kayg/calternal
Watch
1
0
Fork
You've already forked calternal
 0
Code Issues 803 Pull requests Projects Releases Packages Wiki Activity Actions 430

PERF: one optimistic mutation helper with client IDs and durable Undo receipts (#663) #667

New issue
Open
opened 2026-10-02 05:20:41 +00:00 by kayg · 11 comments
kayg commented 2026-10-02 05:20:41 +00:00
Owner
Copy link

Context: #663 instant-interaction audit. No product change is part of the audit job.

Own rule 4 and shared accepted/durable timing in DESIGN §58. This issue is the only owner of client-ID idempotency, mutation receipts and durable inverse Undo. Tab adoption issues only supply operations and adapters.

Evidence at c4a61e8cf0:

  • Calendar optimistic pending IDs and in-memory Undo exist (apps/web/src/lib/calendar/edits.ts:86, :305).
  • Files uses Undo closures after acknowledgement (apps/web/src/lib/files/transfer.ts:108, :138); FilesBrowser removes rows after awaited trash (FilesBrowser.svelte:714).
  • Mail read-state changes wait for POST (apps/web/src/lib/mail/MailView.svelte:238); Money waits for a write and then reloads (apps/web/src/routes/money/[budget]/accounts/[[account]]/+page.svelte:133). These are not one durable receipt contract.

Expected:

  • One synchronous update changes the item, selection and next item in a single frame, across all retained views. A client-generated operation ID identifies one intent. The server stores a User-scoped durable receipt and inverse transactionally with the accepted mutation.
  • Repeated IDs return the same result; an ID with different input is rejected. A timeout/disconnect is unknown, not a rejection. Provide receipt lookup/reconciliation before replay or rollback. Keep conditional-write conflicts and authoritative server validation.
  • Undo uses the receipt inverse, survives reconnect/restart and checks current access and revision. Do not overwrite an intervening edit. Reuse #539/#616 Undo toasts, Calendar pending helpers and Files agent Undo journals.
  • Provider side effects use existing durable queues. Track accepted and durable times separately in content-free logs. The server remains the single writer through calternal-fs.
  • Credential issuance, sign-out, revocation and destructive Admin security operations keep their existing confirmation/step-up boundary. A safe optimistic pending state must never grant authority or claim irreversible work is complete.

Tests:

  • Same-frame item/selection publication; cross-view updates; definitive 4xx rollback; lost acknowledgement; duplicate/racing IDs; restart before/after receipt commit; receipt expiry; Undo after restart; intervening edit conflict; User/revocation isolation.
  • Existing status assertions and data-loss tests stay unchanged. Add one real-server adversarial regression round for new endpoints.
  • Production/HDD locked VM: ≥5 action samples, median/p95/max, accepted state ≤150 ms; report durable latency separately and burst CPU/RSS.

Reuse/dependencies: #555 user scope, shared cache/snapshot/change owners, Files Undo, Calendar edits, Mail queue. #640/#641/#642 remain owners of their active UI work.

Measurement evidence: see the production/HDD matrix posted on #663. Latencies of sampled endpoints do not prove the shared contract is complete.

Locked production measurement evidence:
The audit intentionally made no User mutation as an acceptance test: 0 action/Undo timing samples. Read latency cannot establish the ≤150 ms accepted-action target. The client awaited-write paths and in-memory inverse closures above are source evidence; this owner issue must supply the durable receipt and accepted/durable benchmark.
Runtime server source cc25c441b7, binary SHA-256 2f3567d91c34839851247bc0acbc25a56aaacd14dca269b8f0342ddf83447ed9, shared release binary with embedded production SPA. The source audit uses the newer c4a61e8 base; no code equivalence claim. Perf VM HDD emulator uses bench/hdd-emu.sh (direct-I/O/ext4, 8 ms read/write delay, 200 IOPS and 150 MiB/s caps) and flock -w 14400 /root/perf.lock for every measured phase. First valid qualification QD1 115.3 IOPS/8.028 ms median, QD16 200.7 IOPS/96.993 ms; load 0.10/0.18/0.08 and 0.20/0.20/0.09. Fixture: 366 Daily notes, 10,980 Logs, 100 Files/Photos, 20 Notes/Tasks, three Budgets and 100 transactions; Mail empty and Admin one User. No matching transport/HDD/fixture baseline exists, so no regression ratio is claimed. Full raw scopes, failure retention and endpoint baseline references are on #663.

Context: #663 instant-interaction audit. No product change is part of the audit job. Own rule 4 and shared accepted/durable timing in DESIGN §58. This issue is the only owner of client-ID idempotency, mutation receipts and durable inverse Undo. Tab adoption issues only supply operations and adapters. Evidence at c4a61e8cf090170f35b1bed3350d9de20c83ecd5: - Calendar optimistic pending IDs and in-memory Undo exist (`apps/web/src/lib/calendar/edits.ts:86`, `:305`). - Files uses Undo closures after acknowledgement (`apps/web/src/lib/files/transfer.ts:108`, `:138`); FilesBrowser removes rows after awaited trash (`FilesBrowser.svelte:714`). - Mail read-state changes wait for POST (`apps/web/src/lib/mail/MailView.svelte:238`); Money waits for a write and then reloads (`apps/web/src/routes/money/[budget]/accounts/[[account]]/+page.svelte:133`). These are not one durable receipt contract. Expected: - One synchronous update changes the item, selection and next item in a single frame, across all retained views. A client-generated operation ID identifies one intent. The server stores a User-scoped durable receipt and inverse transactionally with the accepted mutation. - Repeated IDs return the same result; an ID with different input is rejected. A timeout/disconnect is unknown, not a rejection. Provide receipt lookup/reconciliation before replay or rollback. Keep conditional-write conflicts and authoritative server validation. - Undo uses the receipt inverse, survives reconnect/restart and checks current access and revision. Do not overwrite an intervening edit. Reuse #539/#616 Undo toasts, Calendar pending helpers and Files agent Undo journals. - Provider side effects use existing durable queues. Track accepted and durable times separately in content-free logs. The server remains the single writer through calternal-fs. - Credential issuance, sign-out, revocation and destructive Admin security operations keep their existing confirmation/step-up boundary. A safe optimistic pending state must never grant authority or claim irreversible work is complete. Tests: - Same-frame item/selection publication; cross-view updates; definitive 4xx rollback; lost acknowledgement; duplicate/racing IDs; restart before/after receipt commit; receipt expiry; Undo after restart; intervening edit conflict; User/revocation isolation. - Existing status assertions and data-loss tests stay unchanged. Add one real-server adversarial regression round for new endpoints. - Production/HDD locked VM: ≥5 action samples, median/p95/max, accepted state ≤150 ms; report durable latency separately and burst CPU/RSS. Reuse/dependencies: #555 user scope, shared cache/snapshot/change owners, Files Undo, Calendar edits, Mail queue. #640/#641/#642 remain owners of their active UI work. Measurement evidence: see the production/HDD matrix posted on #663. Latencies of sampled endpoints do not prove the shared contract is complete. Locked production measurement evidence: The audit intentionally made no User mutation as an acceptance test: 0 action/Undo timing samples. Read latency cannot establish the ≤150 ms accepted-action target. The client awaited-write paths and in-memory inverse closures above are source evidence; this owner issue must supply the durable receipt and accepted/durable benchmark. Runtime server source cc25c441b7a974185622a1dee853cf38686d2b67, binary SHA-256 2f3567d91c34839851247bc0acbc25a56aaacd14dca269b8f0342ddf83447ed9, shared release binary with embedded production SPA. The source audit uses the newer c4a61e8 base; no code equivalence claim. Perf VM HDD emulator uses bench/hdd-emu.sh (direct-I/O/ext4, 8 ms read/write delay, 200 IOPS and 150 MiB/s caps) and flock -w 14400 /root/perf.lock for every measured phase. First valid qualification QD1 115.3 IOPS/8.028 ms median, QD16 200.7 IOPS/96.993 ms; load 0.10/0.18/0.08 and 0.20/0.20/0.09. Fixture: 366 Daily notes, 10,980 Logs, 100 Files/Photos, 20 Notes/Tasks, three Budgets and 100 transactions; Mail empty and Admin one User. No matching transport/HDD/fixture baseline exists, so no regression ratio is claimed. Full raw scopes, failure retention and endpoint baseline references are on #663.
mail-preferences-1440-dark.png
171 KiB
mail-preferences-1440-light.png
130 KiB
mail-preferences-390-dark.png
104 KiB
mail-preferences-390-light.png
73 KiB
mail-reader-390-dark.png
305 KiB
mail-preferences-820-dark.png
133 KiB
mail-preferences-820-light.png
97 KiB
mail-reader-1440-dark.png
849 KiB
mail-reader-1440-light.png
863 KiB
mail-reader-390-light.png
287 KiB
mail-reader-820-dark.png
408 KiB
mail-reader-820-light.png
284 KiB
mail-preferences-1440-dark.png
164 KiB
mail-preferences-1440-light.png
130 KiB
mail-preferences-390-dark.png
104 KiB
mail-preferences-390-light.png
72 KiB
mail-reader-390-dark.png
305 KiB
mail-reader-390-light.png
287 KiB
mail-reader-820-light.png
284 KiB
mail-preferences-820-dark.png
133 KiB
mail-preferences-820-light.png
90 KiB
mail-reader-1440-dark.png
846 KiB
mail-reader-1440-light.png
863 KiB
mail-reader-820-dark.png
410 KiB
mail-preferences-1440-dark.png mail-preferences-1440-light.png mail-preferences-390-dark.png mail-preferences-390-light.png mail-reader-390-dark.png mail-preferences-820-dark.png mail-preferences-820-light.png mail-reader-1440-dark.png mail-reader-1440-light.png mail-reader-390-light.png mail-reader-820-dark.png mail-reader-820-light.png mail-preferences-1440-dark.png mail-preferences-1440-light.png mail-preferences-390-dark.png mail-preferences-390-light.png mail-reader-390-dark.png mail-reader-390-light.png mail-reader-820-light.png mail-preferences-820-dark.png mail-preferences-820-light.png mail-reader-1440-dark.png mail-reader-1440-light.png mail-reader-820-dark.png
kayg commented 2026-10-02 07:35:53 +00:00
Author
Owner
Copy link

Started #667 on job/perf-mut-667, base c4a61e8cf090170f35b1bed3350d9de20c83ecd5. Read #663 matrix and DESIGN §58; imported its two documentation commits. Scope: one shared transactional receipt/Undo contract and one client mutation helper, with at most one proving Tab adapter. No push or deploy. Other shared primitives stay with #665/#666/#668.

