Train BM2: storage temp folder, flaky fixes, mockup values, Composer #770
Closed
kayg
wants to merge 19 commits from
train/2026-10-30-bm2 into dev
pull from: train/2026-10-30-bm2
merge into: kayg:dev
kayg:main
kayg:feat/style-sheet-fixes
kayg:storage/wal-checkpoint-off-save-1051
kayg:feat/contrast
kayg:t3/paged-search-reconcile-final
kayg:feat/pass8
kayg:review/calendar-2
kayg:fix/shared-row-swipes
kayg:dev
kayg:feat/collections-db
kayg:fix/instant-keys-1056
kayg:feat/money-round
kayg:perf/stalls-1054
kayg:wip/tiering-v3-cold4
kayg:wip/tiering-v3-cold5
kayg:port/rows-actions
kayg:port/rows-drop
kayg:port/hidden-blocks
kayg:port/rows
kayg:port/port-tables
kayg:port/port-tables-2
kayg:t3/mail-1011-liveness
kayg:port/devices
kayg:port/port-attachments
kayg:port/port-attachments-2
kayg:port/port-attachments-3
kayg:docs/design-consistency
kayg:docs/engineering-standards
kayg:fix/rusqlite-0.41-rustsec-2026-0459
kayg:feat/iphone-fixes
kayg:shared/restore-and-stale-918-919
kayg:fix/phone-top-band-contrast
kayg:feat/notes-approve
kayg:perf/soak-max-gate
kayg:feat/files-s1-identity
kayg:fix/lifecycle-event-id
kayg:feat/quickfix
kayg:wip/tiering-v3-cold
kayg:perf/web-mockup-frame-fixes
kayg:port/contacts-merge
kayg:port/contacts-edit
kayg:test/shared-room-no-deleted-text
kayg:perf/first-paint-credits
kayg:fix/shared-history-after-grant
kayg:fix/phone-swipe-regressions
kayg:feat/contrast-r1
kayg:review/sharing-pr3-review
kayg:feat/tiering-v3-s2-tags
kayg:feat/folder-drop
kayg:fix/deskpills-lazy-share
kayg:feat/sharing-s1-pr3
kayg:tmp/money-round-before
kayg:fix/phone-pane-backdrop-roots
kayg:fix/palette-preload-chips
kayg:fix/invite-defaults
kayg:port/tasks-matrix
kayg:fix/restore-green-gates
kayg:fix/sharing-fast-path-hardening
kayg:t3/photos-s1
kayg:feat/tiering-v3-s1-namespace
kayg:notes-archive-hide
kayg:feat/tasks-actions
kayg:t3/photos-plan-slice-one
kayg:feat/whiteboard-s1
kayg:t3/paged-search-reconcile
kayg:t3/smooth-pane-transitions
kayg:t3/index-position-startup-scan
kayg:fix/private-staging-759b-r2
kayg:feat/dav-transport
kayg:feat/imap-notes-fetch
kayg:feat/imap-notes-projection
kayg:feat/imap-notes-readonly
kayg:feat/imap-notes-auth
kayg:feat/imap-notes-server-foundation
kayg:docs/undo-block-ids-plan
kayg:fix/undo-768
kayg:proto/block-identity-v7d
kayg:issue/carddav-read-perf-fix-r2
kayg:issue/carddav-read-r2
kayg:docs/imap-766-plan-v2
kayg:docs/imap-notes-plan
kayg:docs/quota-plan-2
kayg:fix/parallel-test-flakes
kayg:feat/contacts-companion-pure
kayg:docs/calendar-backend-v2-plan
kayg:feat/calendar-ical-converter
kayg:docs/tasks-writes-v2-plan
kayg:docs/carddav-writes-v2-plan
kayg:docs/contacts-import-v2-plan
kayg:issue/610-pm-midnight
kayg:feat/calendar-v2-s1-containment
kayg:docs/dav-recorder-v2-plan
kayg:plan/previews-865
kayg:plan/save-log-durable-entry
kayg:fix/e2e-data-on-ram
kayg:feat/appwindow3
kayg:feat/appwindow2
kayg:feat/appwindow
kayg:feat/money-p1
kayg:feat/keys-sheet
kayg:review/calendar-2-themes
kayg:feat/smooth-cursor
kayg:fix/float-style
kayg:review/calendar-2-float
kayg:release/2026-11-06-hotfix
kayg:archive/port/rows-drop-code
kayg:archive/port/rows-actions
kayg:archive/port/rows
kayg:scratch/tasks-894-ui-gates
kayg:review/calendar-2-night-wip
