report.

Further evidence at the same review target: - `review_older_source_leaves_legacy_folder_until_second_run` confirms that an older legacy recording's conflict copy remains in the legacy folder. First repair returns `Directory not empty (os error 39)` after removing that folder's Index row. A second run finishes; recording bytes survive. - `review_two_legacy_twins_without_canonical_cannot_start` confirms that `Voice memos` + `VOICE MEMOS`, without `Voice Memos`, returns `name_conflict_case` on both attempts. Bytes survive; repair cannot start. - `review_encoded_and_reference_destinations_remain_stale` confirms that percent-encoded destinations and reference-style Markdown destinations remain unchanged when the folder moves. - SIGKILL at the three durable case-rename namespace boundaries recovers recording bytes and inode identity. The partial Note/Log write fixture also recovers through a reopened Root and retains item IDs. Per-crate fs and notes-core tests pass. These are distinct from a claim that every multi-file merge crash point has been tested. Final gate output and performance measurements will follow in the report.
kayg commented 2026-10-02 06:17:31 +00:00
Author
Owner
Copy link

Second blocker confirmed by the extended fixture: review_older_source_loses_file_id_and_leaves_legacy_folder passes against the reviewed implementation. It verifies that the first failed repair leaves the older recording's conflict copy on disk but deletes its files_index row, Share, and public link. The next repair assigns a different file ID to that recording.

Cause: after the conflict copy is left inside the legacy folder, migrate_voice_memo_home calls recursive index::remove before remove_empty_user_dir. index::remove deletes descendant Index rows and Security state. Then physical folder removal fails because the conflict copy is still there. Recording bytes survive; stable deep links and Security state do not. This is a NO-GO data-integrity finding, not a SLOW finding.

Second blocker confirmed by the extended fixture: `review_older_source_loses_file_id_and_leaves_legacy_folder` passes against the reviewed implementation. It verifies that the first failed repair leaves the older recording's conflict copy on disk but deletes its `files_index` row, Share, and public link. The next repair assigns a different file ID to that recording. Cause: after the conflict copy is left inside the legacy folder, `migrate_voice_memo_home` calls recursive `index::remove` before `remove_empty_user_dir`. `index::remove` deletes descendant Index rows and Security state. Then physical folder removal fails because the conflict copy is still there. Recording bytes survive; stable deep links and Security state do not. This is a NO-GO data-integrity finding, not a SLOW finding.
kayg commented 2026-10-02 06:20:26 +00:00
Author
Owner
Copy link

The bounded exact-target local profile is complete. With 100,000 flat files in the legacy Voice Memos folder and an empty canonical twin, the repair reached its 30-second bound at 30,008.512 ms after moving 7 files. 99,993 remained in the legacy folder; all 100,000 entries were still present. Kernel read-byte delta was 0 (cached fixture); write-byte delta was 2,555,904, including 491,520 cancelled write bytes. The full test, including fixture creation and cleanup, used 11.616 s user CPU, 8.111 s system CPU and 98,112 KiB peak RSS. This does not establish a full completion time or every file's hash/ID.

For 100,000 unrelated files and an empty legacy folder, first repair took 4,806.097 ms and the canonical-only retry took 0.241 ms. No matching Voice Memos baseline exists. These are local debug measurements on the busy shared host. The perf VM was available under its lock, but no verified exact-target shared release server was available. No build or deployment occurred there. The SLOW result does not add a merge blocker; the two confirmed data-integrity defects remain the NO-GO basis.

The bounded exact-target local profile is complete. With 100,000 flat files in the legacy Voice Memos folder and an empty canonical twin, the repair reached its 30-second bound at 30,008.512 ms after moving 7 files. 99,993 remained in the legacy folder; all 100,000 entries were still present. Kernel read-byte delta was 0 (cached fixture); write-byte delta was 2,555,904, including 491,520 cancelled write bytes. The full test, including fixture creation and cleanup, used 11.616 s user CPU, 8.111 s system CPU and 98,112 KiB peak RSS. This does not establish a full completion time or every file's hash/ID. For 100,000 unrelated files and an empty legacy folder, first repair took 4,806.097 ms and the canonical-only retry took 0.241 ms. No matching Voice Memos baseline exists. These are local debug measurements on the busy shared host. The perf VM was available under its lock, but no verified exact-target shared release server was available. No build or deployment occurred there. The SLOW result does not add a merge blocker; the two confirmed data-integrity defects remain the NO-GO basis.
kayg commented 2026-10-02 06:34:17 +00:00
Author
Owner
Copy link

Final independent review: NO-GO.

Branch: job/voicememos-review. Final head: 9200c49b516148d6b78a70650b0443ec4539fbf4. Reviewed product target: df30c35a487a0a3eb9aedacbf102beec79e0050a. Five atomic review commits; tests and report only. All final per-crate gates passed. The passing characterization tests confirm defects; they do not approve the product repair. Build output was cleaned. No push, deployment or owner-data edit.

Voice Memos data-integrity review

Verdict: NO-GO for #618/#621 at
df30c35a487a0a3eb9aedacbf102beec79e0050a.
Do not run this repair on the owner's Home until the link-identity defect and
recording identity / Security state deletion are fixed. This review changes
tests and this report only. It makes no product fix.

Blocking finding: a link changes recording identity

Files: crates/plugins/files/src/lib.rs, move_indexed,
move_voice_memo_path, and migrate_voice_memo_home.

Fixture: both Voice Memos spellings contain shared.m4a. The legacy file has
newer bytes and modification time. The canonical file has older bytes. A Note
has one link to each file.

The repair keeps the older recording at a conflict-copy path. It moves the newer
recording to the canonical shared path. Both byte contents and both file IDs
survive. But both Note links end at the older conflict-copy path. The link
that named the newer recording now plays the older recording.

Cause: move_indexed rewrites links after each move. At the end,
migrate_voice_memo_home applies the collected mappings again. The second
canonical shared path to conflict-copy mapping catches a link that the legacy
shared path to canonical shared path move already changed.

Evidence: review_twin_merge_redirects_newer_recording_link_to_older_copy in
crates/plugins/files/src/tests/voice_memos_review.rs. The test compares the
whole Note with the observed incorrect output. It also checks file bytes, IDs,
CRLF, frontmatter order, unrelated text, and a second run.

Required fix: define one replay-safe link transaction that retains the original
recording identity. Remove the repeated application of overlapping move
mappings. Test both modification-time orders and a restart during each Note
write. Do not clear a move intent until its link changes and Index updates are
complete.

Other findings

  1. Blocking: an older source loses Index identity and Security state.
    Its conflict copy is made in the legacy folder. The merge does not visit that new entry. It then removes
    the folder's Index row and tries to remove the nonempty folder. The call
    fails with Directory not empty (os error 39). The Index deletion is
    recursive: it also removes the conflict copy's file row, Shares and public
    links. Bytes survive, but a second run must assign a new recording ID.
    Security state cannot be rebuilt from recording bytes. The extended test
    checks all three deletions and the changed ID:
    review_older_source_loses_file_id_and_leaves_legacy_folder. The test passed.
    Keep the conflict copy at its final destination before folder removal. Do not delete any live descendant's
    identity or grants.
  2. Two legacy twins without the canonical spelling cannot migrate. The
    chosen primary folder's rename meets the normal sibling case-conflict gate.
    Both attempts return name_conflict_case. Neither recording changes.
    Test: review_two_legacy_twins_without_canonical_cannot_start. The recovery
    path must handle this existing state without weakening the normal new-name
    gate.
  3. Two Markdown destination forms remain stale. Percent-encoded paths
    such as Documents/Voice%20memos/a.m4a and reference definitions such as
    [audio]: <Documents/Voice memos/a.m4a> do not change. Their recording can
    move while the link retains the legacy destination. Test:
    review_encoded_and_reference_destinations_remain_stale. Extend the shared
    scanner and test the decoded component boundary before the repair runs.
  4. The repair has no hash-based file deduplication. A file collision always
    keeps a conflict copy, even for identical content. This avoids an unchecked
    deletion. The Index deletion defect above can still lose file IDs. The condition “dedupe only when hashes match”
    is met because this merge deletes no colliding file. Do not describe this
    merge as hash-based deduplication. Merged source directory IDs are removed;
    the tested ID guarantee applies to recordings, not to both twin folders.
  5. Legacy invalid new names stop a merge. New-name normalization rejects
    trailing spaces and dots. The merge passes each existing child name to this
    policy. It can therefore stop on imported names. A decomposed name can also
    fail when it is used as a new destination without NFC normalization. This
    is a safe abort, not evidence of escape or byte loss. These merge branches
    were inspected; the name-policy tests exercise the normalization boundary.
  6. There is no durable “done once” flag. Each FilesState::reconcile_all
    calls the repair. A canonical-only Home incurs a directory check and no
    link scan. A completed repair is cheap to retry, but it is not permanently
    disabled. A later legacy folder can trigger it again.

Confirmed behavior and limits

  • Distinct same-name recording bytes and file IDs survive the tested merge
    when the legacy recording is newer. The existing twin-merge test and the new link-identity test check this.
  • Pure inline Markdown rewrites preserve CRLF, frontmatter order, Unicode,
    unrelated links, code examples, labels, query strings and anchors in the
    fixtures. The matching folder prefix has a component boundary. A simple
    folder rename is idempotent.
  • A restart after the physical folder rename and one of two Note writes
    completes both Note and Daily note Log links. The reopened Root and Files
    state retain folder and recording IDs. Repeated reconciliation preserves
    the resulting bytes. Test: review_partial_note_rewrite_replays_after_reopen.
  • A worker is killed with SIGKILL after journal publication, after the temporary
    rename, and after the final rename. Fresh Root recovery finishes each case,
    retains the recording bytes and inode, removes the temporary name, and is
    safe on a second replay. Test:
    review_sigkill_at_each_case_rename_boundary.
  • Root uses openat2 with BENEATH, NO_SYMLINKS and NO_MAGICLINKS.
    Namespace changes use held parent handles with renameat_with. The review
    found formatted relative names, but not an ambient filesystem move built
    from User input. RelPath/InternalPath validate these names before handle
    resolution. A legacy symlink is rejected and its external target is unchanged.
  • Folding is NFC, then default full non-Turkic Unicode case folding, not
    simple folding. The code documents it in calternal-fs/src/path.rs. Tests
    cover NFC/NFD equivalence, ß/SS, ASCII I/i, dotless ı, dotted İ,
    and trailing spaces/dots. This is not evidence from an APFS filesystem.
  • The repair holds the Home Notes lock and uses a content-hash checked update.
    It emits Notes invalidations, which the real Hub consumes as external edits.
    The live-room fixture passed: its live edit, last line, and rewritten
    attachment each appeared once after duplicate invalidations and a flush.
    A Hub test is not a browser typing test for all #634 scenarios.

This is not a proof of crash safety at every multi-file merge boundary.
There is no exhaustive SIGKILL matrix for conflict copies, Sidecars, all SQL
commit points, every Note write, or power failure during fsync. The three
case-rename namespace boundaries and the partial Note replay are covered.
The failing identity case alone is enough to block this repair.

Performance

Local debug measurement, shared host, one run with a cached fixture:
100,000 non-Markdown files in Archive and an empty legacy Voice Memos folder.
Fixture creation and normal Files indexing are outside the repair timer.

Repair phase Elapsed Kernel read bytes delta Kernel write bytes delta
First repair 4,806.097 ms 0 307,200
Canonical-only retry 0.241 ms 0 0

The process used 1.986 s user CPU and 5.023 s system CPU with 39,472 KiB peak
RSS. These process totals include fixture creation, schema setup and cleanup;
they are not repair-only CPU/RSS. The full test took 23.65 s. Initial load was
29.25 / 25.14 / 22.86; final load was 31.65 / 26.15 / 23.30. /proc/self/io
counts disk bytes charged to the process. Cached metadata operations are not
proof of zero filesystem work. This profile does not include 100k moved files,
linked Notes, conflicts, or a cold filesystem.

The affected-folder profile placed 100,000 flat files in the legacy Voice Memos
folder and an empty canonical twin beside it. It reached the 30-second bound
at 30,008.512 ms, with only 7 files moved and 99,993 still in the legacy
folder. All 100,000 directory entries remained present. The profile did not
complete the repair and did not claim to verify every file's hash or ID.
Kernel read-byte delta was 0; write-byte delta was 2,555,904, with 491,520
cancelled write bytes. Process totals, including fixture creation and cleanup:
11.616 s user CPU, 8.111 s system CPU, 98,112 KiB peak RSS, 53.85 s test time.
Final host load was 21.13 / 18.78 / 20.72. This is a local debug result from a
busy host, not a quiet release measurement. It does not support a claim that
repair is cheap for 100k affected files. This SLOW result is not itself a merge
blocker.

The perf VM lock check succeeded. No exact-target release server was available.
The host's shared release binary lacks this migration's completion marker, so
its target revision could not be verified and it was not used for this review.
No server was deployed or compiled on the perf VM.

docs/perf/baseline.json has no Voice Memos migration scenario. There is no
matching baseline or threshold comparison. The earlier job's local debug
profile in docs/perf/2026-10-02-voice-memos.md reports 134,307 ms for 128 legacy
files, 8 conflicts and 16 linked Notes; it is context, not this review's result.

Code review explains the scaling concern: each moved item calls the Notes
rewrite, which walks all visible Home entries. The merge also reads the target
folder for each child. A flat twin merge can require quadratic directory work
and repeated full Home scans. The final batch adds another scan.

Decisions

  • Keep product behavior unchanged. Record defects with explicitly named
    characterization tests. A passing defect test confirms the defect; it is
    not an acceptance gate. Replace its observed-defect assertion with the
    intended invariant when the implementation is fixed.
  • Use process kills only in disposable test Homes. Test partial Note replay
    through a fresh Root rather than add a product fault-injection API.
  • Bound the large twin workload. Do not wait for an unbounded 100k-file merge.
  • Use exact-target local measurements when the shared release does not contain
    the target change. Label all measurements and their limits.

UX gaps closed

None. This is a tests and code review job.

UX gaps left

The link-identity defect can make a Note play the wrong recording. The merge
abort cases leave repair incomplete. No UI was changed or visually reviewed.

Validation

The test head is 335a5fcfe821ddf28089e46fc7322b58b56d02a1.
The final report commit follows this head. Review branch: job/voicememos-review.

Before the final gates, git fetch origin succeeded and git merge origin/dev
returned, verbatim:

Already up to date.

The fetched dev head was c4a61e8cf090170f35b1bed3350d9de20c83ecd5, already an
ancestor of the reviewed target. No product merge commit was made.