Started #667 on `job/perf-mut-667`, base `c4a61e8cf090170f35b1bed3350d9de20c83ecd5`. Read #663 matrix and DESIGN §58; imported its two documentation commits. Scope: one shared transactional receipt/Undo contract and one client mutation helper, with at most one proving Tab adapter. No push or deploy. Other shared primitives stay with #665/#666/#668.
kayg commented 2026-10-02 07:51:38 +00:00
Author
Owner
Copy link

Core receipt slice committed as 245ca30b3. calternal-db clippy and tests pass. Tests show that racing duplicate IDs commit one domain write, dropped transactions leave no receipt, replay and inverse Undo survive an Index reopen, and different input / other User / expired ID cannot reuse the receipt.

Proving adapter choice: Mail's read-marking preference. This is an Index-only User preference with no provider effect; existing synchronous Mail Seen changes remain with the Mail adoption issue. Legacy preference PATCH keeps its 204 status and advances the revision so an Undo cannot erase an intervening legacy write. New forward, receipt lookup and Undo routes check the current data scope before accessing receipts. No other shared primitive is implemented.

Decisions: inverse retention is 24 hours, distinct from the existing eight-second Undo toast. IDs remain tombstones after expiry; 10,000 receipts per User bound this initial store. The existing Db WAL/NORMAL policy remains: committed receipts survive process restart, but this does not add a power-loss guarantee. File/provider adapters must use their recovery journals/durable queues; this job does not invent a second filesystem writer.

Core receipt slice committed as `245ca30b3`. `calternal-db` clippy and tests pass. Tests show that racing duplicate IDs commit one domain write, dropped transactions leave no receipt, replay and inverse Undo survive an Index reopen, and different input / other User / expired ID cannot reuse the receipt. Proving adapter choice: Mail's read-marking preference. This is an Index-only User preference with no provider effect; existing synchronous Mail Seen changes remain with the Mail adoption issue. Legacy preference PATCH keeps its 204 status and advances the revision so an Undo cannot erase an intervening legacy write. New forward, receipt lookup and Undo routes check the current data scope before accessing receipts. No other shared primitive is implemented. Decisions: inverse retention is 24 hours, distinct from the existing eight-second Undo toast. IDs remain tombstones after expiry; 10,000 receipts per User bound this initial store. The existing Db WAL/NORMAL policy remains: committed receipts survive process restart, but this does not add a power-loss guarantee. File/provider adapters must use their recovery journals/durable queues; this job does not invent a second filesystem writer.
kayg commented 2026-10-02 07:54:46 +00:00
Author
Owner
Copy link

Client primitive committed as 29470a99e0d230f22311dea5e9e17a46a8eb8966: one synchronous adapter publication, bounded User-scoped pending intent storage, same-ID reconciliation before replay, no rollback for transport/5xx/expired lookup outcomes. Seven focused tests pass, including same-frame shared-view publication, restart after lost acknowledgement, User-switch fencing and coalesced reconciliation. The initial web check passes with zero errors/warnings. No dependencies added or versions changed.

Client primitive committed as `29470a99e0d230f22311dea5e9e17a46a8eb8966`: one synchronous adapter publication, bounded User-scoped pending intent storage, same-ID reconciliation before replay, no rollback for transport/5xx/expired lookup outcomes. Seven focused tests pass, including same-frame shared-view publication, restart after lost acknowledgement, User-switch fencing and coalesced reconciliation. The initial web check passes with zero errors/warnings. No dependencies added or versions changed.
kayg commented 2026-10-02 08:24:58 +00:00
Author
Owner
Copy link

Mail proving adoption is committed in 19f4f4f02, with server adapter/timing commits 680aafdad and f25e89223. Seventeen focused web tests and the production SPA build pass. Settings and retained Mail readers now share the preference value, and body loading does not wait for preference reconciliation. The UI has Undo, reload on rejection/load error, and Check again for unknown acknowledgements. A saved Undo action is fenced at session end.

Expiry correction: inverse application expires after 24 hours; receipt lookup and same-ID replay continue to return the committed outcome. This prevents rollback or a second write when an acknowledgement was lost longer than the Undo window. Core regression commit: 5a3237ee2.

The required one-time fetch/merge of origin/dev returned Already up to date. Core migration 7 and Mail migration 10 remain free on that remote branch. Final per-crate gates are queued behind the current server build. The earlier server check had no production SPA directory; the prerequisite is now built. One prerequisite compilation was interrupted (exit 130); it is retained in the local log and resumed, not counted as a passed gate.

Interfaces for #669–#676/#701: Db::begin_mutation -> Replay/New transaction, MutationTransaction::connection/take_inverse/commit, Db::mutation_receipt, and mutationController with synchronous publish/confirm/reject plus send/lookup. The adoption guide is docs/mutations/receipts.md. #665/#666/#668 caches and change streams are not reimplemented. A generic SQLite receipt cannot atomically commit a file rename: Files/Calendar/Notes adapters must reuse their recovery journals and calternal-fs; provider adapters enqueue their durable jobs inside the same transaction.

Mail proving adoption is committed in `19f4f4f02`, with server adapter/timing commits `680aafdad` and `f25e89223`. Seventeen focused web tests and the production SPA build pass. Settings and retained Mail readers now share the preference value, and body loading does not wait for preference reconciliation. The UI has Undo, reload on rejection/load error, and Check again for unknown acknowledgements. A saved Undo action is fenced at session end. Expiry correction: inverse application expires after 24 hours; receipt lookup and same-ID replay continue to return the committed outcome. This prevents rollback or a second write when an acknowledgement was lost longer than the Undo window. Core regression commit: `5a3237ee2`. The required one-time fetch/merge of `origin/dev` returned `Already up to date.` Core migration 7 and Mail migration 10 remain free on that remote branch. Final per-crate gates are queued behind the current server build. The earlier server check had no production SPA directory; the prerequisite is now built. One prerequisite compilation was interrupted (exit 130); it is retained in the local log and resumed, not counted as a passed gate. Interfaces for #669–#676/#701: `Db::begin_mutation` -> Replay/New transaction, `MutationTransaction::connection/take_inverse/commit`, `Db::mutation_receipt`, and `mutationController` with synchronous publish/confirm/reject plus send/lookup. The adoption guide is `docs/mutations/receipts.md`. #665/#666/#668 caches and change streams are not reimplemented. A generic SQLite receipt cannot atomically commit a file rename: Files/Calendar/Notes adapters must reuse their recovery journals and calternal-fs; provider adapters enqueue their durable jobs inside the same transaction.
kayg commented 2026-10-02 08:58:03 +00:00
Author
Owner
Copy link

Head 429bd6193, branch job/perf-mut-667.

Receipt history must preserve an acknowledged outcome even after the Undo window expires. Lookup and same-ID replay return that outcome; only inverse application returns 410 after 24 hours. Deleting an expired ID would permit duplicate work after a lost acknowledgement.

The initial 10,000-receipt cap is removed. It would block all later edits by the User and require a COUNT on each intent. The Index now grows with accepted intents. Input, result and inverse remain limited to 64 KiB each. An archival policy is a follow-up; it must keep replay protection. The new bench profile tests 100,000 retained receipt rows and a five-request duplicate-ID burst.

Database gates: 10 unit tests, 3 receipt tests, 16 queue tests pass (1 existing ignored). Mail gates: 47 tests pass (2 existing ignored). Clippy passes for both crates. The four-route real local User/scope matrix, session revocation, duplicate/reused IDs, Undo replay and intervening legacy edits pass. Production pointer/touch/keyboard walk, lost acknowledgement recovery, conflict Retry and Undo after reload pass. Twelve screenshots are attached: 390/820/1440 px, light/dark, Settings and Mail reader. Visual review remains with the orchestrator.

The final loading review found state and restored-Undo reads without a deadline. Both now use a 15-second deadline so a stalled request releases loading and permits Retry. A regression test covers timeout and retry. Web gates and final server tests are running; the production build will be measured under the perf VM lock after it completes.

Head 429bd6193, branch job/perf-mut-667. Receipt history must preserve an acknowledged outcome even after the Undo window expires. Lookup and same-ID replay return that outcome; only inverse application returns 410 after 24 hours. Deleting an expired ID would permit duplicate work after a lost acknowledgement. The initial 10,000-receipt cap is removed. It would block all later edits by the User and require a COUNT on each intent. The Index now grows with accepted intents. Input, result and inverse remain limited to 64 KiB each. An archival policy is a follow-up; it must keep replay protection. The new bench profile tests 100,000 retained receipt rows and a five-request duplicate-ID burst. Database gates: 10 unit tests, 3 receipt tests, 16 queue tests pass (1 existing ignored). Mail gates: 47 tests pass (2 existing ignored). Clippy passes for both crates. The four-route real local User/scope matrix, session revocation, duplicate/reused IDs, Undo replay and intervening legacy edits pass. Production pointer/touch/keyboard walk, lost acknowledgement recovery, conflict Retry and Undo after reload pass. Twelve screenshots are attached: 390/820/1440 px, light/dark, Settings and Mail reader. Visual review remains with the orchestrator. The final loading review found state and restored-Undo reads without a deadline. Both now use a 15-second deadline so a stalled request releases loading and permits Retry. A regression test covers timeout and retry. Web gates and final server tests are running; the production build will be measured under the perf VM lock after it completes.
kayg commented 2026-10-02 09:16:31 +00:00
Author
Owner
Copy link

Final review findings, branch job/perf-mut-667, head 8582b76ad.

The first release binary was built while the 10,000-row quota was being removed. A local profile seeded 100,000 receipt rows and received 500 on the next action. That binary still contains SELECT count(*) FROM mutation_receipts WHERE owner_id=?. This obsolete-binary run is retained in bench-local-profile.json and is not a successful budget sample. The source quota removal is 429bd6193. Regression test 8582b76ad seeds 10,001 old receipts, accepts a fresh ID, and verifies its receipt. Database gates pass, including that fourth receipt test. The current release is being rebuilt before VM measurement.

The retained Mail reader also had an incomplete pending guard: a tentative preference could start an automatic provider read timer. The shared model now allows this timer only after confirmation. Pending or unknown state cancels the timer; confirmation reschedules it. The new test exercises initial loading, confirmed state, lost acknowledgement and receipt reconciliation. This does not delay bodies or adopt the provider Seen mutation; that adapter remains a follow-up in #672. Web gates are running for this final correction.

Final review findings, branch job/perf-mut-667, head 8582b76ad. The first release binary was built while the 10,000-row quota was being removed. A local profile seeded 100,000 receipt rows and received 500 on the next action. That binary still contains `SELECT count(*) FROM mutation_receipts WHERE owner_id=?`. This obsolete-binary run is retained in bench-local-profile.json and is not a successful budget sample. The source quota removal is 429bd6193. Regression test 8582b76ad seeds 10,001 old receipts, accepts a fresh ID, and verifies its receipt. Database gates pass, including that fourth receipt test. The current release is being rebuilt before VM measurement. The retained Mail reader also had an incomplete pending guard: a tentative preference could start an automatic provider read timer. The shared model now allows this timer only after confirmation. Pending or unknown state cancels the timer; confirmation reschedules it. The new test exercises initial loading, confirmed state, lost acknowledgement and receipt reconciliation. This does not delay bodies or adopt the provider Seen mutation; that adapter remains a follow-up in #672. Web gates are running for this final correction.
kayg commented 2026-10-02 09:45:00 +00:00
Author
Owner
Copy link

Code and gates are complete. Current head: 2f2dee97e9. Last product change: 3c313d4ed7.

Final release records GIT_COMMIT=3c313d4ed705fe5c00b09e6508ef9d12f39220dd. Binary SHA-256: af05232a711fdce969b8f28b3d4985e716cdf3fb8a7b8ce02fe875d70e899d48. The release openapi subcommand rewrote the contract with no git diff. The SPA walk passed again and 12 current production SPA captures are attached.

The VM profile queued at 09:30 UTC behind flock -w 14400 /root/perf.lock. It has not acquired the lock or run any VM samples yet. No measurement is made outside the lock. Chromium and the server will both run on the VM; the HTTPS front is forwarded from the build host. The profile keeps five forward and five Undo samples each for warm state, a fresh server process and 100,000 retained receipts, then a five-request duplicate-ID burst. It checks /api/v1/system/info against the selected source and records CPU/RSS, both timing boundaries, load inside the lock, HDD qualification and all raw samples. There is no matching accepted/durable mutation baseline.

All current gates pass: Db 10 unit + 4 receipt + 16 queue tests (1 existing ignored); Mail 47 (2 existing ignored); server 107 (3 existing ignored); Clippy clean for all three crates; fmt clean; web check 0 errors/0 warnings, 155 files and 1,065 tests pass. The final report will quote the exact output. Measurement and cleanup remain pending.

Code and gates are complete. Current head: 2f2dee97e9c632890d3b43ffad745a790e28dde4. Last product change: 3c313d4ed705fe5c00b09e6508ef9d12f39220dd. Final release records GIT_COMMIT=3c313d4ed705fe5c00b09e6508ef9d12f39220dd. Binary SHA-256: af05232a711fdce969b8f28b3d4985e716cdf3fb8a7b8ce02fe875d70e899d48. The release `openapi` subcommand rewrote the contract with no git diff. The SPA walk passed again and 12 current production SPA captures are attached. The VM profile queued at 09:30 UTC behind `flock -w 14400 /root/perf.lock`. It has not acquired the lock or run any VM samples yet. No measurement is made outside the lock. Chromium and the server will both run on the VM; the HTTPS front is forwarded from the build host. The profile keeps five forward and five Undo samples each for warm state, a fresh server process and 100,000 retained receipts, then a five-request duplicate-ID burst. It checks `/api/v1/system/info` against the selected source and records CPU/RSS, both timing boundaries, load inside the lock, HDD qualification and all raw samples. There is no matching accepted/durable mutation baseline. All current gates pass: Db 10 unit + 4 receipt + 16 queue tests (1 existing ignored); Mail 47 (2 existing ignored); server 107 (3 existing ignored); Clippy clean for all three crates; fmt clean; web check 0 errors/0 warnings, 155 files and 1,065 tests pass. The final report will quote the exact output. Measurement and cleanup remain pending.
kayg commented 2026-10-02 10:38:25 +00:00
Author
Owner
Copy link

#667 completion report

Branch: job/perf-mut-667. Base: c4a61e8cf090170f35b1bed3350d9de20c83ecd5. Head: 52d2b17f80.

Built

One shared receipt transaction in calternal-db. It stores the domain write, inverse and committed result in one writer transaction. Operation IDs are scoped by User across operation kinds. Same-ID retries return the committed result; changed input conflicts. Undo uses a fresh ID and the server inverse. An intervening revision conflicts and rolls back the Undo mark. Restart, duplicate/racing IDs, expired inverse windows and dropped transactions have regression tests.

One shared optimistic client controller. One synchronous adapter callback publishes the item, selection and next item. It persists pending intent IDs through userStorage before network I/O. Lost acknowledgement remains unknown. Reconciliation looks up the receipt before a same-ID replay. Only a definite write rejection permits rollback. Session changes fence late responses.

The proving adapter is Mail read marking, shared by Settings and retained readers. Four routes add revision-bearing state, conditional mutation, receipt lookup and inverse Undo. Legacy GET/PATCH stay unchanged; legacy PATCH advances the revision. Pending preferences cannot start the automatic provider read timer. Bodies do not await preference reconciliation. Existing provider Seen writes remain in #672.

Generated the API client, OpenAPI contract, action registry and parity matrix. Added the real-server regression probe, cross-User route fixtures, production UI walk and bench/mutation-receipts.mjs. Imported the parent DESIGN §58 commits as requested. No other cache or stream primitive is implemented.

Files

  • CLAUDE.md
  • apps/web/e2e/mutation-receipts-667.mjs
  • apps/web/src/lib/mail/MailView.svelte
  • apps/web/src/lib/mail/preferences.svelte.test.ts
  • apps/web/src/lib/mail/preferences.svelte.ts
  • apps/web/src/lib/mutations.test.ts
  • apps/web/src/lib/mutations.ts
  • apps/web/src/routes/settings/mail/MailSection.svelte
  • bench/mutation-receipts.mjs
  • contracts/actions.json
  • contracts/openapi.json
  • crates/calternal-db/src/lib.rs
  • crates/calternal-db/src/migrations.rs
  • crates/calternal-db/src/migrations/0007_mutation_receipts.sql
  • crates/calternal-db/src/mutations.rs
  • crates/calternal-db/tests/mutations.rs
  • crates/plugins/mail/migrations/0010_preference_revision.sql
  • crates/plugins/mail/src/cache.rs
  • crates/plugins/mail/src/cache/store.rs
  • crates/plugins/mail/src/routes.rs
  • docs/DESIGN.md
  • docs/mutations/receipts.md
  • docs/parity-matrix.md
  • docs/perf/2026-10-02-mutations-667.md
  • docs/perf/runs/2026-10-02-mutations-667-bench-local-profile.json
  • docs/perf/runs/2026-10-02-mutations-667-bench-local-validation.json
  • docs/perf/runs/2026-10-02-mutations-667-bench-vm-browser-missing.json
  • docs/perf/runs/2026-10-02-mutations-667-bench-vm-diagnostic-failed.json
  • docs/perf/runs/2026-10-02-mutations-667-bench-vm-startup-failed.json
  • docs/perf/runs/2026-10-02-mutations-667.json
  • packages/api-client/src/generated.ts
  • tests/adversarial/mutation_receipts.mjs
  • tests/adversarial/xuser_matrix.py

UX gaps closed

  • Preference choices update in the input frame through one shared model.
  • Undo uses the server inverse and works after a document/server restart.
  • Lost acknowledgement keeps the choice and offers Check again, including reconnect recovery.
  • Definite conflicts show Reload and recover the authoritative choice.
  • State and restored-Undo reads have a 15-second deadline. Loading releases on timeout and Retry works.
  • Pending/unknown preferences cancel automatic provider read timers. Confirmation reschedules the timer.
  • Pointer, touch and keyboard use the existing shared controls and Undo toast. Settings retains its Copy link action. Real empty Mail remains a real API empty state.

UX gaps left / known gaps

Other Tabs adopt this primitive in #669–#676 and #701. Provider Seen receipts remain in #672. File adapters must use their existing recovery journals; a SQLite receipt alone cannot make a filesystem rename atomic with commit. Visual approval remains with the orchestrator; 12 current production SPA captures are attached below.

Receipt history grows with accepted intents. A later archive policy must preserve ID replay protection. Browser storage can be disabled; the server receipt remains, but a document restart cannot recover an intent reference that the browser did not retain. The existing SQLite WAL/NORMAL policy gives process-restart durability; this job does not add a power-loss guarantee.

Decisions

DESIGN §58 does not set an inverse window, byte limit or adapter transport shape. This job uses a 24-hour inverse window, 64 KiB each for input/result/inverse, and at most 100 pending client intents / 64 KiB client state. Lookup and replay remain available after the inverse window. There is no lifetime action quota. Mail accepts one pending preference at a time to avoid inverse reordering. New conditional routes preserve the existing GET/PATCH contract. The read-marking preference is the one proving adapter; provider and filesystem adoption remains with the follow-up owners.