All cargo commands used CARGO_PROFILE_DEV_DEBUG=line-tables-only,
CARGO_INCREMENTAL=0, CARGO_BUILD_JOBS=4 and this worktree's target/tmp for
TMPDIR. The preset CARGO_TARGET_DIR was not changed. No dependency version
or lockfile was changed. No web or server route code was changed.

cargo fmt --check: no output, exit 0. git diff --check: no output, exit 0.
An initial filesystem clippy run found a type error in the new child-worker
fixture. It was corrected before the filesystem tests. The corrected clippy
output appears below. No existing test expectation was changed.

The following are verbatim summary lines from the final gate logs. Complete
logs remain in the gitignored artifacts/ directory. These are per-crate gates,
not workspace gates. The large-Home profile ran alone as an explicit ignored
test. The ignored SIGKILL worker ran through its parent test. The existing
10k-file rclone opt-in test was not run.

cargo clippy -p calternal-fs --all-targets -- -D warnings (exit 0):

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 3.39s

cargo test -p calternal-fs -- --test-threads=2 (exit 0):

test result: ok. 53 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 24.43s
test result: ok. 44 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 11.95s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.05s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo clippy -p calternal-notes-core --all-targets -- -D warnings (exit 0):

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 26.95s

cargo test -p calternal-notes-core -- --test-threads=2 (exit 0):

test result: ok. 521 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.79s
test result: ok. 19 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 7.52s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.11s
test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.64s
test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo clippy -p calternal-plugin-files --all-targets -- -D warnings (exit 0):

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 49s

cargo test -p calternal-plugin-files -- --test-threads=2 (exit 0):

test result: ok. 157 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 245.87s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo clippy -p calternal-collab --all-targets -- -D warnings (exit 0):

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 2m 01s

cargo test -p calternal-collab -- --test-threads=2 (exit 0):

test result: ok. 25 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 8.82s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.38s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.71s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 73.91s
test result: ok. 11 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 10.88s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.06s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.60s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 11.31s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.10s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 47.70s
test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.06s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.68s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 21.24s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

Changed files

  • crates/calternal-fs/src/lib.rs: test-only module registration.
  • crates/calternal-fs/src/review_case_crash.rs: SIGKILL worker and replay test.
  • crates/calternal-fs/tests/voice_memos_review.rs: name classes and symlink check.
  • crates/calternal-notes-core/tests/voice_memos_review.rs: byte boundaries and stale forms.
  • crates/plugins/files/src/lib.rs: test-only module registration.
  • crates/plugins/files/src/tests/voice_memos_review.rs: merge defects, partial replay, profiles.
  • crates/calternal-collab/tests/voice_memos_review.rs: dirty-room external rewrite check.
  • review-findings.md: verdict, evidence, limits and exact gate summaries.

Module comments and the comments of each new test/helper were read again before
this report. No push, deployment, owner-data edit, screenshot or video was made.

Cleanup output, verbatim:

     Removed 10487 files, 6.2GiB total

No web build output was created.

Final independent review: **NO-GO**. Branch: `job/voicememos-review`. Final head: `9200c49b516148d6b78a70650b0443ec4539fbf4`. Reviewed product target: `df30c35a487a0a3eb9aedacbf102beec79e0050a`. Five atomic review commits; tests and report only. All final per-crate gates passed. The passing characterization tests confirm defects; they do not approve the product repair. Build output was cleaned. No push, deployment or owner-data edit. # Voice Memos data-integrity review Verdict: **NO-GO** for #618/#621 at `df30c35a487a0a3eb9aedacbf102beec79e0050a`. Do not run this repair on the owner's Home until the link-identity defect and recording identity / Security state deletion are fixed. This review changes tests and this report only. It makes no product fix. ## Blocking finding: a link changes recording identity Files: `crates/plugins/files/src/lib.rs`, `move_indexed`, `move_voice_memo_path`, and `migrate_voice_memo_home`. Fixture: both Voice Memos spellings contain `shared.m4a`. The legacy file has newer bytes and modification time. The canonical file has older bytes. A Note has one link to each file. The repair keeps the older recording at a conflict-copy path. It moves the newer recording to the canonical shared path. Both byte contents and both file IDs survive. But **both Note links end at the older conflict-copy path**. The link that named the newer recording now plays the older recording. Cause: `move_indexed` rewrites links after each move. At the end, `migrate_voice_memo_home` applies the collected mappings again. The second canonical shared path to conflict-copy mapping catches a link that the legacy shared path to canonical shared path move already changed. Evidence: `review_twin_merge_redirects_newer_recording_link_to_older_copy` in `crates/plugins/files/src/tests/voice_memos_review.rs`. The test compares the whole Note with the observed incorrect output. It also checks file bytes, IDs, CRLF, frontmatter order, unrelated text, and a second run. Required fix: define one replay-safe link transaction that retains the original recording identity. Remove the repeated application of overlapping move mappings. Test both modification-time orders and a restart during each Note write. Do not clear a move intent until its link changes and Index updates are complete. ## Other findings 1. **Blocking: an older source loses Index identity and Security state.** Its conflict copy is made in the legacy folder. The merge does not visit that new entry. It then removes the folder's Index row and tries to remove the nonempty folder. The call fails with `Directory not empty (os error 39)`. The Index deletion is recursive: it also removes the conflict copy's file row, Shares and public links. Bytes survive, but a second run must assign a new recording ID. Security state cannot be rebuilt from recording bytes. The extended test checks all three deletions and the changed ID: `review_older_source_loses_file_id_and_leaves_legacy_folder`. The test passed. Keep the conflict copy at its final destination before folder removal. Do not delete any live descendant's identity or grants. 2. **Two legacy twins without the canonical spelling cannot migrate.** The chosen primary folder's rename meets the normal sibling case-conflict gate. Both attempts return `name_conflict_case`. Neither recording changes. Test: `review_two_legacy_twins_without_canonical_cannot_start`. The recovery path must handle this existing state without weakening the normal new-name gate. 3. **Two Markdown destination forms remain stale.** Percent-encoded paths such as `Documents/Voice%20memos/a.m4a` and reference definitions such as `[audio]: <Documents/Voice memos/a.m4a>` do not change. Their recording can move while the link retains the legacy destination. Test: `review_encoded_and_reference_destinations_remain_stale`. Extend the shared scanner and test the decoded component boundary before the repair runs. 4. **The repair has no hash-based file deduplication.** A file collision always keeps a conflict copy, even for identical content. This avoids an unchecked deletion. The Index deletion defect above can still lose file IDs. The condition “dedupe only when hashes match” is met because this merge deletes no colliding file. Do not describe this merge as hash-based deduplication. Merged source directory IDs are removed; the tested ID guarantee applies to recordings, not to both twin folders. 5. **Legacy invalid new names stop a merge.** New-name normalization rejects trailing spaces and dots. The merge passes each existing child name to this policy. It can therefore stop on imported names. A decomposed name can also fail when it is used as a new destination without NFC normalization. This is a safe abort, not evidence of escape or byte loss. These merge branches were inspected; the name-policy tests exercise the normalization boundary. 6. **There is no durable “done once” flag.** Each `FilesState::reconcile_all` calls the repair. A canonical-only Home incurs a directory check and no link scan. A completed repair is cheap to retry, but it is not permanently disabled. A later legacy folder can trigger it again. ## Confirmed behavior and limits - Distinct same-name recording bytes and file IDs survive the tested merge when the legacy recording is newer. The existing twin-merge test and the new link-identity test check this. - Pure inline Markdown rewrites preserve CRLF, frontmatter order, Unicode, unrelated links, code examples, labels, query strings and anchors in the fixtures. The matching folder prefix has a component boundary. A simple folder rename is idempotent. - A restart after the physical folder rename and one of two Note writes completes both Note and Daily note Log links. The reopened Root and Files state retain folder and recording IDs. Repeated reconciliation preserves the resulting bytes. Test: `review_partial_note_rewrite_replays_after_reopen`. - A worker is killed with SIGKILL after journal publication, after the temporary rename, and after the final rename. Fresh Root recovery finishes each case, retains the recording bytes and inode, removes the temporary name, and is safe on a second replay. Test: `review_sigkill_at_each_case_rename_boundary`. - Root uses `openat2` with `BENEATH`, `NO_SYMLINKS` and `NO_MAGICLINKS`. Namespace changes use held parent handles with `renameat_with`. The review found formatted relative names, but not an ambient filesystem move built from User input. RelPath/InternalPath validate these names before handle resolution. A legacy symlink is rejected and its external target is unchanged. - Folding is **NFC, then default full non-Turkic Unicode case folding**, not simple folding. The code documents it in `calternal-fs/src/path.rs`. Tests cover NFC/NFD equivalence, `ß`/`SS`, ASCII `I`/`i`, dotless `ı`, dotted `İ`, and trailing spaces/dots. This is not evidence from an APFS filesystem. - The repair holds the Home Notes lock and uses a content-hash checked update. It emits Notes invalidations, which the real Hub consumes as external edits. The live-room fixture passed: its live edit, last line, and rewritten attachment each appeared once after duplicate invalidations and a flush. A Hub test is not a browser typing test for all #634 scenarios. This is **not** a proof of crash safety at every multi-file merge boundary. There is no exhaustive SIGKILL matrix for conflict copies, Sidecars, all SQL commit points, every Note write, or power failure during fsync. The three case-rename namespace boundaries and the partial Note replay are covered. The failing identity case alone is enough to block this repair. ## Performance Local debug measurement, shared host, one run with a cached fixture: 100,000 non-Markdown files in Archive and an empty legacy Voice Memos folder. Fixture creation and normal Files indexing are outside the repair timer. | Repair phase | Elapsed | Kernel read bytes delta | Kernel write bytes delta | |---|---:|---:|---:| | First repair | 4,806.097 ms | 0 | 307,200 | | Canonical-only retry | 0.241 ms | 0 | 0 | The process used 1.986 s user CPU and 5.023 s system CPU with 39,472 KiB peak RSS. These process totals include fixture creation, schema setup and cleanup; they are not repair-only CPU/RSS. The full test took 23.65 s. Initial load was 29.25 / 25.14 / 22.86; final load was 31.65 / 26.15 / 23.30. `/proc/self/io` counts disk bytes charged to the process. Cached metadata operations are not proof of zero filesystem work. This profile does not include 100k moved files, linked Notes, conflicts, or a cold filesystem. The affected-folder profile placed 100,000 flat files in the legacy Voice Memos folder and an empty canonical twin beside it. It reached the 30-second bound at **30,008.512 ms**, with only **7 files moved** and 99,993 still in the legacy folder. All 100,000 directory entries remained present. The profile did not complete the repair and did not claim to verify every file's hash or ID. Kernel read-byte delta was 0; write-byte delta was 2,555,904, with 491,520 cancelled write bytes. Process totals, including fixture creation and cleanup: 11.616 s user CPU, 8.111 s system CPU, 98,112 KiB peak RSS, 53.85 s test time. Final host load was 21.13 / 18.78 / 20.72. This is a local debug result from a busy host, not a quiet release measurement. It does not support a claim that repair is cheap for 100k affected files. This SLOW result is not itself a merge blocker. The perf VM lock check succeeded. No exact-target release server was available. The host's shared release binary lacks this migration's completion marker, so its target revision could not be verified and it was not used for this review. No server was deployed or compiled on the perf VM. `docs/perf/baseline.json` has no Voice Memos migration scenario. There is no matching baseline or threshold comparison. The earlier job's local debug profile in `docs/perf/2026-10-02-voice-memos.md` reports 134,307 ms for 128 legacy files, 8 conflicts and 16 linked Notes; it is context, not this review's result. Code review explains the scaling concern: each moved item calls the Notes rewrite, which walks all visible Home entries. The merge also reads the target folder for each child. A flat twin merge can require quadratic directory work and repeated full Home scans. The final batch adds another scan. ## Decisions - Keep product behavior unchanged. Record defects with explicitly named characterization tests. A passing defect test confirms the defect; it is not an acceptance gate. Replace its observed-defect assertion with the intended invariant when the implementation is fixed. - Use process kills only in disposable test Homes. Test partial Note replay through a fresh Root rather than add a product fault-injection API. - Bound the large twin workload. Do not wait for an unbounded 100k-file merge. - Use exact-target local measurements when the shared release does not contain the target change. Label all measurements and their limits. ## UX gaps closed None. This is a tests and code review job. ## UX gaps left The link-identity defect can make a Note play the wrong recording. The merge abort cases leave repair incomplete. No UI was changed or visually reviewed. ## Validation The test head is `335a5fcfe821ddf28089e46fc7322b58b56d02a1`. The final report commit follows this head. Review branch: `job/voicememos-review`. Before the final gates, `git fetch origin` succeeded and `git merge origin/dev` returned, verbatim: ```text Already up to date. ``` The fetched dev head was `c4a61e8cf090170f35b1bed3350d9de20c83ecd5`, already an ancestor of the reviewed target. No product merge commit was made. All cargo commands used `CARGO_PROFILE_DEV_DEBUG=line-tables-only`, `CARGO_INCREMENTAL=0`, `CARGO_BUILD_JOBS=4` and this worktree's `target/tmp` for `TMPDIR`. The preset `CARGO_TARGET_DIR` was not changed. No dependency version or lockfile was changed. No web or server route code was changed. `cargo fmt --check`: no output, exit 0. `git diff --check`: no output, exit 0. An initial filesystem clippy run found a type error in the new child-worker fixture. It was corrected before the filesystem tests. The corrected clippy output appears below. No existing test expectation was changed. The following are verbatim summary lines from the final gate logs. Complete logs remain in the gitignored `artifacts/` directory. These are per-crate gates, not workspace gates. The large-Home profile ran alone as an explicit ignored test. The ignored SIGKILL worker ran through its parent test. The existing 10k-file rclone opt-in test was not run. `cargo clippy -p calternal-fs --all-targets -- -D warnings` (exit 0): ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 3.39s ``` `cargo test -p calternal-fs -- --test-threads=2` (exit 0): ```text test result: ok. 53 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 24.43s test result: ok. 44 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 11.95s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.05s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` `cargo clippy -p calternal-notes-core --all-targets -- -D warnings` (exit 0): ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 26.95s ``` `cargo test -p calternal-notes-core -- --test-threads=2` (exit 0): ```text test result: ok. 521 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.79s test result: ok. 19 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 7.52s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.11s test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.64s test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` `cargo clippy -p calternal-plugin-files --all-targets -- -D warnings` (exit 0): ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 49s ``` `cargo test -p calternal-plugin-files -- --test-threads=2` (exit 0): ```text test result: ok. 157 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 245.87s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` `cargo clippy -p calternal-collab --all-targets -- -D warnings` (exit 0): ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 2m 01s ``` `cargo test -p calternal-collab -- --test-threads=2` (exit 0): ```text test result: ok. 25 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 8.82s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.38s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.71s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 73.91s test result: ok. 11 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 10.88s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.06s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.60s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 11.31s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.10s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 47.70s test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.06s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.68s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 21.24s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` ## Changed files - `crates/calternal-fs/src/lib.rs`: test-only module registration. - `crates/calternal-fs/src/review_case_crash.rs`: SIGKILL worker and replay test. - `crates/calternal-fs/tests/voice_memos_review.rs`: name classes and symlink check. - `crates/calternal-notes-core/tests/voice_memos_review.rs`: byte boundaries and stale forms. - `crates/plugins/files/src/lib.rs`: test-only module registration. - `crates/plugins/files/src/tests/voice_memos_review.rs`: merge defects, partial replay, profiles. - `crates/calternal-collab/tests/voice_memos_review.rs`: dirty-room external rewrite check. - `review-findings.md`: verdict, evidence, limits and exact gate summaries. Module comments and the comments of each new test/helper were read again before this report. No push, deployment, owner-data edit, screenshot or video was made. Cleanup output, verbatim: ```text Removed 10487 files, 6.2GiB total ``` No web build output was created.
kayg commented 2026-10-02 13:23:11 +00:00
Author
Owner
Copy link

Round 2 started on job/voicememos-618, base df30c35a487a0a3eb9aedacbf102beec79e0050a. Imported the independent review tests from 9200c49b5 unchanged. Fixing repeated link mappings and conflict copies left under a removed Index subtree, then moving repair to bounded durable Jobs. No push or deploy.