Gates (verbatim output)

cargo fmt --check returned 0 with no output. All cargo commands used line-tables-only, incremental=0 and build jobs=4. Rust gates ran per crate. Web tests used two workers.

cargo clippy -p calternal-db --all-targets -- -D warnings
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 4.00s
cargo test -p calternal-db
test result: ok. 10 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 8.32s
test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.40s
test result: ok. 16 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.82s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
cargo clippy -p calternal-plugin-mail --all-targets -- -D warnings
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 56.20s
cargo test -p calternal-plugin-mail
test result: ok. 47 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 1.31s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
cargo clippy -p calternal-server --all-targets -- -D warnings
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 2m 01s
cargo test -p calternal-server
test result: ok. 107 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 16.43s
bun run check
svelte-check found 0 errors and 0 warnings
bun run test --maxWorkers=2
 Test Files  155 passed (155)
      Tests  1065 passed (1065)
   Duration  146.50s (transform 26%, environment 26%, import 25%, tests 17%, setup 5%)

The one-time git fetch origin / git merge origin/dev returned:

Already up to date.

Core migration 7 and Mail migration 10 were free on fetched origin/dev before the final gates.

Real local server round:

PASS: legacy contract, duplicate/reused IDs, Undo replay, intervening edit, four-route User/scope matrix
PASS: session revocation blocks receipt lookup
PASS: pointer/touch/keyboard, lost acknowledgement, conflict Retry, Undo after reload; 12 width/theme captures

Offline cross-User classification: 339 API operations and 957 generated tools classified; 7 classification tests pass. Admin coverage: 39 reviewed operations agree with Rust guards. The new routes cover anonymous, another User, protocol-scoped, read-only API-scoped and revoked sessions. Existing test expectations are unchanged.

Performance

Locked production/HDD run: 30 valid samples, five forward and five Undo per phase. Both Chromium 153.0.8010.12 and the server ran on the VM; the HTTPS front used SSH forwarding. Production source 3c313d4ed705fe5c00b09e6508ef9d12f39220dd, binary SHA-256 af05232a711fdce969b8f28b3d4985e716cdf3fb8a7b8ce02fe875d70e899d48. Profile source 3b5dd40abf89d133b04fc78ebfbfd2b260c2c9f3, profile SHA-256 ff1cab97f2226792a8323f6ac77f057f1f5a91d31942db9efada095c9d65f735. The server source endpoint matched the selected revision.

Phase / action Accepted median / p95 / max, ms Durable median / p95 / max, ms
average / forward 3.6 / 120.6 / 120.6 83.8 / 126.8 / 126.8
average / undo 6.4 / 81.7 / 81.7 91.8 / 523.2 / 523.2
cold-process / forward 105.3 / 114.0 / 114.0 83.1 / 85.4 / 85.4
cold-process / undo 61.9 / 175.5 / 175.5 80.7 / 88.6 / 88.6
large-history / forward 3.0 / 3.6 / 3.6 79.7 / 329.9 / 329.9
large-history / undo 9.2 / 13.3 / 13.3 78.9 / 83.2 / 83.2

Accepted is click to the next frame with checked DOM state. Durable ends when the client reads the receipt. Cold means a fresh server process before each input; OS caches remain. Large history starts at 100,020 receipts, including 100,000 fixture rows. All slow samples remain. Warm and large-history accepted states meet 150 ms. One cold Undo sample is 175.5 ms, tracked in #713; it does not block the merge.

The full warm interval used 70 ms server CPU (0.30% of one CPU) and 11780 ms browser CPU over 23.36 seconds. Warm sampled peak server RSS is 191.8 MiB; browser process RSS sum is 2009.4 MiB. Sampling intervals include automation/SSH waits and browser work; these are not per-handler costs. RSS can double-count shared pages. CPU counters have 10 ms resolution.

The five-request duplicate-ID burst returned identical committed results: 1085.5 ms wall, 0 ms server CPU tick delta, 20 ms browser CPU, 138.9 MiB server RSS and 1939.5 MiB browser RSS sum. Zero tick delta does not mean zero work.

HDD qualification passed: QD1 124.9 IOPS / 8.028 ms median; QD16 200.9 IOPS / 100.139 ms median. Load inside the lock at cold phase: 2.13 1.95 1.83 1/444 64887. Full phase load and raw samples are committed in docs/perf/2026-10-02-mutations-667.md and docs/perf/runs/2026-10-02-mutations-667.json.

There is no matching accepted/durable mutation baseline. docs/perf/baseline.json source 369ab6a2f9fc673e3564b94857fbecfeb04df404 has Mail accounts read p50 1.3 ms / p95 3.8 ms; that is context only, not a comparable mutation baseline. No regression ratio is claimed.

Incomplete runs are committed beside the successful raw record and excluded from budgets: an earlier local harness check, an obsolete-binary local 500 at 100,000 receipts, two VM startup attempts before fixture-root creation, and one qualified HDD run that did not find the existing Chromium path. The lifetime quota is removed, the 10,001-row regression passes, and this run accepts intents at 100,020 rows. The profile now creates fixture roots, retains sanitized startup diagnostics and finds /opt/ms-playwright and headless-shell caches.

Review captures

Current production SPA 3c313d4ed705fe5c00b09e6508ef9d12f39220dd, real isolated API, phone 390 px, tablet 820 px and desktop 1440 px, light and dark. No screenshots or binary artifacts are committed.

Cleanup

Cargo clean completed (verbatim):

     Removed 24111 files, 11.0GiB total

Removed web build output, .svelte-kit, temporary test data, the media fixture and Python bytecode. Review screenshots remain in artifacts/. VM cleanup check: zero #667 fixture roots and zero #667 copied servers. No push or deploy. The only merge was the requested origin/dev update. The issue remains open.