Round 2 started on `job/voicememos-618`, base `df30c35a487a0a3eb9aedacbf102beec79e0050a`. Imported the independent review tests from `9200c49b5` unchanged. Fixing repeated link mappings and conflict copies left under a removed Index subtree, then moving repair to bounded durable Jobs. No push or deploy.
kayg commented 2026-10-02 13:41:32 +00:00
Author
Owner
Copy link

Round 2 findings and decisions:

  • Removed the second application of overlapping move mappings. A landed move retains its pending intent through Note/Log rewrites and Tags, then commits Item ID and Share/public-link paths.
  • Conflict copies now use the final target directory. Physical empty-directory removal succeeds before recursive Index cleanup, so a nonempty source cannot lose recording identities or grants.
  • Existing twins without the canonical spelling merge before the final case rename. The ordinary new-name gate stays in force.
  • The review also exposed encoded and reference-style destinations; their unchanged fixtures now assert the repaired destination while retaining all unrelated-byte checks.
  • Tag metadata (.calternal.json) must not move ahead of its recordings. The existing Tags writer moves each key; the regression checks its source and Index assignment.
  • Decision: register files.voice-memos-repair in the existing durable Jobs runner, private to its User. Each batch allows at most eight primary moves (a collision may need one extra displacement), checks a two-second soft budget between atomic moves and releases the namespace lock. Completed move intents are the durable cursor, so no directory offset survives a mutation or restart. Startup only queues repair. The shared Jobs view supplies progress, stop/retry, deep links and Copy link.
  • A minimal public Notes helper accepts reconciled Markdown path hints. It reuses the existing hash-checked writer and live-room invalidations; ordinary Files moves retain their Home scan. Repair uses paged source listing and indexed Sidecar hints after reconciliation.

Validation is compiling on the shared host. No dependency version or migration number changed. No push or deploy.

Round 2 findings and decisions: - Removed the second application of overlapping move mappings. A landed move retains its pending intent through Note/Log rewrites and Tags, then commits Item ID and Share/public-link paths. - Conflict copies now use the final target directory. Physical empty-directory removal succeeds before recursive Index cleanup, so a nonempty source cannot lose recording identities or grants. - Existing twins without the canonical spelling merge before the final case rename. The ordinary new-name gate stays in force. - The review also exposed encoded and reference-style destinations; their unchanged fixtures now assert the repaired destination while retaining all unrelated-byte checks. - Tag metadata (`.calternal.json`) must not move ahead of its recordings. The existing Tags writer moves each key; the regression checks its source and Index assignment. - Decision: register `files.voice-memos-repair` in the existing durable Jobs runner, private to its User. Each batch allows at most eight primary moves (a collision may need one extra displacement), checks a two-second soft budget between atomic moves and releases the namespace lock. Completed move intents are the durable cursor, so no directory offset survives a mutation or restart. Startup only queues repair. The shared Jobs view supplies progress, stop/retry, deep links and Copy link. - A minimal public Notes helper accepts reconciled Markdown path hints. It reuses the existing hash-checked writer and live-room invalidations; ordinary Files moves retain their Home scan. Repair uses paged source listing and indexed Sidecar hints after reconciliation. Validation is compiling on the shared host. No dependency version or migration number changed. No push or deploy.
kayg commented 2026-10-02 14:58:13 +00:00
Author
Owner
Copy link

Round 2 finding: delaying the repair exposed a recording failure while case twins remain. Tus creation used to reject the ambiguous folder with 409. The repair now persists the chosen folder Item ID in the queued Job, and routed recording uploads use that ID under the existing Home writer lock. Upload finalization already follows its stored parent Item ID across folder moves. Added a regression for both canonical-present and two-legacy-folder fixtures. No UI source or new endpoint is required; existing Background Work renders the registered Job.

Build validation is running with four compiler workers. The shared compiler cache caused long waits; this worktree now uses direct compiler calls.

Round 2 finding: delaying the repair exposed a recording failure while case twins remain. Tus creation used to reject the ambiguous folder with 409. The repair now persists the chosen folder Item ID in the queued Job, and routed recording uploads use that ID under the existing Home writer lock. Upload finalization already follows its stored parent Item ID across folder moves. Added a regression for both canonical-present and two-legacy-folder fixtures. No UI source or new endpoint is required; existing Background Work renders the registered Job. Build validation is running with four compiler workers. The shared compiler cache caused long waits; this worktree now uses direct compiler calls.
kayg commented 2026-10-02 15:44:49 +00:00
Author
Owner
Copy link

Validation progress: Files compiled without reported Rust errors and reached test-binary linking. At 15:44 UTC, its linker chain was cc → collect2 → ld.lld (shell wrapper) → ld-wrapper.sh; the wrapper child showed 0 CPU time after about eight minutes elapsed. The shared host linker coordination remains in force. Per-crate gates and the real-server build are queued. Source includes regressions for Calendar attachment projection, stopped-repair recording routing, and empty-directory batch bounds.

Validation progress: Files compiled without reported Rust errors and reached test-binary linking. At 15:44 UTC, its linker chain was `cc → collect2 → ld.lld (shell wrapper) → ld-wrapper.sh`; the wrapper child showed 0 CPU time after about eight minutes elapsed. The shared host linker coordination remains in force. Per-crate gates and the real-server build are queued. Source includes regressions for Calendar attachment projection, stopped-repair recording routing, and empty-directory batch bounds.
kayg commented 2026-10-02 16:01:13 +00:00
Author
Owner
Copy link

Head: 6c47ebb8e. Focused integrity validation is green. Both independent NO-GO fixtures now assert identity preservation, with their original byte-sensitive recording and Note fixtures retained. Also green: partial Note rewrite replay in both conflict orders, restart between batches, persisted primary identity after an mtime change, retained Tags and Calendar attachment projection, recording while queued or stopped, Notes inside the moved folder, and empty-directory batch bounds.

Command: cargo test -p calternal-plugin-files voice_memo -- --test-threads=2

test result: ok. 17 passed; 0 failed; 2 ignored; 0 measured; 147 filtered out; finished in 364.78s

The two ignored tests are explicit 100k-file profiles. Full per-crate gates, the process-kill filesystem replay suite and the real-server evidence build remain in progress. No push, deploy or merge.

Head: `6c47ebb8e`. Focused integrity validation is green. Both independent NO-GO fixtures now assert identity preservation, with their original byte-sensitive recording and Note fixtures retained. Also green: partial Note rewrite replay in both conflict orders, restart between batches, persisted primary identity after an mtime change, retained Tags and Calendar attachment projection, recording while queued or stopped, Notes inside the moved folder, and empty-directory batch bounds. Command: `cargo test -p calternal-plugin-files voice_memo -- --test-threads=2` ```text test result: ok. 17 passed; 0 failed; 2 ignored; 0 measured; 147 filtered out; finished in 364.78s ``` The two ignored tests are explicit 100k-file profiles. Full per-crate gates, the process-kill filesystem replay suite and the real-server evidence build remain in progress. No push, deploy or merge.
kayg commented 2026-10-02 17:19:01 +00:00
Author
Owner
Copy link

Round 2 report — implemented; full validation incomplete at the four-hour limit.

Branch: job/voicememos-618. Head: 8f929eefc6d512c520f784a1ac63cd628f85b866.

Built:

  • Each recording move rewrites only its own link mapping. The final overlapping mapping replay is removed. Newer and older recording links retain their original Item ID targets.
  • An older source moves directly to a conflict name in the final directory. Physical folder removal succeeds before Index cleanup. Recording Item IDs, Shares, public links, Tags and Calendar attachment targets survive retry.
  • Startup queues a durable private files.voice-memos-repair Job. Small batches release the Home writer. Move intents and remaining source entries support restart. The chosen folder Item ID is persisted before work starts.
  • Recording uses that folder identity while repair is queued or stopped. Existing Background Work supplies the Job view, progress and controls. Markdown support now covers encoded and reference destinations without changing unrelated bytes.

The independent tests were imported unchanged from 9200c49b5 in 5aea05d05. Their defect-characterization expectations were then changed to the correct invariants required by this issue; original byte-sensitive fixtures and grant checks remain. No unrelated existing expectation was changed.

Files:

bench/voice-memo-batches-618.sh
crates/calternal-collab/tests/voice_memos_review.rs
crates/calternal-fs/src/lib.rs
crates/calternal-fs/src/review_case_crash.rs
crates/calternal-fs/tests/voice_memos_review.rs
crates/calternal-notes-core/src/links.rs
crates/calternal-notes-core/tests/voice_memos_review.rs
crates/plugins/files/src/index.rs
crates/plugins/files/src/lib.rs
crates/plugins/files/src/tests/voice_memos_review.rs
crates/plugins/files/src/uploads.rs
crates/plugins/notes/src/lib.rs
docs/DESIGN.md
docs/perf/2026-10-02-voice-memos-round2.md

Completed checks, with output verbatim:

cargo fmt --check: exit 0, no output.

cargo clippy -p calternal-notes-core --all-targets -- -D warnings:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 8m 51s

cargo test -p calternal-notes-core:

test result: ok. 521 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.61s
test result: ok. 19 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 12.21s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.22s
test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 7.65s
test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo clippy -p calternal-plugin-files --all-targets -- -D warnings:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 77m 54s

Focused Files integrity/replay tests:

test result: ok. 17 passed; 0 failed; 2 ignored; 0 measured; 147 filtered out; finished in 364.78s

100k-file bounded profile:

100k queue p50_ms=33.448 p95_ms=50.931; batch p50_ms=5942.611 p95_ms=14987.863; moved=4
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 165 filtered out; finished in 231.86s

Production web build completed:

✓ built in 6m 9s

Known gaps / remaining checks:

  • The full Files suite was still running at the time limit. No failure was reported in its output before it was stopped. This is not a full-suite pass.
  • Notes, Filesystem, Collab and Server per-crate gates remain incomplete. The imported filesystem SIGKILL replay suite and Collab live-room review test have not run. The plugin-level interrupted Note-write and restart tests are green.
  • The server build did not finish. No real-server adversarial round, real-server average/upload-burst profile, or macOS screenshot set was completed. Do not treat this branch as merge-validated.
  • The two-second batch budget is soft: one atomic move can exceed it. The 100k local profile indexes folders only, as the independent profile did; it includes lazy file adoption. It measures three batches, not full completion. There is no matched Voice Memos scenario in docs/perf/baseline.json, so no baseline regression can be established.

Performance: local shared host, load 134.09 before / 145.10 after. Whole-test CPU was 0.773 s user + 6.893 s system; sampled mean RSS 42,304,492 bytes, peak 43,962,368 bytes. Resources include fixture setup and cleanup. Details and limits are in docs/perf/2026-10-02-voice-memos-round2.md.

UX gaps closed: recording remains available during queued repair and after Stop; primary choice cannot oscillate after a restart; each committed move publishes Files refresh events. Calendar's attachment projection retains the recording target and Item ID in the regression.

UX gaps left: Jobs controls and layout still require a real production screenshot walk at phone, tablet and desktop widths in both themes with macOS rendering. The prepared screenshot runner is in ignored artifacts/voice-memo-jobs-macos.mjs; no screenshot artifacts were committed.

Decisions:

  • Reuse existing private Jobs and Background Work instead of adding a screen or endpoint.
  • Bound work by eight changes and a two-second check between atomic moves; count empty folder merges. A collision can require one extra displacement. Release the writer between batches.
  • Persist the destination Item ID at enqueue time; canonical spelling wins, otherwise use the newest folder. Stop controls repair, not recording availability.
  • Use reconciled Markdown/Sidecar hints for repair; ordinary moves retain their filesystem fallback. Keep non-replacing Tag writes inside the move intent; retain existing replacement ordering.

One git fetch origin / git merge origin/dev refresh was done before gates and returned Already up to date. No dependencies or migrations changed. No push, deploy, issue close or promotion was done. The shared compiler/linker queues consumed most of the time budget. Commits preserve completed source; some were made while full execution gates were pending, as reported during the job.