# #667 completion report Branch: `job/perf-mut-667`. Base: `c4a61e8cf090170f35b1bed3350d9de20c83ecd5`. Head: 52d2b17f805072cd0304d7a05fe0534523cc7bc3. ## Built One shared receipt transaction in calternal-db. It stores the domain write, inverse and committed result in one writer transaction. Operation IDs are scoped by User across operation kinds. Same-ID retries return the committed result; changed input conflicts. Undo uses a fresh ID and the server inverse. An intervening revision conflicts and rolls back the Undo mark. Restart, duplicate/racing IDs, expired inverse windows and dropped transactions have regression tests. One shared optimistic client controller. One synchronous adapter callback publishes the item, selection and next item. It persists pending intent IDs through userStorage before network I/O. Lost acknowledgement remains unknown. Reconciliation looks up the receipt before a same-ID replay. Only a definite write rejection permits rollback. Session changes fence late responses. The proving adapter is Mail read marking, shared by Settings and retained readers. Four routes add revision-bearing state, conditional mutation, receipt lookup and inverse Undo. Legacy GET/PATCH stay unchanged; legacy PATCH advances the revision. Pending preferences cannot start the automatic provider read timer. Bodies do not await preference reconciliation. Existing provider Seen writes remain in #672. Generated the API client, OpenAPI contract, action registry and parity matrix. Added the real-server regression probe, cross-User route fixtures, production UI walk and bench/mutation-receipts.mjs. Imported the parent DESIGN §58 commits as requested. No other cache or stream primitive is implemented. ## Files - `CLAUDE.md` - `apps/web/e2e/mutation-receipts-667.mjs` - `apps/web/src/lib/mail/MailView.svelte` - `apps/web/src/lib/mail/preferences.svelte.test.ts` - `apps/web/src/lib/mail/preferences.svelte.ts` - `apps/web/src/lib/mutations.test.ts` - `apps/web/src/lib/mutations.ts` - `apps/web/src/routes/settings/mail/MailSection.svelte` - `bench/mutation-receipts.mjs` - `contracts/actions.json` - `contracts/openapi.json` - `crates/calternal-db/src/lib.rs` - `crates/calternal-db/src/migrations.rs` - `crates/calternal-db/src/migrations/0007_mutation_receipts.sql` - `crates/calternal-db/src/mutations.rs` - `crates/calternal-db/tests/mutations.rs` - `crates/plugins/mail/migrations/0010_preference_revision.sql` - `crates/plugins/mail/src/cache.rs` - `crates/plugins/mail/src/cache/store.rs` - `crates/plugins/mail/src/routes.rs` - `docs/DESIGN.md` - `docs/mutations/receipts.md` - `docs/parity-matrix.md` - `docs/perf/2026-10-02-mutations-667.md` - `docs/perf/runs/2026-10-02-mutations-667-bench-local-profile.json` - `docs/perf/runs/2026-10-02-mutations-667-bench-local-validation.json` - `docs/perf/runs/2026-10-02-mutations-667-bench-vm-browser-missing.json` - `docs/perf/runs/2026-10-02-mutations-667-bench-vm-diagnostic-failed.json` - `docs/perf/runs/2026-10-02-mutations-667-bench-vm-startup-failed.json` - `docs/perf/runs/2026-10-02-mutations-667.json` - `packages/api-client/src/generated.ts` - `tests/adversarial/mutation_receipts.mjs` - `tests/adversarial/xuser_matrix.py` ## UX gaps closed - Preference choices update in the input frame through one shared model. - Undo uses the server inverse and works after a document/server restart. - Lost acknowledgement keeps the choice and offers Check again, including reconnect recovery. - Definite conflicts show Reload and recover the authoritative choice. - State and restored-Undo reads have a 15-second deadline. Loading releases on timeout and Retry works. - Pending/unknown preferences cancel automatic provider read timers. Confirmation reschedules the timer. - Pointer, touch and keyboard use the existing shared controls and Undo toast. Settings retains its Copy link action. Real empty Mail remains a real API empty state. ## UX gaps left / known gaps Other Tabs adopt this primitive in #669–#676 and #701. Provider Seen receipts remain in #672. File adapters must use their existing recovery journals; a SQLite receipt alone cannot make a filesystem rename atomic with commit. Visual approval remains with the orchestrator; 12 current production SPA captures are attached below. Receipt history grows with accepted intents. A later archive policy must preserve ID replay protection. Browser storage can be disabled; the server receipt remains, but a document restart cannot recover an intent reference that the browser did not retain. The existing SQLite WAL/NORMAL policy gives process-restart durability; this job does not add a power-loss guarantee. ## Decisions DESIGN §58 does not set an inverse window, byte limit or adapter transport shape. This job uses a 24-hour inverse window, 64 KiB each for input/result/inverse, and at most 100 pending client intents / 64 KiB client state. Lookup and replay remain available after the inverse window. There is no lifetime action quota. Mail accepts one pending preference at a time to avoid inverse reordering. New conditional routes preserve the existing GET/PATCH contract. The read-marking preference is the one proving adapter; provider and filesystem adoption remains with the follow-up owners. ## Gates (verbatim output) `cargo fmt --check` returned 0 with no output. All cargo commands used line-tables-only, incremental=0 and build jobs=4. Rust gates ran per crate. Web tests used two workers. ```text cargo clippy -p calternal-db --all-targets -- -D warnings Finished `dev` profile [unoptimized + debuginfo] target(s) in 4.00s cargo test -p calternal-db test result: ok. 10 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 8.32s test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.40s test result: ok. 16 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.82s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s cargo clippy -p calternal-plugin-mail --all-targets -- -D warnings Finished `dev` profile [unoptimized + debuginfo] target(s) in 56.20s cargo test -p calternal-plugin-mail test result: ok. 47 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 1.31s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s cargo clippy -p calternal-server --all-targets -- -D warnings Finished `dev` profile [unoptimized + debuginfo] target(s) in 2m 01s cargo test -p calternal-server test result: ok. 107 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 16.43s bun run check svelte-check found 0 errors and 0 warnings bun run test --maxWorkers=2 Test Files 155 passed (155) Tests 1065 passed (1065) Duration 146.50s (transform 26%, environment 26%, import 25%, tests 17%, setup 5%) ``` The one-time `git fetch origin` / `git merge origin/dev` returned: ```text Already up to date. ``` Core migration 7 and Mail migration 10 were free on fetched origin/dev before the final gates. Real local server round: ```text PASS: legacy contract, duplicate/reused IDs, Undo replay, intervening edit, four-route User/scope matrix PASS: session revocation blocks receipt lookup PASS: pointer/touch/keyboard, lost acknowledgement, conflict Retry, Undo after reload; 12 width/theme captures ``` Offline cross-User classification: 339 API operations and 957 generated tools classified; 7 classification tests pass. Admin coverage: 39 reviewed operations agree with Rust guards. The new routes cover anonymous, another User, protocol-scoped, read-only API-scoped and revoked sessions. Existing test expectations are unchanged. ## Performance Locked production/HDD run: 30 valid samples, five forward and five Undo per phase. Both Chromium 153.0.8010.12 and the server ran on the VM; the HTTPS front used SSH forwarding. Production source `3c313d4ed705fe5c00b09e6508ef9d12f39220dd`, binary SHA-256 `af05232a711fdce969b8f28b3d4985e716cdf3fb8a7b8ce02fe875d70e899d48`. Profile source `3b5dd40abf89d133b04fc78ebfbfd2b260c2c9f3`, profile SHA-256 `ff1cab97f2226792a8323f6ac77f057f1f5a91d31942db9efada095c9d65f735`. The server source endpoint matched the selected revision. | Phase / action | Accepted median / p95 / max, ms | Durable median / p95 / max, ms | | --- | --- | --- | | average / forward | 3.6 / 120.6 / 120.6 | 83.8 / 126.8 / 126.8 | | average / undo | 6.4 / 81.7 / 81.7 | 91.8 / 523.2 / 523.2 | | cold-process / forward | 105.3 / 114.0 / 114.0 | 83.1 / 85.4 / 85.4 | | cold-process / undo | 61.9 / 175.5 / 175.5 | 80.7 / 88.6 / 88.6 | | large-history / forward | 3.0 / 3.6 / 3.6 | 79.7 / 329.9 / 329.9 | | large-history / undo | 9.2 / 13.3 / 13.3 | 78.9 / 83.2 / 83.2 | Accepted is click to the next frame with checked DOM state. Durable ends when the client reads the receipt. Cold means a fresh server process before each input; OS caches remain. Large history starts at 100,020 receipts, including 100,000 fixture rows. All slow samples remain. Warm and large-history accepted states meet 150 ms. One cold Undo sample is 175.5 ms, tracked in [#713](https://git.kayg.org/kayg/calternal/issues/713); it does not block the merge. The full warm interval used 70 ms server CPU (0.30% of one CPU) and 11780 ms browser CPU over 23.36 seconds. Warm sampled peak server RSS is 191.8 MiB; browser process RSS sum is 2009.4 MiB. Sampling intervals include automation/SSH waits and browser work; these are not per-handler costs. RSS can double-count shared pages. CPU counters have 10 ms resolution. The five-request duplicate-ID burst returned identical committed results: 1085.5 ms wall, 0 ms server CPU tick delta, 20 ms browser CPU, 138.9 MiB server RSS and 1939.5 MiB browser RSS sum. Zero tick delta does not mean zero work. HDD qualification passed: QD1 124.9 IOPS / 8.028 ms median; QD16 200.9 IOPS / 100.139 ms median. Load inside the lock at cold phase: `2.13 1.95 1.83 1/444 64887`. Full phase load and raw samples are committed in `docs/perf/2026-10-02-mutations-667.md` and `docs/perf/runs/2026-10-02-mutations-667.json`. There is no matching accepted/durable mutation baseline. `docs/perf/baseline.json` source `369ab6a2f9fc673e3564b94857fbecfeb04df404` has Mail accounts read p50 1.3 ms / p95 3.8 ms; that is context only, not a comparable mutation baseline. No regression ratio is claimed. Incomplete runs are committed beside the successful raw record and excluded from budgets: an earlier local harness check, an obsolete-binary local 500 at 100,000 receipts, two VM startup attempts before fixture-root creation, and one qualified HDD run that did not find the existing Chromium path. The lifetime quota is removed, the 10,001-row regression passes, and this run accepts intents at 100,020 rows. The profile now creates fixture roots, retains sanitized startup diagnostics and finds `/opt/ms-playwright` and headless-shell caches. ## Review captures Current production SPA `3c313d4ed705fe5c00b09e6508ef9d12f39220dd`, real isolated API, phone 390 px, tablet 820 px and desktop 1440 px, light and dark. No screenshots or binary artifacts are committed. - [mail-preferences-1440-dark.png](https://git.kayg.org/attachments/20ed8dcc-9fc7-4423-8668-576cabf74449) - [mail-preferences-1440-light.png](https://git.kayg.org/attachments/a3acbb74-f12f-46ed-8a53-1e13b74b173d) - [mail-preferences-390-dark.png](https://git.kayg.org/attachments/d48793d6-c321-456d-ac0e-fc0a778aae1d) - [mail-preferences-390-light.png](https://git.kayg.org/attachments/7f6315ca-d889-4dbf-ae41-3f718b5b26e6) - [mail-preferences-820-dark.png](https://git.kayg.org/attachments/a604614c-189a-41d3-950b-cf20c1ad1f92) - [mail-preferences-820-light.png](https://git.kayg.org/attachments/4be06d6a-4164-4c6c-9d3f-e049896f22fc) - [mail-reader-1440-dark.png](https://git.kayg.org/attachments/4868a903-d693-4a3f-9fa1-01911e47ddc3) - [mail-reader-1440-light.png](https://git.kayg.org/attachments/e82acae7-762b-4142-ba0f-65183d7a0020) - [mail-reader-390-dark.png](https://git.kayg.org/attachments/e22ae77b-3931-4e67-ab11-4095e9935980) - [mail-reader-390-light.png](https://git.kayg.org/attachments/0bc5471b-0809-42e7-bf1e-0100d85f1511) - [mail-reader-820-dark.png](https://git.kayg.org/attachments/2ffd8b6f-fa4b-4452-9267-101f90102331) - [mail-reader-820-light.png](https://git.kayg.org/attachments/be6667e0-abf7-4c7e-9058-66d32708ca28) ## Cleanup Cargo clean completed (verbatim): ```text Removed 24111 files, 11.0GiB total ``` Removed web build output, .svelte-kit, temporary test data, the media fixture and Python bytecode. Review screenshots remain in artifacts/. VM cleanup check: zero #667 fixture roots and zero #667 copied servers. No push or deploy. The only merge was the requested origin/dev update. The issue remains open.
kayg commented 2026-10-02 16:45:22 +00:00
Author
Owner
Copy link

#722 follow-up: I merged job/perf-mut-667 at 52d2b17f8 and added `optimisticUndo()` in apps/web/src/lib/mutations.ts. It publishes each cached inverse synchronously and reuses `isDefiniteRejection()` from #667 so definite 4xx rejections roll back while unknown outcomes stay optimistic. Photos, Files and Calendar do not expose the receipt/write/lookup endpoints needed to use `mutationController()` and durable receipts; these adapters still call their existing inverse APIs. I recorded that as a gap on #722. The same-frame and peer-tab E2E assertions are added but could not be run because the local server did not emit a setup token before the harness timeout.

#722 follow-up: I merged job/perf-mut-667 at 52d2b17f8 and added \`optimisticUndo()\` in apps/web/src/lib/mutations.ts. It publishes each cached inverse synchronously and reuses \`isDefiniteRejection()\` from #667 so definite 4xx rejections roll back while unknown outcomes stay optimistic. Photos, Files and Calendar do not expose the receipt/write/lookup endpoints needed to use \`mutationController()\` and durable receipts; these adapters still call their existing inverse APIs. I recorded that as a gap on #722. The same-frame and peer-tab E2E assertions are added but could not be run because the local server did not emit a setup token before the harness timeout.
kayg commented 2026-10-02 17:20:27 +00:00
Author
Owner
Copy link

Conflict-audit evidence for the merge round:

  • origin/job/perf-mut-667 adds crates/calternal-db/src/migrations/0007_mutation_receipts.sql and registers Migration::new(7, ...) in crates/calternal-db/src/migrations.rs (built_in_migrations()).
  • origin/job/deployfix-732 adds core migrations 0007_integrations.sql through 0012_integration_endpoint_identity.sql and registers versions 7–12 in the same function.
  • git merge-tree --write-tree origin/job/perf-mut-667 origin/job/deployfix-732 reports a conflict in crates/calternal-db/src/migrations.rs.

The shared migration rule requires unique numbers per plugin. If integrations 0007–0012 land first, renumber the mutation-receipts migration and filename to 0013 before the merge, then verify fresh and upgraded Index migration tests.

Conflict-audit evidence for the merge round: - `origin/job/perf-mut-667` adds `crates/calternal-db/src/migrations/0007_mutation_receipts.sql` and registers `Migration::new(7, ...)` in `crates/calternal-db/src/migrations.rs` (`built_in_migrations()`). - `origin/job/deployfix-732` adds core migrations `0007_integrations.sql` through `0012_integration_endpoint_identity.sql` and registers versions 7–12 in the same function. - `git merge-tree --write-tree origin/job/perf-mut-667 origin/job/deployfix-732` reports a conflict in `crates/calternal-db/src/migrations.rs`. The shared migration rule requires unique numbers per plugin. If integrations 0007–0012 land first, renumber the mutation-receipts migration and filename to 0013 before the merge, then verify fresh and upgraded Index migration tests.
kayg commented 2026-10-02 17:43:33 +00:00
Author
Owner
Copy link

P2 — Task actions wait for the server and use unguarded Undo closures

Evidence: apps/web/src/lib/notes/TaskHeader.svelte:69 waits for the tick
response before it updates currentTask at line 70. TaskSection also waits at
lines 315–316. Undo at TaskHeader line 90 sends the old status without a
revision or receipt. A later status edit from another Installation can be
overwritten by that Undo. The new helper in apps/web/src/lib/tasks/writes.ts
does not supply an operation ID or a receipt.

Fix: adopt the shared optimistic mutation and durable inverse contract owned
by #667. Publish accepted state in one frame. On Undo, check the current
revision and preserve intervening edits.

Test idea: hold the tick response and assert that the checkbox updates in the
same frame. Change the Task from another Installation before Undo, then assert
that Undo reports a conflict and preserves that change.

Rule: the interactive-path rules cited as DESIGN §58 in #667, rule 4 in #663.
Section 58 is absent from the reviewed and fetched DESIGN files. This review
uses the owner rules recorded on #663 and #667 and makes no latency claim.