Round 2 report — implemented; full validation incomplete at the four-hour limit. Branch: `job/voicememos-618`. Head: `8f929eefc6d512c520f784a1ac63cd628f85b866`. Built: - Each recording move rewrites only its own link mapping. The final overlapping mapping replay is removed. Newer and older recording links retain their original Item ID targets. - An older source moves directly to a conflict name in the final directory. Physical folder removal succeeds before Index cleanup. Recording Item IDs, Shares, public links, Tags and Calendar attachment targets survive retry. - Startup queues a durable private `files.voice-memos-repair` Job. Small batches release the Home writer. Move intents and remaining source entries support restart. The chosen folder Item ID is persisted before work starts. - Recording uses that folder identity while repair is queued or stopped. Existing Background Work supplies the Job view, progress and controls. Markdown support now covers encoded and reference destinations without changing unrelated bytes. The independent tests were imported unchanged from `9200c49b5` in `5aea05d05`. Their defect-characterization expectations were then changed to the correct invariants required by this issue; original byte-sensitive fixtures and grant checks remain. No unrelated existing expectation was changed. Files: ```text bench/voice-memo-batches-618.sh crates/calternal-collab/tests/voice_memos_review.rs crates/calternal-fs/src/lib.rs crates/calternal-fs/src/review_case_crash.rs crates/calternal-fs/tests/voice_memos_review.rs crates/calternal-notes-core/src/links.rs crates/calternal-notes-core/tests/voice_memos_review.rs crates/plugins/files/src/index.rs crates/plugins/files/src/lib.rs crates/plugins/files/src/tests/voice_memos_review.rs crates/plugins/files/src/uploads.rs crates/plugins/notes/src/lib.rs docs/DESIGN.md docs/perf/2026-10-02-voice-memos-round2.md ``` Completed checks, with output verbatim: `cargo fmt --check`: exit 0, no output. `cargo clippy -p calternal-notes-core --all-targets -- -D warnings`: ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 8m 51s ``` `cargo test -p calternal-notes-core`: ```text test result: ok. 521 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.61s test result: ok. 19 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 12.21s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.22s test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 7.65s test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` `cargo clippy -p calternal-plugin-files --all-targets -- -D warnings`: ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 77m 54s ``` Focused Files integrity/replay tests: ```text test result: ok. 17 passed; 0 failed; 2 ignored; 0 measured; 147 filtered out; finished in 364.78s ``` 100k-file bounded profile: ```text 100k queue p50_ms=33.448 p95_ms=50.931; batch p50_ms=5942.611 p95_ms=14987.863; moved=4 test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 165 filtered out; finished in 231.86s ``` Production web build completed: ```text ✓ built in 6m 9s ``` Known gaps / remaining checks: - The full Files suite was still running at the time limit. No failure was reported in its output before it was stopped. This is not a full-suite pass. - Notes, Filesystem, Collab and Server per-crate gates remain incomplete. The imported filesystem SIGKILL replay suite and Collab live-room review test have not run. The plugin-level interrupted Note-write and restart tests are green. - The server build did not finish. No real-server adversarial round, real-server average/upload-burst profile, or macOS screenshot set was completed. Do not treat this branch as merge-validated. - The two-second batch budget is soft: one atomic move can exceed it. The 100k local profile indexes folders only, as the independent profile did; it includes lazy file adoption. It measures three batches, not full completion. There is no matched Voice Memos scenario in `docs/perf/baseline.json`, so no baseline regression can be established. Performance: local shared host, load 134.09 before / 145.10 after. Whole-test CPU was 0.773 s user + 6.893 s system; sampled mean RSS 42,304,492 bytes, peak 43,962,368 bytes. Resources include fixture setup and cleanup. Details and limits are in `docs/perf/2026-10-02-voice-memos-round2.md`. UX gaps closed: recording remains available during queued repair and after Stop; primary choice cannot oscillate after a restart; each committed move publishes Files refresh events. Calendar's attachment projection retains the recording target and Item ID in the regression. UX gaps left: Jobs controls and layout still require a real production screenshot walk at phone, tablet and desktop widths in both themes with macOS rendering. The prepared screenshot runner is in ignored `artifacts/voice-memo-jobs-macos.mjs`; no screenshot artifacts were committed. Decisions: - Reuse existing private Jobs and Background Work instead of adding a screen or endpoint. - Bound work by eight changes and a two-second check between atomic moves; count empty folder merges. A collision can require one extra displacement. Release the writer between batches. - Persist the destination Item ID at enqueue time; canonical spelling wins, otherwise use the newest folder. Stop controls repair, not recording availability. - Use reconciled Markdown/Sidecar hints for repair; ordinary moves retain their filesystem fallback. Keep non-replacing Tag writes inside the move intent; retain existing replacement ordering. One `git fetch origin` / `git merge origin/dev` refresh was done before gates and returned `Already up to date.` No dependencies or migrations changed. No push, deploy, issue close or promotion was done. The shared compiler/linker queues consumed most of the time budget. Commits preserve completed source; some were made while full execution gates were pending, as reported during the job.
kayg commented 2026-10-02 17:20:56 +00:00
Author
Owner
Copy link

Correction to the final report: the full Files log contains this failure, found during final log inspection:

test tests::internal_temp_paths_never_enter_index_during_atomic_write_reconcile_storm ... FAILED

The previous “no failure was reported” statement was wrong. The suite was interrupted before its captured failure diagnostics were printed. The failure remains unresolved and unclassified; it is not established as SLOW. Do not merge on the focused-test result. Full per-crate gates, filesystem SIGKILL / Collab review tests, server checks and visual evidence remain incomplete as listed above.

Cleanup completed: cargo clean output was Removed 9807 files, 4.0GiB total; verified generated web output was removed. Working tree is clean. Head remains 8f929eefc6d512c520f784a1ac63cd628f85b866. No test expectation was changed to hide this failure.

Correction to the final report: the full Files log contains this failure, found during final log inspection: ```text test tests::internal_temp_paths_never_enter_index_during_atomic_write_reconcile_storm ... FAILED ``` The previous “no failure was reported” statement was wrong. The suite was interrupted before its captured failure diagnostics were printed. The failure remains unresolved and unclassified; it is not established as SLOW. Do not merge on the focused-test result. Full per-crate gates, filesystem SIGKILL / Collab review tests, server checks and visual evidence remain incomplete as listed above. Cleanup completed: `cargo clean` output was ` Removed 9807 files, 4.0GiB total`; verified generated web output was removed. Working tree is clean. Head remains `8f929eefc6d512c520f784a1ac63cd628f85b866`. No test expectation was changed to hide this failure.
kayg commented 2026-10-02 17:34:07 +00:00
Author
Owner
Copy link

Read-only review starts on job/rev2-voicememos-618, base 440e19dce23040ac8ebaae88f0469b6535b1afcb.

Target: origin/dev...8f929eefc in job/voicememos-618. Scope: recording identity in conflict moves and repair jobs. I will read code and tests only. The LIGHT review rule prohibits builds, tests, servers and browsers. I will commit audit-findings.md and review-voicememos-618.md in the review worktree.

Read-only review starts on `job/rev2-voicememos-618`, base `440e19dce23040ac8ebaae88f0469b6535b1afcb`. Target: `origin/dev...8f929eefc` in `job/voicememos-618`. Scope: recording identity in conflict moves and repair jobs. I will read code and tests only. The LIGHT review rule prohibits builds, tests, servers and browsers. I will commit `audit-findings.md` and `review-voicememos-618.md` in the review worktree.
kayg commented 2026-10-02 17:41:13 +00:00
Author
Owner
Copy link

Independent read-only review completed. Target: 8f929eefc. Review head: c284a0dcbe53fb70d0fb3353d883d41410037292 on job/rev2-voicememos-618.

Request changes.

  • P1 — Same-process repair retry can delete recording identity and grants. crates/plugins/files/src/lib.rs:1446, :1607-1628; crates/plugins/files/src/index.rs:1436-1449. A rename can land before a Note rewrite fails. The Job retry does not replay its pending move. It can remove the empty legacy folder and delete the old recording row, Share and public link, then report success with the move still pending. Fix: reuse pending-move recovery under the namespace lock before retry and prevent source cleanup while intents remain. Test: fail one Note write after rename, retry without restart or full reconciliation, and assert the original item ID and grants. Existing restart fixtures miss this case. This evidence belongs to #618.
  • P2 — Folder merges invalidate active upload parents. crates/plugins/files/src/lib.rs:1619-1628, :1789-1803; crates/plugins/files/src/uploads.rs:1416-1430. A ticket opened against the legacy or a nested source folder loses its parent ID when repair merges that directory away. Its final PATCH returns 412. Fix: retain the source while uploads are active, or use a User-scoped merge mapping to update tickets under the writer lock; keep preconditions and authorization. Test POST → repair → final PATCH, including nested, target-collision and second-User cases. Filed as #904, after searching existing issues and reading #627.

Built/files: audit-findings.md and review-voicememos-618.md, committed in two atomic documentation commits. No product changes. No new cross-User access defect or weakened expectation found in the inspected diff. No P3 defect reported.

Gate output verbatim: none — no gate was run. The LIGHT contract prohibits builds, tests, servers and browsers. git diff --check returned exit 0 with no output. No push, deploy or merge ran. There was no build output to clean.

Known gaps: the two findings are source traces, not executed reproductions. They need focused regression tests and fixes. Performance and Apple-client checks did not run. UX gaps closed: none. UX gaps left: paused recording uploads can fail after a merge (P2).

Decisions: no new product design. P1 remains on #618. P2 is #904 because its active-upload merge fix differs from #627's re-index fix. Target DESIGN ends at §57; the brief's §58 is absent. Performance inspection used §§2, 6 and 40 and owner rules.

For the merge round, after adding regressions, run with the required Cargo environment:

cargo test -p calternal-plugin-files voice_memos_review
cargo test -p calternal-fs review_case_crash
cargo test -p calternal-notes-core --test voice_memos_review
cargo test -p calternal-collab --test voice_memos_review

Prove bytes, item IDs, Shares, public links, Note targets and live edits survive restart and same-process retry. The first command must include the new failed-move retry and paused-upload tests. The merge round owns full gates and server adversarial checks.

Independent read-only review completed. Target: `8f929eefc`. Review head: `c284a0dcbe53fb70d0fb3353d883d41410037292` on `job/rev2-voicememos-618`. Request changes. - **P1 — Same-process repair retry can delete recording identity and grants.** `crates/plugins/files/src/lib.rs:1446`, `:1607-1628`; `crates/plugins/files/src/index.rs:1436-1449`. A rename can land before a Note rewrite fails. The Job retry does not replay its pending move. It can remove the empty legacy folder and delete the old recording row, Share and public link, then report success with the move still pending. Fix: reuse pending-move recovery under the namespace lock before retry and prevent source cleanup while intents remain. Test: fail one Note write after rename, retry without restart or full reconciliation, and assert the original item ID and grants. Existing restart fixtures miss this case. This evidence belongs to #618. - **P2 — Folder merges invalidate active upload parents.** `crates/plugins/files/src/lib.rs:1619-1628`, `:1789-1803`; `crates/plugins/files/src/uploads.rs:1416-1430`. A ticket opened against the legacy or a nested source folder loses its parent ID when repair merges that directory away. Its final PATCH returns 412. Fix: retain the source while uploads are active, or use a User-scoped merge mapping to update tickets under the writer lock; keep preconditions and authorization. Test POST → repair → final PATCH, including nested, target-collision and second-User cases. Filed as [#904](https://git.kayg.org/kayg/calternal/issues/904), after searching existing issues and reading #627. Built/files: `audit-findings.md` and `review-voicememos-618.md`, committed in two atomic documentation commits. No product changes. No new cross-User access defect or weakened expectation found in the inspected diff. No P3 defect reported. Gate output verbatim: **none — no gate was run.** The LIGHT contract prohibits builds, tests, servers and browsers. `git diff --check` returned exit 0 with no output. No push, deploy or merge ran. There was no build output to clean. Known gaps: the two findings are source traces, not executed reproductions. They need focused regression tests and fixes. Performance and Apple-client checks did not run. UX gaps closed: none. UX gaps left: paused recording uploads can fail after a merge (P2). Decisions: no new product design. P1 remains on #618. P2 is #904 because its active-upload merge fix differs from #627's re-index fix. Target DESIGN ends at §57; the brief's §58 is absent. Performance inspection used §§2, 6 and 40 and owner rules. For the merge round, after adding regressions, run with the required Cargo environment: ```sh cargo test -p calternal-plugin-files voice_memos_review cargo test -p calternal-fs review_case_crash cargo test -p calternal-notes-core --test voice_memos_review cargo test -p calternal-collab --test voice_memos_review ``` Prove bytes, item IDs, Shares, public links, Note targets and live edits survive restart and same-process retry. The first command must include the new failed-move retry and paused-upload tests. The merge round owns full gates and server adversarial checks.
kayg commented 2026-10-02 19:52:16 +00:00
Author
Owner
Copy link

Round 3 starts on job/voicememos-618, base 8f929eefc6d512c520f784a1ac63cd628f85b866. Read the independent review at c284a0dcbe53fb70d0fb3353d883d41410037292. Fix P1 retry recovery and P2 active-upload parent retention with focused regressions first. The latest verification policy assigns full e2e/adversarial matrices, release builds, Mac interop and non-performance-issue measurements to the merge round. No push or deployment.

Round 3 starts on `job/voicememos-618`, base `8f929eefc6d512c520f784a1ac63cd628f85b866`. Read the independent review at `c284a0dcbe53fb70d0fb3353d883d41410037292`. Fix P1 retry recovery and P2 active-upload parent retention with focused regressions first. The latest verification policy assigns full e2e/adversarial matrices, release builds, Mac interop and non-performance-issue measurements to the merge round. No push or deployment.
kayg commented 2026-10-02 20:09:27 +00:00
Author
Owner
Copy link

Round 3 source findings:

  • P1: migrate_voice_memo_home walks disk entries without index::recover_moves. A rename followed by a failed Note write leaves the old Index prefix and grants under a now-empty source folder. A same-process retry can remove that prefix. The new fixture denies writes to Notes for one attempt and retries the real Job handler with the stored payload; it checks Item IDs, both grant kinds, bytes, Note targets and pending intents in an empty-target case and both conflict orders.
  • Folder reconciliation also needs recovery under its namespace lock. Full reconciliation drops that lock between move recovery and its scan; it must replay any newly failed move after it acquires the scan lock.
  • P2/#904: a Tus ticket retains parent_item_id. A directory merge removes that Index identity, so finalization cannot resolve the parent. Decision: retain a source subtree with active uploads and use the existing Job retry/backoff. Do not rewrite ticket identities or transfer a source folder grant to a broader target. The paused-upload fixture covers direct and nested parents, two Users, target collisions and source folder grants.

Merged origin/dev once as e5573dcb4. No dependency or migration change. Production web build passed. The regression build is still compiling; the shared-host load average reached 113.01. Compiler workers are capped at four. No executable fix claim yet. No push or deployment.

Round 3 source findings: - P1: `migrate_voice_memo_home` walks disk entries without `index::recover_moves`. A rename followed by a failed Note write leaves the old Index prefix and grants under a now-empty source folder. A same-process retry can remove that prefix. The new fixture denies writes to Notes for one attempt and retries the real Job handler with the stored payload; it checks Item IDs, both grant kinds, bytes, Note targets and pending intents in an empty-target case and both conflict orders. - Folder reconciliation also needs recovery under its namespace lock. Full reconciliation drops that lock between move recovery and its scan; it must replay any newly failed move after it acquires the scan lock. - P2/#904: a Tus ticket retains `parent_item_id`. A directory merge removes that Index identity, so finalization cannot resolve the parent. Decision: retain a source subtree with active uploads and use the existing Job retry/backoff. Do not rewrite ticket identities or transfer a source folder grant to a broader target. The paused-upload fixture covers direct and nested parents, two Users, target collisions and source folder grants. Merged `origin/dev` once as `e5573dcb4`. No dependency or migration change. Production web build passed. The regression build is still compiling; the shared-host load average reached 113.01. Compiler workers are capped at four. No executable fix claim yet. No push or deployment.
kayg commented 2026-10-02 20:30:24 +00:00
Author
Owner
Copy link

Both independent findings reproduced before the fixes:

  • Same-process Job retry: the original Item ID lookup returned RowNotFound after the source prefix was removed.
  • Stale-folder reconciliation: it returned success after removing the old rows while a landed move still had a failed Note rewrite.
  • Paused upload: repair removed the ticket's stored parent Item ID (None instead of the original ID).

The fixes replay pending moves under the namespace lock before repair or folder scans and retain source subtrees while active uploads use them. Full scans repeat recovery after reacquiring their scan lock. Expired ordinary tickets do not hold a folder; pending installation intents do. No ticket identity, destination precondition or authorization check changes.

The Note-write fault now uses a file in place of its Version directory, so it fails for root as well as an ordinary operating-system User. No product fault hook was added.

Focused review command: cargo test -p calternal-plugin-files voice_memos_review -- --nocapture --test-threads=2

test result: ok. 13 passed; 0 failed; 2 ignored; 0 measured; 154 filtered out; finished in 115.11s

This includes empty-target and both conflict orders, same-process retry, stale scans, paused direct/nested upload parents, two Users, destination collisions, source-folder grant isolation, retained Tags and Calendar attachments, and restart fixtures. The ignored tests are explicit 100k performance profiles. The existing assertions were retained; stale test names now state the correct invariants.

cargo fmt --check passed with no output. bun run check returned:

svelte-check found 0 errors and 0 warnings

Serial crate gates are in progress. Product commits follow the working gate results. No push or deployment.

Both independent findings reproduced before the fixes: - Same-process Job retry: the original Item ID lookup returned `RowNotFound` after the source prefix was removed. - Stale-folder reconciliation: it returned success after removing the old rows while a landed move still had a failed Note rewrite. - Paused upload: repair removed the ticket's stored parent Item ID (`None` instead of the original ID). The fixes replay pending moves under the namespace lock before repair or folder scans and retain source subtrees while active uploads use them. Full scans repeat recovery after reacquiring their scan lock. Expired ordinary tickets do not hold a folder; pending installation intents do. No ticket identity, destination precondition or authorization check changes. The Note-write fault now uses a file in place of its Version directory, so it fails for root as well as an ordinary operating-system User. No product fault hook was added. Focused review command: `cargo test -p calternal-plugin-files voice_memos_review -- --nocapture --test-threads=2` ```text test result: ok. 13 passed; 0 failed; 2 ignored; 0 measured; 154 filtered out; finished in 115.11s ``` This includes empty-target and both conflict orders, same-process retry, stale scans, paused direct/nested upload parents, two Users, destination collisions, source-folder grant isolation, retained Tags and Calendar attachments, and restart fixtures. The ignored tests are explicit 100k performance profiles. The existing assertions were retained; stale test names now state the correct invariants. `cargo fmt --check` passed with no output. `bun run check` returned: ```text svelte-check found 0 errors and 0 warnings ``` Serial crate gates are in progress. Product commits follow the working gate results. No push or deployment.
kayg commented 2026-10-02 20:48:14 +00:00
Author
Owner
Copy link

Round 3 fixes saved in two atomic commits:

  • a47def54c: recover landed moves before repair retries and folder scans; retain recording identities and grants after a failed Note write.
  • 244d3e5f89c866a90e4d3c37cb3c07b8143fab57: defer directory merges while active uploads use source parents; retain upload preconditions and source grant boundaries.

Focused review suite: 13 passed, 0 failed, 2 explicit performance profiles ignored. Files fmt and clippy passed. Web check returned 0 errors and 0 warnings. The full serial crate gate round is still running; its Files test binary is rebuilding. These are progress commits, not a full-suite completion claim. No push or deployment.

Round 3 fixes saved in two atomic commits: - `a47def54c`: recover landed moves before repair retries and folder scans; retain recording identities and grants after a failed Note write. - `244d3e5f89c866a90e4d3c37cb3c07b8143fab57`: defer directory merges while active uploads use source parents; retain upload preconditions and source grant boundaries. Focused review suite: 13 passed, 0 failed, 2 explicit performance profiles ignored. Files fmt and clippy passed. Web check returned 0 errors and 0 warnings. The full serial crate gate round is still running; its Files test binary is rebuilding. These are progress commits, not a full-suite completion claim. No push or deployment.
kayg commented 2026-10-02 21:18:17 +00:00
Author
Owner
Copy link

Full Files verification found the earlier failure again. The complete diagnostics are now captured with --nocapture:

writes, reconcile scans, and watcher adoption complete within five minutes: Elapsed(())
atomic write 220 failed: entry not found

The first panic is the unchanged 300-second limit. The second follows abort and temporary Home cleanup: the test keeps only AbortHandles, so its timed-out JoinHandles are dropped before cancellation finishes. The temporary directory can be removed while a worker is still inside a filesystem step. The cleanup now retains and joins all workers before TempDir drops. No timeout, fixture size, status code or assertion is weakened. A focused rerun will determine whether the five-minute bound passes on this host; the full suite result remains a failure until then.

A separate source check found an ASCII-only Voice Memos rewrite classifier while folder discovery uses full Unicode folding. Added a focused two-legacy-twin conflict regression using long s, which discovery treats as ASCII s. It is compiling behind the shared Cargo cache lock. No fix claim yet.

Full Files verification found the earlier failure again. The complete diagnostics are now captured with `--nocapture`: ```text writes, reconcile scans, and watcher adoption complete within five minutes: Elapsed(()) atomic write 220 failed: entry not found ``` The first panic is the unchanged 300-second limit. The second follows abort and temporary Home cleanup: the test keeps only AbortHandles, so its timed-out JoinHandles are dropped before cancellation finishes. The temporary directory can be removed while a worker is still inside a filesystem step. The cleanup now retains and joins all workers before TempDir drops. No timeout, fixture size, status code or assertion is weakened. A focused rerun will determine whether the five-minute bound passes on this host; the full suite result remains a failure until then. A separate source check found an ASCII-only Voice Memos rewrite classifier while folder discovery uses full Unicode folding. Added a focused two-legacy-twin conflict regression using long s, which discovery treats as ASCII s. It is compiling behind the shared Cargo cache lock. No fix claim yet.
kayg commented 2026-10-02 21:38:29 +00:00
Author
Owner
Copy link

Additional source finding: Files folder discovery uses NFC plus full Unicode case folding, while its Voice Memos attachment rewrite classifier used ASCII case comparison. Two imported folders containing long s can therefore be discovered as twins but skip per-file link rewrites before their folder links merge. A new conflict regression asserts both recording IDs, bytes and exact Note targets. Its pre-fix test build is still running; no pass claim.

The implementation reuses the existing calternal-fs name key. The only cross-crate addition is exporting fold_name; filesystem behavior and the name policy do not change. ASCII comparisons retain their allocation-free path.

The full Files test result is:

test result: FAILED. 165 passed; 1 failed; 3 ignored; 0 measured; 0 filtered out; finished in 2303.45s

The one failure is the unchanged five-minute write/reconcile stress bound. Its cancellation cleanup now joins workers before deleting their temporary Home. A focused rerun and final Files clippy are queued. The other crate gates and debug server build are queued on the same target lock. No push or deployment.

Additional source finding: Files folder discovery uses NFC plus full Unicode case folding, while its Voice Memos attachment rewrite classifier used ASCII case comparison. Two imported folders containing long s can therefore be discovered as twins but skip per-file link rewrites before their folder links merge. A new conflict regression asserts both recording IDs, bytes and exact Note targets. Its pre-fix test build is still running; no pass claim. The implementation reuses the existing calternal-fs name key. The only cross-crate addition is exporting `fold_name`; filesystem behavior and the name policy do not change. ASCII comparisons retain their allocation-free path. The full Files test result is: ```text test result: FAILED. 165 passed; 1 failed; 3 ignored; 0 measured; 0 filtered out; finished in 2303.45s ``` The one failure is the unchanged five-minute write/reconcile stress bound. Its cancellation cleanup now joins workers before deleting their temporary Home. A focused rerun and final Files clippy are queued. The other crate gates and debug server build are queued on the same target lock. No push or deployment.
kayg commented 2026-10-02 21:50:52 +00:00
Author
Owner
Copy link

Saved f86da93b4: corrected the repair comment to match its existing order: merge imported twins into the chosen primary, then perform the final canonical rename. This is a documentation-only commit.

P1 and P2 fixes remain in a47def54c and 244d3e5f8. The Unicode conflict regression and storm-cleanup follow-ups are awaiting verification. The pre-fix Files test build has reached linking after over 35 minutes; the other gates and current debug server build remain queued. Chromium starts successfully. No push or deployment.

Saved `f86da93b4`: corrected the repair comment to match its existing order: merge imported twins into the chosen primary, then perform the final canonical rename. This is a documentation-only commit. P1 and P2 fixes remain in `a47def54c` and `244d3e5f8`. The Unicode conflict regression and storm-cleanup follow-ups are awaiting verification. The pre-fix Files test build has reached linking after over 35 minutes; the other gates and current debug server build remain queued. Chromium starts successfully. No push or deployment.
kayg commented 2026-10-02 21:55:47 +00:00
Author
Owner
Copy link

The pre-fix Unicode conflict regression reproduced a link-identity failure. Both Note links became Documents/Voice Memos/shared.m4a; the first must target the older recording's stable conflict copy. Bytes and item IDs survived, but its Note link pointed to the newer recording.

    Finished `test` profile [unoptimized + debuginfo] target(s) in 46m 52s
test tests::voice_memos_review::review_unicode_folded_twins_keep_conflict_link_identities ... FAILED
test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 169 filtered out; finished in 9.99s

The correction uses the existing full Unicode name key, with the ASCII fast path retained. Green verification is queued. Full diagnostics are in artifacts/unicode-red.log. No existing expectation was changed.

The pre-fix Unicode conflict regression reproduced a link-identity failure. Both Note links became `Documents/Voice Memos/shared.m4a`; the first must target the older recording's stable conflict copy. Bytes and item IDs survived, but its Note link pointed to the newer recording. ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 46m 52s test tests::voice_memos_review::review_unicode_folded_twins_keep_conflict_link_identities ... FAILED test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 169 filtered out; finished in 9.99s ``` The correction uses the existing full Unicode name key, with the ASCII fast path retained. Green verification is queued. Full diagnostics are in `artifacts/unicode-red.log`. No existing expectation was changed.
kayg commented 2026-10-02 22:03:24 +00:00
Author
Owner
Copy link

Follow-ups saved as separate progress commits to keep the work recoverable:

  • 47ebf7f71: join cancelled stress workers before temporary Home cleanup; preserve all workload sizes, timeouts and assertions.
  • 1606aa9f738cf137169ae4d6fa6c3d4fd5cc4071: use the filesystem Unicode name key for Voice Memos link repair and add the reproduced long-s twin conflict regression. The calternal-fs change exports an existing helper; it does not change filesystem behavior.

The Unicode test failed against the pre-fix binary as reported above. Its green rerun, the focused stress rerun and final Files clippy are queued behind Notes clippy. Full verification is pending for these progress commits. The earlier P1/P2 focused suite passed, while the full Files suite has its recorded five-minute stress timeout. No push or deployment.

Follow-ups saved as separate progress commits to keep the work recoverable: - `47ebf7f71`: join cancelled stress workers before temporary Home cleanup; preserve all workload sizes, timeouts and assertions. - `1606aa9f738cf137169ae4d6fa6c3d4fd5cc4071`: use the filesystem Unicode name key for Voice Memos link repair and add the reproduced long-s twin conflict regression. The calternal-fs change exports an existing helper; it does not change filesystem behavior. The Unicode test failed against the pre-fix binary as reported above. Its green rerun, the focused stress rerun and final Files clippy are queued behind Notes clippy. Full verification is **pending** for these progress commits. The earlier P1/P2 focused suite passed, while the full Files suite has its recorded five-minute stress timeout. No push or deployment.
kayg commented 2026-10-02 22:25:48 +00:00
Author
Owner
Copy link

Completed verification and pre-fix regression evidence is attached. The Unicode green run, focused storm rerun, remaining crate tests and screenshots are still pending.

Completed verification and pre-fix regression evidence is attached. The Unicode green run, focused storm rerun, remaining crate tests and screenshots are still pending. - [round3-files-focused.log](https://git.kayg.org/attachments/560df0c9-0081-4ae5-8446-bf351b0b3a89) - [round3-calternal-plugin-files-clippy.log](https://git.kayg.org/attachments/11228d72-e1e5-48ab-a707-cb9b2c21099f) - [round3-calternal-plugin-files-test.log](https://git.kayg.org/attachments/a3d99398-c959-4024-b075-35bd7a2a823c) - [round3-calternal-plugin-notes-clippy.log](https://git.kayg.org/attachments/c433bbad-ca70-4acd-806c-4469efdc1b87) - [round3-web-check.log](https://git.kayg.org/attachments/a401de2c-392b-446f-8eb3-88f4ba3de8ee) - [unicode-red.log](https://git.kayg.org/attachments/37705b72-ffb3-47a7-b5c6-30c05501df0a) - [p1-red-behavior.log](https://git.kayg.org/attachments/92c1fc0a-8398-4484-9889-780e1ccd9de5) - [p1-scan-red.log](https://git.kayg.org/attachments/2ee7564c-d009-4089-a4a3-8d2e6c8b2403) - [p2-red.log](https://git.kayg.org/attachments/7a6d4f9b-0187-4409-8c40-8eaea10a95c0)
kayg commented 2026-10-02 22:48:14 +00:00
Author
Owner
Copy link

Unicode conflict regression passed on the committed source. Head d687417a15b7b1cd5cf2e64a7f1c5eda8a1c853b adds DESIGN documentation only after the Rust fix.

    Finished `test` profile [unoptimized + debuginfo] target(s) in 70m 10s
test tests::voice_memos_review::review_unicode_folded_twins_keep_conflict_link_identities ... ok
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 169 filtered out; finished in 42.79s

The regression checks both recording IDs and bytes, the older recording's exact conflict Note target, the newer recording's original Note target, and a second repair. Full output.