## P2 — Task actions wait for the server and use unguarded Undo closures Evidence: `apps/web/src/lib/notes/TaskHeader.svelte:69` waits for the tick response before it updates `currentTask` at line 70. TaskSection also waits at lines 315–316. Undo at TaskHeader line 90 sends the old status without a revision or receipt. A later status edit from another Installation can be overwritten by that Undo. The new helper in `apps/web/src/lib/tasks/writes.ts` does not supply an operation ID or a receipt. Fix: adopt the shared optimistic mutation and durable inverse contract owned by #667. Publish accepted state in one frame. On Undo, check the current revision and preserve intervening edits. Test idea: hold the tick response and assert that the checkbox updates in the same frame. Change the Task from another Installation before Undo, then assert that Undo reports a conflict and preserves that change. Rule: the interactive-path rules cited as DESIGN §58 in #667, rule 4 in #663. Section 58 is absent from the reviewed and fetched DESIGN files. This review uses the owner rules recorded on #663 and #667 and makes no latency claim.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
dev
wip/e2e-b2-1071
wip/e2e-b-1071
wip/draw4-1101
wip/draw3-1101
wip/draw2-1101
wip/draw-1101
wip/directory-1199-r
wip/directory-1199
wip/delete-1119
wip/collabrev-1197
wip/collabloss-1197
wip/cards2-1083
wip/cards-1083
wip/canvas-visual
wip/canvasvis2-976
wip/calhdr-1112
wip/calcards-1115
wip/browserfix
wip/blocks-1125
wip/allday-1107
wip/agenda-decks
wip/agenda-1086
wip/adv7c-1105
wip/txentry-1198
wip/trayicons2-1095
wip/trayicons-1095
wip/tagperf-1186
wip/sidebar3-1094
wip/rev2-webperf
wip/rev2-money-ident
job/adv-1202
wip/restyle-notes
wip/previewcard-1098
wip/palette2-1123
wip/palette-1093
wip/onboard2-1141
wip/onboard-1141.aborted-early
wip/onboard-1141
wip/nlpchip-1127
wip/morph-1104
wip/merge-round-7c5
wip/merge-round-7c4
job/notifloop-1194
wip/merge-round-7c3
wip/merge-round-7c2
wip/merge-round-7c
wip/mchrome-1084
wip/mailghost2-1094
wip/mailghost-1094
wip/kbpreview2-1118
wip/kbpreview-1118
wip/kanban-1092
wip/importhang-1121
wip/hiderev-1153
wip/hide4-1153
wip/hide3-1153
wip/hide2-1153
wip/hide-1153
wip/editreg-1132
job/collabloss-1197
wip/editorrail3-1113
wip/editorrail2-1113
wip/editorrail-1113
job/onboard-1141
job/hide-1153
job/perf-1124
job/perf2-1124
job/tocrail-1191
job/restyle-settings
wip/restyle-settings
job/segmented-1200
wip/notifloop-1194
job/tagperf-1186
wip/segmented-1200
job/restyle-files
job/tagdnd-1187
job/merge30
job/cards-1179
wip/cards2-1179
wip/cards-1179
wip/tocrail-1191
wip/tagdnd-1187
wip/restyle-files
wip/perf-1124
wip/merge30j
job/restyle-notes
job/wizchoices-1140
wip/wizchoices-1140
wip/restyle-1190
job/moneyfmt-1180
job/txentry-1198
wip/moneyfmt2-1180
wip/moneyfmt-1180-r
wip/moneyfmt-1180
job/pillglass-1189
job/flags-1181
wip/flags-1181
job/restyle-1190
job/restyle-mailmoney
job/restyle-search
job/settingsreg-1195
job/wizard-1140
site/website
wip/wizardrev2-1140
wip/wizardrev-1140
wip/wizard5-1140
wip/wizard4-1140
wip/wizard3-1140
wip/wizard2-1140
wip/wizard-1140
wip/pillglass-1189
wip/settingsreg-1195
job/merge29
job/fu-1171
wip/merge29j
wip/fu-1171
job/fu-1166
job/directory-1199
job/proflog-1204
job/txresearch-1188
wip/fu-1166
job/merge28
job/search-1066
wip/search-1066
wip/merge28j
job/gateslot-1182
job/bulkimport-1157
job/mailnet-1160
wip/mailnetrev-1160
wip/mailnet-1160
wip/bulkrev-1157
wip/bulkimport-1157
job/startup-1161
wip/startup-1161
job/merge27
job/linkcards-1151
wip/linkcards3-1151
wip/linkcards2-1151
wip/linkcards-1151
job/traydate-1144
wip/traydate3-1144
wip/traydate2-1144
wip/traydate-1144
job/draw-1101
wip/merge27j
job/blockpill-1152
wip/blockpill3-1152
wip/blockpill2-1152
wip/blockpill-1152
job/minihover-1149
wip/minihover2-1149
wip/minihover-1149
job/merge25
wip/merge25-r
wip/merge25b
wip/merge25
job/inspector-1129
job/tags-1110
wip/inspector3-1129
wip/inspector2-1129
wip/inspector-1129
wip/tagsrev-1110
wip/tags2-1110
wip/tags-1110
job/dates-1148
wip/datesrev-1148
wip/dates2-1148
wip/dates-1148
job/licence-1145
wip/licence2-1145
wip/licence-1145
job/selfhost-1156
job/merge23
wip/merge23
job/tagfilter-1109
wip/tagfilter2-1109
wip/tagfilter-1109
job/kbd-1134
wip/kbd2-1134
wip/kbd-1134
job/palfoot-1137
wip/selfhost-1156
wip/palfoot2-1137
wip/palfoot-1137
job/toggle-1158
wip/toggle-1158
job/kbpreview-1118
job/docratchet-1155
job/perflint-1133
job/devtests-1159
wip/docratchet-1155
wip/devtests-1159
job/segv-1136
wip/toast-1142
wip/segv-1136
job/toast-1142
job/blockreload-1147
wip/blockreload-1147
job/font-1150
wip/font-1150
job/importui-1120
job/minimonth-1149
wip/importui-1120
wip/minimonth-1149
job/depcheck-1146
wip/perflint-1133
wip/depcheck-1146
job/calcards-1115
job/blocks-1125
job/plus-1128
job/shift-1138
wip/plus2-1128
wip/plus-1128
wip/shift-1138
job/moneyfid-1130
job/editorrail-1113
wip/moneyrev-1130
wip/moneyfid-1130
job/noext-851
wip/noext-851
wip/noext3-851
wip/noext2-851
job/week-1135
wip/week-1135
job/editreg-1132
job/smoke-1122
wip/smoke-1122
job/docs-1143
job/palette2-1123
job/calhdr-1112
job/nlpchip-1127
job/mailghost-1094
job/reconnect-1131
wip/reconnect-1131
job/trayicons-1095
job/delete-1119
job/importhang-1121
job/cards-1083
job/palette-1093
job/mchrome-1084
job/e2e-a-1071
job/canvas-visual
job/previewcard-1098
job/allday-1107
wip/e2e-a2-1071
wip/e2e-a-1071
job/e2e-b-1071
job/adv7c-1105
job/kanban-1092
job/agenda-1086
job/merge-round-7c
job/morph-1104
wip/surfaces-p2
job/merge-round-9
wip/merge-round-9
job/7cfix-small
wip/7cfix-small
job/mailui-1078
job/merge-round-8
wip/merge-round-8
wip/mailui-1078
job/mailround-1038
job/applemail-accept
wip/settitle-1068
wip/mailround2-1038
wip/mailround-1038
wip/e2e-7b
job/crash-1069
wip/crash-1069
job/searchlost-1066
wip/searchlost-1066
job/7b-reconcile
job/flake-1065
wip/flake-1065
wip/merge-round-7b7
wip/merge-round-7b6
wip/merge-round-7b5
wip/merge-round-7b4
wip/7b-reconcile
job/appupdate-1059
job/nfd-1044
wip/appupdate-1059
job/e2e-7b
job/loop-1062
wip/loop-1062
job/pdfprev-1045
job/invtoggle-1053
wip/pdfprev-1045
wip/nfd-1044
wip/invtoggle-1053
job/7bfix-e2e
job/mailstress-b
wip/7bfix-e2e
wip/mailstress-b
job/7bfix-adv
wip/7bfix-adv
job/mailstress-a
job/stack-1054
wip/stack-1054
wip/mailstress-a
job/mailstress-1038
wip/mailstress-1038
job/upload500-1051
wip/upload500-1051
job/share-1034
wip/share-1034
job/syncerr-1037
job/7bfix-photos
wip/7bfix-photos
job/paste-1036
job/setside-1039
wip/setside-1039
wip/paste-1036
job/lease-1042
wip/syncerr-1037
wip/lease-1042
job/7bfix-data
job/passkeybind-1043
wip/apprevoke-1041
job/invite-1035
wip/invite-1035
job/merge-round-7b2
wip/merge-round-7b2
job/mailproxy-486
job/apprevoke-1041
job/rebuild-1033
job/pillborder-1029
wip/pillborder-1029
wip/mailproxy-486
wip/applemail-486
job/headless-998
wip/headless-998
job/groups-1028
wip/groups-1028
job/rebuildwarn-1016
wip/rebuildwarn-1016
job/startup-1011
wip/startup-1011
job/monthpill-1009
job/bgthumb-1025
job/sharetitle-1012
wip/monthpill-1009
wip/bgthumb-1025
wip/sharetitle-1012
job/canvas-cards-977
wip/canvas-cards-977
job/canvas-pencil-978
job/canvas-sketch-990
wip/canvas-sketch-990
wip/canvas-pencil-978
job/canvas-files-989
wip/canvas-files-989
job/canvas-collab-991
wip/canvas-collab-991
job/weekscroll-1018
wip/weekscroll-1018
wip/canvas-core-976
job/canvas-core-976
job/round-drag
wip/round-drag
job/round-settings
job/browserfix
wip/oapi-974
job/oapi-974
job/hist2-integrate
job/mailhtml-726
wip/mailhtml-726
wip/hist2-integrate
job/moneyfu-984
job/drag-1015
wip/drag-1015
job/rename-1017
wip/rename-1017
job/hist2-api
wip/hist2-api
job/oneacct-1014
wip/oneacct-1014
wip/moneyfu-984
job/hist2-bench
job/hist2-restore
wip/hist2-bench
job/hist2-write
job/hotfix-724
wip/hotfix-724
wip/hist2-write
wip/hist2-restore
job/hist2-store
job/hist2-ui
wip/hist2-ui
wip/hist2-store
job/searchstarve-965
job/shutdown-963
wip/shutdown-963
wip/pubedit-981
job/pubedit-981
job/analytics-973
wip/searchstarve-965
job/authflash-850
job/weeklane-969
job/pvtitle-1004
job/hist-975
wip/authflash-850
job/voicepill-617
wip/pvtitle-1004
job/headring-1003
wip/weeklane-969
wip/voicepill-617
wip/headring-1003
wip/analytics-973
job/agentscope-980
wip/thumbsandbox-988
job/thumbsandbox-988
wip/hist-975
job/links-856
wip/links-856
job/davetag-966
wip/davetag-966
job/filesstorm-1000
job/hoverpad-725
wip/filesstorm-1000
job/ffmpegblas-993
job/merge-round-7a
wip/hoverpad-725
wip/ffmpegblas-993
job/nowdot-1002
wip/verify-7a
job/noteid-857
wip/nowdot-1002
wip/noteid-857
wip/merge-round-7a
wip/agentscope-980
job/imapedge
job/a11yfix2
wip/imapedge-941
wip/imapedge
wip/a11yfix2
job/notetask-986
job/logheading
wip/logheading-998
job/textthumb-652
job/photolive-987
wip/photolive-987
job/davactive-983
job/savefix-985
job/tabicons-607
wip/davactive-983
wip/tabicons-607
wip/notetask-986
wip/savefix-985
job/dirid-627
job/buildspeed-1007
wip/dirid-627
job/agenda-decks
job/perfguards-impl
job/undo-a11y
wip/undo-a11y
job/mailperf
job/wal-824
wip/settings-50
job/settings-50
job/notesfilter-606
wip/notesfilter-606
job/surfaces-p2
wip/wal-824
job/maillayouts
wip/mailperf
wip/maillayouts
job/taskmeta-659
job/money-ident
wip/money-ident
wip/taskmeta-659
job/errstates
wip/perfguards-impl
job/headings-881
wip/headings-881
wip/errstates
job/voice-619
job/gaps-827
job/notesperf
wip/notesperf
wip/voice-619
job/hddsql-549
job/perf-stream-668
wip/perf-stream-668
wip/deeplinks-fix
job/deeplinks-fix
job/authfix
job/docsfix-rust
wip/docsfix-rust
job/webperf
job/docsfix-web
job/datafix2
job/webdav-lock-476
job/copyfix
wip/copyfix
wip/webperf
job/focus-658
wip/protofix
job/mediafix
job/protofix
wip/mediafix
job/agentfix
job/hhmm-724
wip/agentfix
job/undo-722
job/reuse
wip/webdav-lock-476
wip/reuse
job/scopefix
job/datafix
wip/hhmm-724
wip/undo-722
job/surfaces-p1
wip/hddsql-549
job/voicememos-618
wip/datafix2
wip/surfaces-p1
job/fix-940
wip/fix-940
job/blaze-surfaces
wip/datafix
wip/blaze-surfaces
job/taskday-655
job/linknav-639
wip/linknav-639
wip/gaps-827
job/isolation-707
job/audiophotos-720
wip/audiophotos-720
job/advfind-664
wip/voicememos-618
wip/taskday-655
wip/isolation-707
wip/advfind-664
wip/scopefix
wip/focus-658
job/testgaps
wip/testgaps
job/overscroll-718
wip/authfix
job/deps
wip/overscroll-718
job/rev2-agentfix
job/rev2-money-ident