The focused stress rerun, final Files clippy, remaining crate gates and current server build remain queued. Screenshots are prepared for macOS rendering at all three widths in both themes, including actual browser recording and saving a Note. No screenshot pass claim yet.

Unicode conflict regression passed on the committed source. Head `d687417a15b7b1cd5cf2e64a7f1c5eda8a1c853b` adds DESIGN documentation only after the Rust fix. ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 70m 10s test tests::voice_memos_review::review_unicode_folded_twins_keep_conflict_link_identities ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 169 filtered out; finished in 42.79s ``` The regression checks both recording IDs and bytes, the older recording's exact conflict Note target, the newer recording's original Note target, and a second repair. [Full output](https://git.kayg.org/attachments/b8a55d94-1f70-4c06-8a0d-ce9d9c8d595e). The focused stress rerun, final Files clippy, remaining crate gates and current server build remain queued. Screenshots are prepared for macOS rendering at all three widths in both themes, including actual browser recording and saving a Note. No screenshot pass claim yet.
kayg commented 2026-10-02 23:52:30 +00:00
Author
Owner
Copy link

Round 3: review fixes committed; verification incomplete at the four-hour job limit.

Head: d687417a15b7b1cd5cf2e64a7f1c5eda8a1c853b on job/voicememos-618. Merged origin/dev once (e5573dcb4). No push or deployment.

Built:

  • Replay landed Files move intents under the namespace lock before repair retries and folder scans. Retain recording IDs, Shares and public links until Note rewrites succeed.
  • Retain a legacy source subtree while its active uploads use a parent there. Resume the same ticket without changing destination preconditions or broadening folder grants.
  • Use the existing filesystem Unicode name key for attachment rewrites. Imported Unicode twins must keep each recording's Note link after a conflict move.
  • Join cancelled stress workers before temporary Home cleanup, and correct a stale repair-order comment. No existing timeout, assertion or fixture was weakened.

Files changed in this round:

  • crates/calternal-fs/src/lib.rs
  • crates/calternal-fs/src/path.rs
  • crates/plugins/files/src/index.rs
  • crates/plugins/files/src/lib.rs
  • crates/plugins/files/src/tests/voice_memos_review.rs
  • docs/DESIGN.md

Decisions:

  • Defer a directory merge with the existing queue retry policy instead of adding merge aliases or changing upload tickets.
  • Export the existing calternal-fs::fold_name helper. The filesystem policy does not change. ASCII matching retains its allocation-free path.

UX gaps closed:

  • Failed Note writes followed by same-process retry or scan can no longer delete recording identity and grants.
  • Paused direct and nested uploads retain their parents, bytes and authorization boundaries during repair.
  • Unicode legacy twins must not redirect the older recording's Note link to the newer recording. The focused Unicode regression passed.

Known gaps and UX gaps left:

  • Full Files verification hit the unchanged 300-second stress bound. Keep its failure in the report, even if the focused rerun passes.
  • Batch limits apply between moves. One move can exceed the soft duration when many Notes need rewrites.
  • Broader recording, restart, Share, Tags and Calendar attachment walkthroughs are for the merge round under the latest verification policy.
  • Final Files clippy and the focused stress rerun did not start beyond their target-lock wait. Notes tests compiled partially. notes-core, filesystem and Collab gates, including the SIGKILL test, did not run. The unfinished build/test queue was stopped at the job limit.
  • The current server and production web build completed, but no screenshots were produced. The runner failed first on a legacy title mismatch, then on two runner errors (missing storage seam and missing Job variable). The handoff runner is corrected and syntax checked; its runtime remains unverified.
  • The legacy title mismatch is filed as #962: #962. Only the title mismatch is proven.

For the merge round (latest owner verification policy):

  • (cd apps/web && bun run test) and the combined full e2e run. bun run test:e2e:composer, bun run test:e2e:files, bun run test:e2e:notes, bun run test:e2e:share and bun run test:e2e:deeplinks must prove recording playback, conflict moves, stable links and sharing after repair. Also walk Tags and a Calendar attachment, and restart during repair.
  • bash tests/adversarial/run-split.sh for the combined API verification round.
  • (cd apps/web && bun run build) then cargo build --release -p calternal-server; staging and real Mac interop remain with the orchestrator.
  • On the perf VM, with the existing shared release binary, flock /root/perf.lock sh -c 'uptime; exec python3 bench/voice-memo-migration-618.py --server "$CALTERNAL_SERVER_BIN" --runs 5 --average-files 64 --worst-files 100000 --conflicts 256 --linked-notes 256 --burst 32 --label "perf VM shared release"'. Keep the load average inside the lock. No new measurements were run in this non-performance issue. The profile says no Voice Memos scenario baseline exists yet; compare the recorded baseline commit and available metrics in docs/perf/baseline.json.

Verification output (verbatim summary lines; full logs attached):

cargo fmt --check: exit 0, no output, including the final Rust source.

Files clippy before the Unicode follow-up:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 9m 19s

Notes clippy:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 32m 54s

Focused recovery/upload review suite:

test result: ok. 13 passed; 0 failed; 2 ignored; 0 measured; 154 filtered out; finished in 115.11s

Full Files suite:

writes, reconcile scans, and watcher adoption complete within five minutes: Elapsed(())
atomic write 220 failed: entry not found
test result: FAILED. 165 passed; 1 failed; 3 ignored; 0 measured; 0 filtered out; finished in 2303.45s

The secondary NotFound followed timeout cleanup in the old harness. The cleanup fix retains and joins the workers. The focused rerun remained blocked, so this is not a rerun success claim. No bound or assertion changed.

Unicode regression on the committed Rust source:

    Finished `test` profile [unoptimized + debuginfo] target(s) in 70m 10s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 169 filtered out; finished in 42.79s

Web check:

svelte-check found 0 errors and 0 warnings

Current debug server build:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 115m 31s

Unfinished exact Rust commands for the merge round:

cargo clippy -p calternal-plugin-files --all-targets -- -D warnings
cargo test -p calternal-plugin-files internal_temp_paths_never_enter_index_during_atomic_write_reconcile_storm -- --nocapture
cargo test -p calternal-plugin-notes -- --nocapture --test-threads=2
for crate in calternal-notes-core calternal-fs calternal-collab; do
  cargo clippy -p "$crate" --all-targets -- -D warnings
  cargo test -p "$crate" -- --nocapture --test-threads=2
done

Use the required Cargo environment, four build workers and the worktree TMPDIR. The filesystem suite must execute review_case_crash::review_sigkill_at_each_case_rename_boundary and print its diagnostics on failure.

After the combined server and web build, run the attached corrected screenshot script from artifacts/:

TMPDIR="$PWD/target/tmp" CALTERNAL_SERVER_BIN="$CARGO_TARGET_DIR/debug/calternal-server" node artifacts/voice-memo-jobs-macos.mjs --screenshots-only --screenshots artifacts/voice-memo-jobs-macos

It must prove keyboard Copy link, actual recording/Keep/Mac submission, Note attachment paths, and 18 captures (Maintenance User/Admin and Composer at 390/820/1440, light/dark). Run without --screenshots-only to retain the legacy-navigation assertions after #962 is resolved. No image is committed.

Attached evidence:

Corrected handoff runner: voice-memo-jobs-macos.mjs.txt. Save it as artifacts/voice-memo-jobs-macos.mjs before the command above. Forgejo rejected the .mjs attachment extension; the text copy has the same content. The partial Notes/server/browser logs are also uploaded as issue assets.

Cleanup: the unfinished build/test queue was stopped. Web build output and temporary test data were removed. cargo clean was started and its final status is pending at report creation.

Round 3: review fixes committed; verification incomplete at the four-hour job limit. Head: `d687417a15b7b1cd5cf2e64a7f1c5eda8a1c853b` on `job/voicememos-618`. Merged `origin/dev` once (`e5573dcb4`). No push or deployment. Built: - Replay landed Files move intents under the namespace lock before repair retries and folder scans. Retain recording IDs, Shares and public links until Note rewrites succeed. - Retain a legacy source subtree while its active uploads use a parent there. Resume the same ticket without changing destination preconditions or broadening folder grants. - Use the existing filesystem Unicode name key for attachment rewrites. Imported Unicode twins must keep each recording's Note link after a conflict move. - Join cancelled stress workers before temporary Home cleanup, and correct a stale repair-order comment. No existing timeout, assertion or fixture was weakened. Files changed in this round: - `crates/calternal-fs/src/lib.rs` - `crates/calternal-fs/src/path.rs` - `crates/plugins/files/src/index.rs` - `crates/plugins/files/src/lib.rs` - `crates/plugins/files/src/tests/voice_memos_review.rs` - `docs/DESIGN.md` Decisions: - Defer a directory merge with the existing queue retry policy instead of adding merge aliases or changing upload tickets. - Export the existing `calternal-fs::fold_name` helper. The filesystem policy does not change. ASCII matching retains its allocation-free path. UX gaps closed: - Failed Note writes followed by same-process retry or scan can no longer delete recording identity and grants. - Paused direct and nested uploads retain their parents, bytes and authorization boundaries during repair. - Unicode legacy twins must not redirect the older recording's Note link to the newer recording. The focused Unicode regression passed. Known gaps and UX gaps left: - Full Files verification hit the unchanged 300-second stress bound. Keep its failure in the report, even if the focused rerun passes. - Batch limits apply between moves. One move can exceed the soft duration when many Notes need rewrites. - Broader recording, restart, Share, Tags and Calendar attachment walkthroughs are for the merge round under the latest verification policy. - Final Files clippy and the focused stress rerun did not start beyond their target-lock wait. Notes tests compiled partially. notes-core, filesystem and Collab gates, including the SIGKILL test, did not run. The unfinished build/test queue was stopped at the job limit. - The current server and production web build completed, but no screenshots were produced. The runner failed first on a legacy title mismatch, then on two runner errors (missing storage seam and missing Job variable). The handoff runner is corrected and syntax checked; its runtime remains unverified. - The legacy title mismatch is filed as #962: https://git.kayg.org/kayg/calternal/issues/962. Only the title mismatch is proven. For the merge round (latest owner verification policy): - `(cd apps/web && bun run test)` and the combined full e2e run. `bun run test:e2e:composer`, `bun run test:e2e:files`, `bun run test:e2e:notes`, `bun run test:e2e:share` and `bun run test:e2e:deeplinks` must prove recording playback, conflict moves, stable links and sharing after repair. Also walk Tags and a Calendar attachment, and restart during repair. - `bash tests/adversarial/run-split.sh` for the combined API verification round. - `(cd apps/web && bun run build)` then `cargo build --release -p calternal-server`; staging and real Mac interop remain with the orchestrator. - On the perf VM, with the existing shared release binary, `flock /root/perf.lock sh -c 'uptime; exec python3 bench/voice-memo-migration-618.py --server "$CALTERNAL_SERVER_BIN" --runs 5 --average-files 64 --worst-files 100000 --conflicts 256 --linked-notes 256 --burst 32 --label "perf VM shared release"'`. Keep the load average inside the lock. No new measurements were run in this non-performance issue. The profile says no Voice Memos scenario baseline exists yet; compare the recorded baseline commit and available metrics in `docs/perf/baseline.json`. Verification output (verbatim summary lines; full logs attached): `cargo fmt --check`: exit 0, no output, including the final Rust source. Files clippy before the Unicode follow-up: ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 9m 19s ``` Notes clippy: ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 32m 54s ``` Focused recovery/upload review suite: ```text test result: ok. 13 passed; 0 failed; 2 ignored; 0 measured; 154 filtered out; finished in 115.11s ``` Full Files suite: ```text writes, reconcile scans, and watcher adoption complete within five minutes: Elapsed(()) atomic write 220 failed: entry not found test result: FAILED. 165 passed; 1 failed; 3 ignored; 0 measured; 0 filtered out; finished in 2303.45s ``` The secondary NotFound followed timeout cleanup in the old harness. The cleanup fix retains and joins the workers. The focused rerun remained blocked, so this is not a rerun success claim. No bound or assertion changed. Unicode regression on the committed Rust source: ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 70m 10s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 169 filtered out; finished in 42.79s ``` Web check: ```text svelte-check found 0 errors and 0 warnings ``` Current debug server build: ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 115m 31s ``` Unfinished exact Rust commands for the merge round: ```sh cargo clippy -p calternal-plugin-files --all-targets -- -D warnings cargo test -p calternal-plugin-files internal_temp_paths_never_enter_index_during_atomic_write_reconcile_storm -- --nocapture cargo test -p calternal-plugin-notes -- --nocapture --test-threads=2 for crate in calternal-notes-core calternal-fs calternal-collab; do cargo clippy -p "$crate" --all-targets -- -D warnings cargo test -p "$crate" -- --nocapture --test-threads=2 done ``` Use the required Cargo environment, four build workers and the worktree TMPDIR. The filesystem suite must execute `review_case_crash::review_sigkill_at_each_case_rename_boundary` and print its diagnostics on failure. After the combined server and web build, run the attached corrected screenshot script from `artifacts/`: ```sh TMPDIR="$PWD/target/tmp" CALTERNAL_SERVER_BIN="$CARGO_TARGET_DIR/debug/calternal-server" node artifacts/voice-memo-jobs-macos.mjs --screenshots-only --screenshots artifacts/voice-memo-jobs-macos ``` It must prove keyboard Copy link, actual recording/Keep/Mac submission, Note attachment paths, and 18 captures (Maintenance User/Admin and Composer at 390/820/1440, light/dark). Run without `--screenshots-only` to retain the legacy-navigation assertions after #962 is resolved. No image is committed. Attached evidence: - [round3-files-focused.log](https://git.kayg.org/attachments/560df0c9-0081-4ae5-8446-bf351b0b3a89) - [round3-calternal-plugin-files-clippy.log](https://git.kayg.org/attachments/11228d72-e1e5-48ab-a707-cb9b2c21099f) - [round3-calternal-plugin-files-test.log](https://git.kayg.org/attachments/a3d99398-c959-4024-b075-35bd7a2a823c) - [round3-calternal-plugin-notes-clippy.log](https://git.kayg.org/attachments/c433bbad-ca70-4acd-806c-4469efdc1b87) - [round3-web-check.log](https://git.kayg.org/attachments/a401de2c-392b-446f-8eb3-88f4ba3de8ee) - [unicode-red.log](https://git.kayg.org/attachments/37705b72-ffb3-47a7-b5c6-30c05501df0a) - [p1-red-behavior.log](https://git.kayg.org/attachments/92c1fc0a-8398-4484-9889-780e1ccd9de5) - [p1-scan-red.log](https://git.kayg.org/attachments/2ee7564c-d009-4089-a4a3-8d2e6c8b2403) - [p2-red.log](https://git.kayg.org/attachments/7a6d4f9b-0187-4409-8c40-8eaea10a95c0) - [unicode-green.log](https://git.kayg.org/attachments/b8a55d94-1f70-4c06-8a0d-ce9d9c8d595e) Corrected handoff runner: [voice-memo-jobs-macos.mjs.txt](https://git.kayg.org/attachments/a8694ad5-d1c9-40d5-9264-d72f3ce70ed9). Save it as `artifacts/voice-memo-jobs-macos.mjs` before the command above. Forgejo rejected the `.mjs` attachment extension; the text copy has the same content. The partial Notes/server/browser logs are also uploaded as issue assets. Cleanup: the unfinished build/test queue was stopped. Web build output and temporary test data were removed. `cargo clean` was started and its final status is pending at report creation.
kayg commented 2026-10-02 23:53:58 +00:00
Author
Owner
Copy link

Cleanup completed after the final report was posted:

     Removed 14839 files, 8.2GiB total

Web build output and temporary test data were removed. The worktree is clean at d687417a15b7b1cd5cf2e64a7f1c5eda8a1c853b. The local final report now records completed cleanup. No push or deployment. Verification remains incomplete as stated in the report.

Cleanup completed after the final report was posted: ```text Removed 14839 files, 8.2GiB total ``` Web build output and temporary test data were removed. The worktree is clean at `d687417a15b7b1cd5cf2e64a7f1c5eda8a1c853b`. The local final report now records completed cleanup. No push or deployment. Verification remains incomplete as stated in the report.
kayg commented 2026-10-03 00:36:02 +00:00
Author
Owner
Copy link

Crate gates on job/voicememos-618 (Files plugin), run by Claude:

  • cargo fmt --check: exit 0
  • cargo clippy -p calternal-plugin-files --all-targets -- -D warnings: Finished \dev` profile [unoptimized + debuginfo] target(s) in 4m 57s`
  • cargo test -p calternal-plugin-files --no-fail-fast -- --test-threads=4: 
    test result: ok. 167 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 94.78s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

No fixes needed. Ready for the merge round (Files crate gates).

Crate gates on `job/voicememos-618` (Files plugin), run by Claude: - `cargo fmt --check`: exit 0 - `cargo clippy -p calternal-plugin-files --all-targets -- -D warnings`: `Finished \`dev\` profile [unoptimized + debuginfo] target(s) in 4m 57s` - `cargo test -p calternal-plugin-files --no-fail-fast -- --test-threads=4`: ``` test result: ok. 167 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 94.78s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` No fixes needed. Ready for the merge round (Files crate gates).
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
dev
wip/palette2-1123
wip/palette-1093
wip/onboard2-1141
wip/onboard-1141.aborted-early
wip/onboard-1141
wip/notifloop-1194
wip/nlpchip-1127
wip/morph-1104
wip/merge-round-7c5
wip/merge-round-7c4
wip/merge-round-7c3
wip/merge-round-7c2
wip/merge-round-7c
wip/mchrome-1084
wip/mailghost2-1094
wip/mailghost-1094
wip/kbpreview2-1118
wip/kbpreview-1118
wip/kanban-1092
wip/importhang-1121
wip/hiderev-1153
wip/hide4-1153
wip/hide3-1153
wip/hide2-1153
wip/hide-1153
wip/editreg-1132
wip/editorrail3-1113
wip/editorrail2-1113
wip/editorrail-1113
wip/e2e-b2-1071
wip/e2e-b-1071
wip/draw4-1101
wip/draw3-1101
wip/draw2-1101
wip/draw-1101
wip/directory-1199-r
wip/directory-1199
wip/delete-1119
wip/collabrev-1197
wip/collabloss-1197
wip/cards2-1083
wip/cards-1083
wip/canvas-visual
wip/canvasvis2-976
wip/calhdr-1112
wip/calcards-1115
wip/browserfix
wip/blocks-1125
job/onboard-1141
wip/allday-1107
wip/agenda-decks
wip/agenda-1086
wip/adv7c-1105
wip/txentry-1198
wip/trayicons2-1095
wip/trayicons-1095
wip/tagperf-1186
wip/sidebar3-1094
wip/rev2-webperf
wip/rev2-money-ident
job/adv-1202
wip/restyle-notes
wip/previewcard-1098
job/merge30
job/notifloop-1194
job/collabloss-1197
job/hide-1153
job/perf-1124
job/perf2-1124
job/tocrail-1191
job/restyle-settings
wip/restyle-settings
job/segmented-1200
job/tagperf-1186
wip/segmented-1200
job/restyle-files
job/tagdnd-1187
job/cards-1179
wip/cards2-1179
wip/cards-1179
wip/tocrail-1191
wip/tagdnd-1187
wip/restyle-files
wip/perf-1124
wip/merge30j
job/restyle-notes
job/wizchoices-1140
wip/wizchoices-1140
wip/restyle-1190
job/moneyfmt-1180
job/txentry-1198
wip/moneyfmt2-1180
wip/moneyfmt-1180-r
wip/moneyfmt-1180
job/pillglass-1189
job/flags-1181
wip/flags-1181
job/restyle-1190
job/restyle-mailmoney
job/restyle-search
job/settingsreg-1195
job/wizard-1140
site/website
wip/wizardrev2-1140
wip/wizardrev-1140
wip/wizard5-1140
wip/wizard4-1140
wip/wizard3-1140
wip/wizard2-1140
wip/wizard-1140
wip/pillglass-1189
wip/settingsreg-1195
job/merge29
job/fu-1171
wip/merge29j
wip/fu-1171
job/fu-1166
job/directory-1199
job/proflog-1204
job/txresearch-1188
wip/fu-1166
job/merge28
job/search-1066
wip/search-1066
wip/merge28j
job/gateslot-1182
job/bulkimport-1157
job/mailnet-1160
wip/mailnetrev-1160
wip/mailnet-1160
wip/bulkrev-1157
wip/bulkimport-1157
job/startup-1161
wip/startup-1161
job/merge27
job/linkcards-1151
wip/linkcards3-1151
wip/linkcards2-1151
wip/linkcards-1151
job/traydate-1144
wip/traydate3-1144
wip/traydate2-1144
wip/traydate-1144
job/draw-1101
wip/merge27j
job/blockpill-1152
wip/blockpill3-1152
wip/blockpill2-1152
wip/blockpill-1152
job/minihover-1149
wip/minihover2-1149
wip/minihover-1149
job/merge25
wip/merge25-r
wip/merge25b
wip/merge25
job/inspector-1129
job/tags-1110
wip/inspector3-1129
wip/inspector2-1129
wip/inspector-1129
wip/tagsrev-1110
wip/tags2-1110
wip/tags-1110
job/dates-1148
wip/datesrev-1148
wip/dates2-1148
wip/dates-1148
job/licence-1145
wip/licence2-1145
wip/licence-1145
job/selfhost-1156
job/merge23
wip/merge23
job/tagfilter-1109
wip/tagfilter2-1109
wip/tagfilter-1109
job/kbd-1134
wip/kbd2-1134
wip/kbd-1134
job/palfoot-1137
wip/selfhost-1156
wip/palfoot2-1137
wip/palfoot-1137
job/toggle-1158
wip/toggle-1158
job/kbpreview-1118
job/docratchet-1155
job/perflint-1133
job/devtests-1159
wip/docratchet-1155
wip/devtests-1159
job/segv-1136
wip/toast-1142
wip/segv-1136
job/toast-1142
job/blockreload-1147
wip/blockreload-1147
job/font-1150
wip/font-1150
job/importui-1120
job/minimonth-1149
wip/importui-1120
wip/minimonth-1149
job/depcheck-1146
wip/perflint-1133
wip/depcheck-1146
job/calcards-1115
job/blocks-1125
job/plus-1128
job/shift-1138
wip/plus2-1128
wip/plus-1128
wip/shift-1138
job/moneyfid-1130
job/editorrail-1113
wip/moneyrev-1130
wip/moneyfid-1130
job/noext-851
wip/noext-851
wip/noext3-851
wip/noext2-851
job/week-1135
wip/week-1135
job/editreg-1132
job/smoke-1122
wip/smoke-1122
job/docs-1143
job/palette2-1123
job/calhdr-1112
job/nlpchip-1127
job/mailghost-1094
job/reconnect-1131
wip/reconnect-1131
job/trayicons-1095
job/delete-1119
job/importhang-1121
job/cards-1083
job/palette-1093
job/mchrome-1084
job/e2e-a-1071
job/canvas-visual
job/previewcard-1098
job/allday-1107
wip/e2e-a2-1071
wip/e2e-a-1071
job/e2e-b-1071
job/adv7c-1105
job/kanban-1092
job/agenda-1086
job/merge-round-7c
job/morph-1104
wip/surfaces-p2
job/merge-round-9
wip/merge-round-9
job/7cfix-small
wip/7cfix-small
job/mailui-1078
job/merge-round-8
wip/merge-round-8
wip/mailui-1078
job/mailround-1038
job/applemail-accept
wip/settitle-1068
wip/mailround2-1038
wip/mailround-1038
wip/e2e-7b
job/crash-1069
wip/crash-1069
job/searchlost-1066
wip/searchlost-1066
job/7b-reconcile
job/flake-1065
wip/flake-1065
wip/merge-round-7b7
wip/merge-round-7b6
wip/merge-round-7b5
wip/merge-round-7b4
wip/7b-reconcile
job/appupdate-1059
job/nfd-1044
wip/appupdate-1059
job/e2e-7b
job/loop-1062
wip/loop-1062
job/pdfprev-1045
job/invtoggle-1053
wip/pdfprev-1045
wip/nfd-1044
wip/invtoggle-1053
job/7bfix-e2e
job/mailstress-b
wip/7bfix-e2e
wip/mailstress-b
job/7bfix-adv
wip/7bfix-adv
job/mailstress-a
job/stack-1054
wip/stack-1054
wip/mailstress-a
job/mailstress-1038
wip/mailstress-1038
job/upload500-1051
wip/upload500-1051
job/share-1034
wip/share-1034
job/syncerr-1037
job/7bfix-photos
wip/7bfix-photos
job/paste-1036
job/setside-1039
wip/setside-1039
wip/paste-1036
job/lease-1042
wip/syncerr-1037
wip/lease-1042
job/7bfix-data
job/passkeybind-1043
wip/apprevoke-1041
job/invite-1035
wip/invite-1035
job/merge-round-7b2
wip/merge-round-7b2
job/mailproxy-486
job/apprevoke-1041
job/rebuild-1033
job/pillborder-1029
wip/pillborder-1029
wip/mailproxy-486
wip/applemail-486
job/headless-998
wip/headless-998
job/groups-1028
wip/groups-1028
job/rebuildwarn-1016
wip/rebuildwarn-1016
job/startup-1011
wip/startup-1011
job/monthpill-1009
job/bgthumb-1025
job/sharetitle-1012
wip/monthpill-1009
wip/bgthumb-1025
wip/sharetitle-1012
job/canvas-cards-977
wip/canvas-cards-977
job/canvas-pencil-978
job/canvas-sketch-990
wip/canvas-sketch-990
wip/canvas-pencil-978
job/canvas-files-989
wip/canvas-files-989
job/canvas-collab-991
wip/canvas-collab-991
job/weekscroll-1018
wip/weekscroll-1018
wip/canvas-core-976
job/canvas-core-976
job/round-drag
wip/round-drag
job/round-settings
job/browserfix
wip/oapi-974
job/oapi-974
job/hist2-integrate
job/mailhtml-726
wip/mailhtml-726
wip/hist2-integrate
job/moneyfu-984
job/drag-1015
wip/drag-1015
job/rename-1017
wip/rename-1017
job/hist2-api
wip/hist2-api
job/oneacct-1014
wip/oneacct-1014
wip/moneyfu-984
job/hist2-bench
job/hist2-restore
wip/hist2-bench
job/hist2-write
job/hotfix-724
wip/hotfix-724
wip/hist2-write
wip/hist2-restore
job/hist2-store
job/hist2-ui
wip/hist2-ui
wip/hist2-store
job/searchstarve-965
job/shutdown-963
wip/shutdown-963
wip/pubedit-981
job/pubedit-981
job/analytics-973
wip/searchstarve-965
job/authflash-850
job/weeklane-969
job/pvtitle-1004
job/hist-975
wip/authflash-850
job/voicepill-617
wip/pvtitle-1004
job/headring-1003
wip/weeklane-969
wip/voicepill-617
wip/headring-1003
wip/analytics-973
job/agentscope-980
wip/thumbsandbox-988
job/thumbsandbox-988
wip/hist-975
job/links-856
wip/links-856
job/davetag-966
wip/davetag-966
job/filesstorm-1000
job/hoverpad-725
wip/filesstorm-1000
job/ffmpegblas-993
job/merge-round-7a
wip/hoverpad-725
wip/ffmpegblas-993
job/nowdot-1002
wip/verify-7a
job/noteid-857
wip/nowdot-1002
wip/noteid-857
wip/merge-round-7a
wip/agentscope-980
job/imapedge
job/a11yfix2
wip/imapedge-941
wip/imapedge
wip/a11yfix2
job/notetask-986
job/logheading
wip/logheading-998
job/textthumb-652
job/photolive-987
wip/photolive-987
job/davactive-983
job/savefix-985
job/tabicons-607
wip/davactive-983
wip/tabicons-607
wip/notetask-986
wip/savefix-985
job/dirid-627
job/buildspeed-1007
wip/dirid-627
job/agenda-decks
job/perfguards-impl
job/undo-a11y
wip/undo-a11y
job/mailperf
job/wal-824
wip/settings-50
job/settings-50
job/notesfilter-606
wip/notesfilter-606
job/surfaces-p2
wip/wal-824
job/maillayouts
wip/mailperf
wip/maillayouts
job/taskmeta-659
job/money-ident
wip/money-ident
wip/taskmeta-659
job/errstates
wip/perfguards-impl
job/headings-881
wip/headings-881
wip/errstates
job/voice-619
job/gaps-827
job/notesperf
wip/notesperf
wip/voice-619
job/hddsql-549
job/perf-stream-668
wip/perf-stream-668
wip/deeplinks-fix
job/deeplinks-fix
job/authfix
job/docsfix-rust
wip/docsfix-rust
job/webperf
job/docsfix-web
job/datafix2
job/webdav-lock-476
job/copyfix
wip/copyfix
wip/webperf
job/focus-658
wip/protofix
job/mediafix
job/protofix
wip/mediafix
job/agentfix
job/hhmm-724
wip/agentfix
job/undo-722
job/reuse
wip/webdav-lock-476
wip/reuse
job/scopefix
job/datafix
wip/hhmm-724
wip/undo-722
job/surfaces-p1
wip/hddsql-549
job/voicememos-618
wip/datafix2
wip/surfaces-p1
job/fix-940
wip/fix-940
job/blaze-surfaces
wip/datafix
wip/blaze-surfaces
job/taskday-655
job/linknav-639
wip/linknav-639
wip/gaps-827
job/isolation-707
job/audiophotos-720
wip/audiophotos-720
job/advfind-664
wip/voicememos-618
wip/taskday-655
wip/isolation-707