job/rev2-mailperf
wip/deps
job/hardening-728
wip/hardening-728
job/searchgen-832
wip/searchgen-832
job/photopw-849
job/mailsql-825
wip/photopw-849
job/sharefix
wip/sharefix
job/rev2-mailhtml-726
job/rev2-perfguards
job/copyval-723
job/lightglass-r2
wip/lightglass-r2
wip/docsfix-web
job/copy-audit
job/macinterop-staging-r2
job/design-sync
job/rev2-taskmeta-659
job/rev2-webperf
job/docs-audit
job/rev2-advfind-664
job/rev2-mailproxy-486
job/states-audit
job/rev2-datafix
job/design-drift
job/test-gaps
job/rev2-voicememos-618
job/rev2-mediafix
job/rev2-deps
job/rev2-datafix2
job/licence-audit
job/issue-hygiene
job/rev2-protofix
job/rev2-voice-619
job/rev2-isolation-707
job/rev2-surfaces-p1
job/deeplink-audit2
job/rev2-audiophotos-720
wip/test-gaps
job/rev2-overscroll-718
job/rev2-undo-722
wip/states-audit
job/rev2-dropmd-719
job/rev2-linknav-639
job/merge-7b-plan
wip/merge-7b-plan
job/rev2-taskday-655
wip/mailsql-825
job/rev2-webdav-lock-476
job/rev2-browserfix
wip/design-drift
job/rev2-hddsql-549
wip/deeplink-audit2
job/rev2-scopefix
job/rev2-authfix
job/rev2-hardening-728
job/rev2-wal-824
job/rev2-sharefix
job/calsidebar-638
job/chrome-audit
job/ioperf
wip/ioperf
wip/chrome-audit
wip/calsidebar-638
job/dropmd-719
wip/dropmd-719
job/ocr-build
wip/ocr-build
job/blaze-settings
wip/copyval-723
job/toastring-721
wip/toastring-721
job/deployfix-732
wip/deployfix-732
wip/blaze-settings
job/money-import-recheck
job/rev-a11y
job/perf-arch-db
job/rev-7b-data
wip/textthumb-652
wip/perf-arch-db
job/sec-protocols
job/sidehdr-660
job/rev-7b-security
job/research-surfaces
job/rev-design-gaps
job/rev-mcp-api
wip/sidehdr-660
job/perf-arch-memory
wip/sec-protocols
job/perf-arch-bundle
job/snapedge-714
wip/rev-mcp-api
job/sec-supplychain
wip/research-surfaces
job/perf-arch-sync
job/rev-consistency
job/perf-arch-server
wip/perf-arch-server
wip/perf-arch-memory
job/perf-arch-io
job/perf-arch-client
job/sec-fs
job/sec-mcp-scopes
job/sec-sharing
job/perf-guards
job/sec-browser
job/sec-admin-deploy
job/sec-auth
wip/snapedge-714
job/bgpicker-717
wip/perf-arch-bundle
wip/money-import-recheck
job/advsetup-654
wip/bgpicker-717
wip/advsetup-654
job/burst-709
job/kbdcaps-710
job/app-pw-chooser
wip/burst-709
wip/app-pw-chooser
job/imaptest-625
wip/kbdcaps-710
job/fix-499
wip/fix-499
job/perf-mut-667
job/calimg-589
job/perf-snap-666
wip/calimg-589
wip/perf-snap-666
wip/perf-mut-667
job/perf-cache-665
wip/perf-cache-665
job/voicefiles-620
wip/voicefiles-620
job/admin-burst-705
wip/admin-burst-705
job/voicememos-review
wip/voicememos-review
wip/ryw-653
job/ryw-653
job/writeonopen-661
job/instant-663
wip/writeonopen-661
job/money-import-review
wip/money-import-review
wip/importjs-610
review/integrations-407-round6
wip/integrations-review
job/dragghost-612
wip/dragghost-612
job/integrations
wip/integrations
job/decider-656
job/merge-round-6
job/perf-rerun
wip/merge-round-6
job/integrations-review-round5
job/selalign-576
wip/selalign-576
job/mcp-events-491
job/files-631
job/cal-e2e-569
wip/cal-e2e-569
job/reload-423
wip/reload-423
wip/mcp-events-491
wip/files-631
job/notesbridge-644
wip/notesbridge-644
job/editor-series
job/calcard-series
wip/calcard-series
job/mcp-events-review-491
wip/mcp-events-review
wip/editor-series
job/quirks-546
job/integrations-recheck
job/tocrail-636
wip/tocrail-636
wip/quirks-546
wip/reminders-643
job/reminders-643
wip/davscale-573
job/davscale-573
job/integrations-review
wip/ocr-eval-584
job/ocr-eval-584
job/esc-537
wip/esc-537
job/toastname-586
wip/toastname-586
job/submenu-579
wip/submenu-579
job/tasks-mode
wip/tasks-mode
job/agentdocs-630
job/dupwrite-634
wip/agentdocs-630
wip/dupwrite-634
job/lightglass-588
wip/lightglass-588
job/tabswitch-549
job/ghosttask-623
wip/ghosttask-623
job/toaststack-616
job/weekstate-609
job/mailsync-613
wip/mailsync-613
wip/weekstate-609
job/maildup-626
wip/tabswitch-549
wip/maildup-626
wip/toaststack-616
job/motion-611
wip/motion-611
job/tlstest-601
wip/tlstest-601
job/perf-495
job/floating-sheet
wip/floating-sheet
job/remdup-585
wip/remdup-585
job/fix-502
wip/fix-502
job/attachplay-622
job/perf-batch
wip/perf-batch-563
wip/perf-495
hotfix/mail-sync-diag
job/mail-m3
wip/mail-m3
job/attach-poof-603
job/calhover-608
job/editorbar-604
job/mentions-605
job/merge-round-4
job/allday-514
wip/merge-round-4
wip/allday-514
job/merge-round-4a
wip/merge-round-4a
job/sharestack-580
job/fix-501
wip/sharestack-580
wip/fix-501
job/perf-batch-563
job/apw-cache-review
wip/apw-cache-review
job/probe-520
wip/probe-520
job/mac-393
wip/mac-393
job/header-571
job/flake-513
wip/flake-513
job/docs-thumb-547
wip/header-571
job/webcal-572
wip/webcal-572
wip/shortcuts-542
job/shortcuts-542
wip/docs-thumb-547
job/caldav-stress
wip/caldav-stress
wip/sweep-478
job/apw-cache-512
wip/apw-cache-512
job/money-empty-540
wip/restart-505
wip/money-empty-540
wip/fix-510
job/restart-505
job/fix-503
job/perf-496
wip/perf-496
job/fix-498
wip/fix-498
job/info-inspector-465
wip/info-inspector-465
job/fix-510
job/fix-507
wip/fix-507
wip/fix-503
job/fix-493
job/money-kinds
wip/money-kinds
job/hygiene-548
job/merge-round-3
wip/fix-493
job/drag-snap-536
wip/merge-round-3
wip/merge-round-0930
wip/drag-snap-536
job/align-538
wip/align-538
job/bg-flash
wip/bg-flash
job/money-import
job/search-count-544
wip/search-count-544
wip/money-import
job/settings-key-541
wip/settings-key-541
job/toast-539
job/preview-421
wip/preview-421
wip/toast-539
job/tasks-500-531
job/title-plain-526
wip/title-plain-526
wip/tasks-500-531
job/notes-bridge
wip/parity-484
job/parity-484
job/files-slow
job/crash-525
wip/notes-bridge
wip/files-slow
wip/crash-525
job/kbd-motion-527
wip/bg-422
job/analytics-504
wip/analytics-504
wip/kbd-motion-527
job/upload-pill-523
wip/upload-pill-523
wip/tray-order
job/tray-order
wip/overflow-mid
wip/merge-round-2
job/perf-494
wip/perf-494
wip/mcp-fast-492
wip/motion-477
wip/asr-ab-489
wip/theme-variants-506
wip/overflow-511
wip/week-header-508
wip/attach-427
job/dav-delete-471
job/iso-435
wip/iso-435
wip/files-sel-keys
wip/dav-delete-471
job/align-253
job/siwc-490
wip/siwc-490
job/money-kinds-review
wip/align-253
wip/money-kinds-review
job/small-bugs-3
wip/overlay-title-487
wip/multiget-500
wip/hidden-420
wip/webcal-ui
wip/webcal-431
job/perf-367
job/location
wip/small-bugs-3
wip/location
wip/perf-367
wip/admin-deny-483
job/tag-unicode-473
wip/tag-unicode-473
job/blur-436
wip/photos-470
wip/blur-436
wip/small-bugs-4
wip/hunt-20260930
wip/settings-hdr-482
wip/chips-416
job/dedup-375
wip/dedup-375
job/doc-stack
wip/doc-stack
job/tokens-literals
wip/tokens-literals
job/jobs-leftovers
wip/send-fast
wip/paste-467
wip/money-numbers
job/money-plugin
wip/money-plugin
job/break-dav
wip/merge-batch
wip/crossday-469
wip/mac-verify
wip/mail-m2
wip/break-dav
wip/money-review2
job/money-md
job/modes-424
wip/money-md
wip/jobs-leftovers
job/agenda-413
wip/agenda-413
wip/modes-424
job/recog-417
wip/recog-417
wip/bounce-425
wip/ab-384-luna
job/webdav-perf
wip/webdav-perf
job/toast-ring
wip/toast-ring
job/money-review
wip/money-review
wip/micro-motion
wip/settings-card
wip/minical
job/notes-imap-428
job/least-priv
wip/ui-small-2
wip/flaky-426
wip/drag-end-418
job/jank
wip/jank
wip/least-priv
wip/docs-site
job/agenda
job/sec-batch
wip/sec-batch
wip/per-user-index
job/area-calendars
wip/area-calendars
job/parity
wip/parity
job/documents-research
wip/documents-research
job/test-infra
job/reminders-sync
wip/small-bugs-2
wip/reminders-sync
wip/gestures
job/google-oauth
wip/tags-merge
wip/tags
job/e2e-theme
wip/e2e-theme
job/icon-align
wip/test-infra
wip/select-align
wip/editor-385
job/voice
wip/webdav
job/webdav
job/app-pw-ui
job/editor-integrity
wip/editor-integrity
wip/voice
wip/quota
wip/cal-followups
wip/icon-align
job/composer-scale
wip/composer-scale
job/jobs-page
wip/jobs-page
job/hig-type
wip/hig-type
wip/app-pw-ui
job/motion-spring
job/mcp
wip/motion-spring
wip/mcp
job/small-bugs
wip/push-hosts
job/profile-sign
wip/touch-369
wip/profile-sign
job/mobile-focus
wip/mobile-focus
wip/ui-polish-354
wip/small-bugs
wip/dup-task
job/toast-polish
job/app-pw-scopes
wip/toast-polish
wip/app-pw-scopes
wip/cli-agent
wip/selection-pills
job/preview-attach
wip/preview-attach
job/dav-proppatch
wip/dav-proppatch
wip/cal-switcher
job/atomic-race
wip/atomic-race
job/photos-shared
wip/photos-shared
wip/cal-grid
wip/note-rewrite
wip/search-rebuild
job/mail-m1
job/paperless-import
wip/paperless-import
wip/mail-m1
wip/hidden-activity
wip/search-d
wip/pricing-research
wip/cursors
wip/auto-scheme
job/single-pills
wip/single-pills
wip/xuser-matrix
wip/money-format
wip/app-pw-setup
wip/purge-dos
wip/vault-health
wip/caldav-apple
wip/xuser-audit
wip/e2e-green
wip/tabbar
wip/adv-harness
wip/maple-mono
job/search-fix
wip/search-fix
wip/search-perf-c
job/adv-harness
wip/sidebar-headers
job/glass
wip/temp-index
job/polish
wip/polish
wip/file-protocols
wip/money-research
wip/glass
wip/voice-models
wip/collab-redo
job/voice-research
wip/hunt-20260928
wip/notes-actions-research
wip/search-pad
wip/search-perf
wip/search-sticky
wip/editor-undo
wip/chrome-rules
wip/motion
wip/appearance-research
wip/appearance
wip/audit-bugs
wip/cal-glass
wip/block-actions
wip/authz-order
wip/event-stripes
wip/chrome-sidebar
wip/auth-flaky
wip/robust-2
wip/gate-fix
wip/menu-blur
wip/import-calternaljs
wip/tray-fix
job/import-calternaljs
wip/index-order
wip/audit-fixes
wip/search-chevrons
research/mail
wip/phone-chrome
wip/dedup-break
wip/csp
wip/ui-audit
wip/select-toast
wip/perf
wip/flat-layout
wip/fonts
wip/event-tint
wip/sync-converge
wip/data-split
wip/glass-audit
wip/robustness
wip/sync-chaos
wip/search-thumbs
wip/fuzz
wip/menu-icons
wip/search-pill
wip/sync-changing
wip/heading-links
wip/date-formats
wip/a11y
wip/break-editor
wip/e2e-fix
wip/settings-sections
wip/sync-root-guard
wip/search-palette
wip/share-edit
job/toasts
wip/toasts
wip/cont-analytics
wip/authz-review
wip/popovers
wip/overlay-glass
wip/change-feed
wip/editor-modes
wip/composer-align
wip/cont-agenda
wip/agenda-merge
job/agent-conventions
wip/agent-conventions
wip/backend-misc
job/route-audit
wip/route-audit
wip/ui-batch
wip/heif-hardening
wip/grid-resize
wip/ask-page
wip/webmcp
job/deeplink-audit
wip/deeplinks
wip/shortcuts
wip/cont-tz-days
main
No results found.
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal#667
No description provided.