wip/advfind-664
wip/scopefix
wip/focus-658
job/testgaps
wip/testgaps
job/overscroll-718
wip/authfix
job/deps
wip/overscroll-718
job/rev2-agentfix
job/rev2-money-ident
job/rev2-mailperf
wip/deps
job/hardening-728
wip/hardening-728
job/searchgen-832
wip/searchgen-832
job/photopw-849
job/mailsql-825
wip/photopw-849
job/sharefix
wip/sharefix
job/rev2-mailhtml-726
job/rev2-perfguards
job/copyval-723
job/lightglass-r2
wip/lightglass-r2
wip/docsfix-web
job/copy-audit
job/macinterop-staging-r2
job/design-sync
job/rev2-taskmeta-659
job/rev2-webperf
job/docs-audit
job/rev2-advfind-664
job/rev2-mailproxy-486
job/states-audit
job/rev2-datafix
job/design-drift
job/test-gaps
job/rev2-voicememos-618
job/rev2-mediafix
job/rev2-deps
job/rev2-datafix2
job/licence-audit
job/issue-hygiene
job/rev2-protofix
job/rev2-voice-619
job/rev2-isolation-707
job/rev2-surfaces-p1
job/deeplink-audit2
job/rev2-audiophotos-720
wip/test-gaps
job/rev2-overscroll-718
job/rev2-undo-722
wip/states-audit
job/rev2-dropmd-719
job/rev2-linknav-639
job/merge-7b-plan
wip/merge-7b-plan
job/rev2-taskday-655
wip/mailsql-825
job/rev2-webdav-lock-476
job/rev2-browserfix
wip/design-drift
job/rev2-hddsql-549
wip/deeplink-audit2
job/rev2-scopefix
job/rev2-authfix
job/rev2-hardening-728
job/rev2-wal-824
job/rev2-sharefix
job/calsidebar-638
job/chrome-audit
job/ioperf
wip/ioperf
wip/chrome-audit
wip/calsidebar-638
job/dropmd-719
wip/dropmd-719
job/ocr-build
wip/ocr-build
job/blaze-settings
wip/copyval-723
job/toastring-721
wip/toastring-721
job/deployfix-732
wip/deployfix-732
wip/blaze-settings
job/money-import-recheck
job/rev-a11y
job/perf-arch-db
job/rev-7b-data
wip/textthumb-652
wip/perf-arch-db
job/sec-protocols
job/sidehdr-660
job/rev-7b-security
job/research-surfaces
job/rev-design-gaps
job/rev-mcp-api
wip/sidehdr-660
job/perf-arch-memory
wip/sec-protocols
job/perf-arch-bundle
job/snapedge-714
wip/rev-mcp-api
job/sec-supplychain
wip/research-surfaces
job/perf-arch-sync
job/rev-consistency
job/perf-arch-server
wip/perf-arch-server
wip/perf-arch-memory
job/perf-arch-io
job/perf-arch-client
job/sec-fs
job/sec-mcp-scopes
job/sec-sharing
job/perf-guards
job/sec-browser
job/sec-admin-deploy
job/sec-auth
wip/snapedge-714
job/bgpicker-717
wip/perf-arch-bundle
wip/money-import-recheck
job/advsetup-654
wip/bgpicker-717
wip/advsetup-654
job/burst-709
job/kbdcaps-710
job/app-pw-chooser
wip/burst-709
wip/app-pw-chooser
job/imaptest-625
wip/kbdcaps-710
job/fix-499
wip/fix-499
job/perf-mut-667
job/calimg-589
job/perf-snap-666
wip/calimg-589
wip/perf-snap-666
wip/perf-mut-667
job/perf-cache-665
wip/perf-cache-665
job/voicefiles-620
wip/voicefiles-620
job/admin-burst-705
wip/admin-burst-705
job/voicememos-review
wip/voicememos-review
wip/ryw-653
job/ryw-653
job/writeonopen-661
job/instant-663
wip/writeonopen-661
job/money-import-review
wip/money-import-review
wip/importjs-610
review/integrations-407-round6
wip/integrations-review
job/dragghost-612
wip/dragghost-612
job/integrations
wip/integrations
job/decider-656
job/merge-round-6
job/perf-rerun
wip/merge-round-6
job/integrations-review-round5
job/selalign-576
wip/selalign-576
job/mcp-events-491
job/files-631
job/cal-e2e-569
wip/cal-e2e-569
job/reload-423
wip/reload-423
wip/mcp-events-491
wip/files-631
job/notesbridge-644
wip/notesbridge-644
job/editor-series
job/calcard-series
wip/calcard-series
job/mcp-events-review-491
wip/mcp-events-review
wip/editor-series
job/quirks-546
job/integrations-recheck
job/tocrail-636
wip/tocrail-636
wip/quirks-546
wip/reminders-643
job/reminders-643
wip/davscale-573
job/davscale-573
job/integrations-review
wip/ocr-eval-584
job/ocr-eval-584
job/esc-537
wip/esc-537
job/toastname-586
wip/toastname-586
job/submenu-579
wip/submenu-579
job/tasks-mode
wip/tasks-mode
job/agentdocs-630
job/dupwrite-634
wip/agentdocs-630
wip/dupwrite-634
job/lightglass-588
wip/lightglass-588
job/tabswitch-549
job/ghosttask-623
wip/ghosttask-623
job/toaststack-616
job/weekstate-609
job/mailsync-613
wip/mailsync-613
wip/weekstate-609
job/maildup-626
wip/tabswitch-549
wip/maildup-626
wip/toaststack-616
job/motion-611
wip/motion-611
job/tlstest-601
wip/tlstest-601
job/perf-495
job/floating-sheet
wip/floating-sheet
job/remdup-585
wip/remdup-585
job/fix-502
wip/fix-502
job/attachplay-622
job/perf-batch
wip/perf-batch-563
wip/perf-495
hotfix/mail-sync-diag
job/mail-m3
wip/mail-m3
job/attach-poof-603
job/calhover-608
job/editorbar-604
job/mentions-605
job/merge-round-4
job/allday-514
wip/merge-round-4
wip/allday-514
job/merge-round-4a
wip/merge-round-4a
job/sharestack-580
job/fix-501
wip/sharestack-580
wip/fix-501
job/perf-batch-563
job/apw-cache-review
wip/apw-cache-review
job/probe-520
wip/probe-520
job/mac-393
wip/mac-393
job/header-571
job/flake-513
wip/flake-513
job/docs-thumb-547
wip/header-571
job/webcal-572
wip/webcal-572
wip/shortcuts-542
job/shortcuts-542
wip/docs-thumb-547
job/caldav-stress
wip/caldav-stress
wip/sweep-478
job/apw-cache-512
wip/apw-cache-512
job/money-empty-540
wip/restart-505
wip/money-empty-540
wip/fix-510
job/restart-505
job/fix-503
job/perf-496
wip/perf-496
job/fix-498
wip/fix-498
job/info-inspector-465
wip/info-inspector-465
job/fix-510
job/fix-507
wip/fix-507
wip/fix-503
job/fix-493
job/money-kinds
wip/money-kinds
job/hygiene-548
job/merge-round-3
wip/fix-493
job/drag-snap-536
wip/merge-round-3
wip/merge-round-0930
wip/drag-snap-536
job/align-538
wip/align-538
job/bg-flash
wip/bg-flash
job/money-import
job/search-count-544
wip/search-count-544
wip/money-import
job/settings-key-541
wip/settings-key-541
job/toast-539
job/preview-421
wip/preview-421
wip/toast-539
job/tasks-500-531
job/title-plain-526
wip/title-plain-526
wip/tasks-500-531
job/notes-bridge
wip/parity-484
job/parity-484
job/files-slow
job/crash-525
wip/notes-bridge
wip/files-slow
wip/crash-525
job/kbd-motion-527
wip/bg-422
job/analytics-504
wip/analytics-504
wip/kbd-motion-527
job/upload-pill-523
wip/upload-pill-523
wip/tray-order
job/tray-order
wip/overflow-mid
wip/merge-round-2
job/perf-494
wip/perf-494
wip/mcp-fast-492
wip/motion-477
wip/asr-ab-489
wip/theme-variants-506
wip/overflow-511
wip/week-header-508
wip/attach-427
job/dav-delete-471
job/iso-435
wip/iso-435
wip/files-sel-keys
wip/dav-delete-471
job/align-253
job/siwc-490
wip/siwc-490
job/money-kinds-review
wip/align-253
wip/money-kinds-review
job/small-bugs-3
wip/overlay-title-487
wip/multiget-500
wip/hidden-420
wip/webcal-ui
wip/webcal-431
job/perf-367
job/location
wip/small-bugs-3
wip/location
wip/perf-367
wip/admin-deny-483
job/tag-unicode-473
wip/tag-unicode-473
job/blur-436
wip/photos-470
wip/blur-436
wip/small-bugs-4
wip/hunt-20260930
wip/settings-hdr-482
wip/chips-416
job/dedup-375
wip/dedup-375
job/doc-stack
wip/doc-stack
job/tokens-literals
wip/tokens-literals
job/jobs-leftovers
wip/send-fast
wip/paste-467
wip/money-numbers
job/money-plugin
wip/money-plugin
job/break-dav
wip/merge-batch
wip/crossday-469
wip/mac-verify
wip/mail-m2
wip/break-dav
wip/money-review2
job/money-md
job/modes-424
wip/money-md
wip/jobs-leftovers
job/agenda-413
wip/agenda-413
wip/modes-424
job/recog-417
wip/recog-417
wip/bounce-425
wip/ab-384-luna
job/webdav-perf
wip/webdav-perf
job/toast-ring
wip/toast-ring
job/money-review
wip/money-review
wip/micro-motion
wip/settings-card
wip/minical
job/notes-imap-428
job/least-priv
wip/ui-small-2
wip/flaky-426
wip/drag-end-418
job/jank
wip/jank
wip/least-priv
wip/docs-site
job/agenda
job/sec-batch
wip/sec-batch
wip/per-user-index
job/area-calendars
wip/area-calendars
job/parity
wip/parity
job/documents-research
wip/documents-research
job/test-infra
job/reminders-sync
wip/small-bugs-2
wip/reminders-sync
wip/gestures
job/google-oauth
wip/tags-merge
wip/tags
job/e2e-theme
wip/e2e-theme
job/icon-align
wip/test-infra
wip/select-align
wip/editor-385
job/voice
wip/webdav
job/webdav
job/app-pw-ui
job/editor-integrity
wip/editor-integrity
wip/voice
wip/quota
wip/cal-followups
wip/icon-align
job/composer-scale
wip/composer-scale
job/jobs-page
wip/jobs-page
job/hig-type
wip/hig-type
wip/app-pw-ui
job/motion-spring
job/mcp
wip/motion-spring
wip/mcp
job/small-bugs
wip/push-hosts
job/profile-sign
wip/touch-369
wip/profile-sign
job/mobile-focus
wip/mobile-focus
wip/ui-polish-354
wip/small-bugs
wip/dup-task
job/toast-polish
job/app-pw-scopes
wip/toast-polish
wip/app-pw-scopes
wip/cli-agent
wip/selection-pills
job/preview-attach
wip/preview-attach
job/dav-proppatch
wip/dav-proppatch
wip/cal-switcher
job/atomic-race
wip/atomic-race
job/photos-shared
wip/photos-shared
wip/cal-grid
wip/note-rewrite
wip/search-rebuild
job/mail-m1
job/paperless-import
wip/paperless-import
wip/mail-m1
wip/hidden-activity
wip/search-d
wip/pricing-research
wip/cursors
wip/auto-scheme
job/single-pills
wip/single-pills
wip/xuser-matrix
wip/money-format
wip/app-pw-setup
wip/purge-dos
wip/vault-health
wip/caldav-apple
wip/xuser-audit
wip/e2e-green
wip/tabbar
wip/adv-harness
wip/maple-mono
job/search-fix
wip/search-fix
wip/search-perf-c
job/adv-harness
wip/sidebar-headers
job/glass
wip/temp-index
job/polish
wip/polish
wip/file-protocols
wip/money-research
wip/glass
wip/voice-models
wip/collab-redo
job/voice-research
wip/hunt-20260928
wip/notes-actions-research
wip/search-pad
wip/search-perf
wip/search-sticky
wip/editor-undo
wip/chrome-rules
wip/motion
wip/appearance-research
wip/appearance
wip/audit-bugs
wip/cal-glass
wip/block-actions
wip/authz-order
wip/event-stripes
wip/chrome-sidebar
wip/auth-flaky
wip/robust-2
wip/gate-fix
wip/menu-blur
wip/import-calternaljs
wip/tray-fix
job/import-calternaljs
wip/index-order
wip/audit-fixes
wip/search-chevrons
research/mail
wip/phone-chrome
wip/dedup-break
wip/csp
wip/ui-audit
wip/select-toast
wip/perf
wip/flat-layout
wip/fonts
wip/event-tint
wip/sync-converge
wip/data-split
wip/glass-audit
wip/robustness
wip/sync-chaos
wip/search-thumbs
wip/fuzz
wip/menu-icons
wip/search-pill
wip/sync-changing
wip/heading-links
wip/date-formats
wip/a11y
wip/break-editor
wip/e2e-fix
wip/settings-sections
wip/sync-root-guard
wip/search-palette
wip/share-edit
job/toasts
wip/toasts
wip/cont-analytics
wip/authz-review
wip/popovers
wip/overlay-glass
wip/change-feed
wip/editor-modes
wip/composer-align
wip/cont-agenda
wip/agenda-merge
job/agent-conventions
wip/agent-conventions
wip/backend-misc
job/route-audit
wip/route-audit
wip/ui-batch
wip/heif-hardening
wip/grid-resize
wip/ask-page
wip/webmcp
job/deeplink-audit
wip/deeplinks
wip/shortcuts
wip/cont-tz-days
main
No results found.
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal#618
No description provided.