kayg:release/2026-11-05
kayg:archive/feat/tiering-v3-s1-namespace
kayg:archive/flaky/rows-drop-fixed
kayg:archive/flaky/rows-actions
kayg:archive/feat/tiering-v3-reader
kayg:archive/feat/tiering-v3-roots
kayg:archive/flaky/rows
kayg:sim/bm15-final
kayg:sim/bm15-fix
kayg:sim/bm15-bis-932
kayg:sim/bm15-bis-909
kayg:sim/bm15
kayg:sim/bm15-bis-887
kayg:perf/tiering-option-b
kayg:port/style-3
kayg:port/style-2
kayg:port/style
kayg:fix/sw-lazy-precache
kayg:fix/vim-w-waits-for-save
kayg:fix/signout-test-races
kayg:fp-scratch/all
kayg:sim/bm15-first-paint
kayg:archive/bm15/rows-drop
kayg:archive/bm15/rows-actions
kayg:fix/palette-snippet-contrast
kayg:archive/bm15/rows
kayg:archive/bm15/hidden
kayg:archive/plan/save-log-durable-entry
kayg:mock/money-fix2
kayg:archive/fix/e2e-data-on-ram
kayg:mock/appearance-all
kayg:mock/pill-press
kayg:archive/docs/design-consistency
kayg:mock/auto-swipes
kayg:mock/mail-actions
kayg:archive/feat/mail-p1
kayg:mock/money-static
kayg:archive/review/standards-917
kayg:archive/docs/engineering-standards
kayg:perf/tiering-761-fix
kayg:mock/type-audit
kayg:mock/third-pane
kayg:feat/contacts-import-v2-s1
kayg:perf/executor-hot-path
kayg:archive/port/hidden-blocks
kayg:archive/port/devices
kayg:scratch/executor-on-894
kayg:scratch/executor-spans2
kayg:scratch/executor-spans
kayg:train/2026-11-03-bm14c
kayg:archive/port/rows-drop
kayg:feat/tiering-761-d-scale
kayg:feat/tiering-761-c-index
kayg:feat/tiering-761-b-reader
kayg:archive/review/sharing-pr3-review-9fec3d1f
kayg:train/2026-11-03-bm14b
kayg:perf/ports-lazy-budgets
kayg:feat/tiering-761-a-migration
kayg:train/2026-11-03-bm14
kayg:train/2026-11-03-bm12
kayg:archive/review/sharing-pr3-review
kayg:archive/feat/sharing-s1-pr3
kayg:train/2026-11-03-bm11
kayg:archive/feat/imap-notes-fetch
kayg:train/2026-11-03-bm10
kayg:archive/review/sharing-pr3-review-code
kayg:archive/plan/previews-865
kayg:train/2026-11-02-bm9
kayg:archive/port/port-attachments-3
kayg:archive/port/contacts-merge
kayg:fix/motion-audit-859
kayg:train/2026-11-02-bm8
kayg:archive/scratch/bm8-prep
kayg:archive/port/port-pickers
kayg:archive/port/port-tables-2
kayg:archive/port/port-tables
kayg:archive/feat/sharing-s1-pr3-code
kayg:archive/scratch/bm7-fixed
kayg:train/2026-11-02-bm7
kayg:archive/fix/parallel-test-flakes-code-minipc01
kayg:train/2026-11-02-bm6
kayg:docs/imap-766-readonly-slice
kayg:feat/dav-recorder-v3
kayg:research/788-diagnosis
kayg:archive/fix/parallel-test-flakes
kayg:archive/perf/pr792-cold-index-edit
kayg:docs/sharing-slice-1
kayg:archive/docs/imap-766-plan-v2
kayg:feat/dav-recorder-v2
kayg:archive/docs/dav-recorder-v2-plan
kayg:spike/imap-766-s0-cases
kayg:archive/fix/undo-768
kayg:feat/dav-recorder
kayg:archive/docs/contacts-import-v2-plan
kayg:archive/feat/calendar-ical-converter
kayg:feat/contacts-import
kayg:perf/cold-growth-on-764
kayg:perf/cold-growth-on-tiering
kayg:archive/docs/tasks-writes-v2-plan
kayg:archive/docs/calendar-backend-v2-plan
kayg:archive/feat/contacts-companion-pure
kayg:feat/tasks-set-status
kayg:feat/tasks-move-reorder
kayg:archive/docs/carddav-writes-v2-plan
kayg:archive/feat/calendar-v2-s1-containment
kayg:feat/tasks-delete-promote-duplicate
kayg:archive/feat/dav-transport
kayg:archive/fix/carddav-rebuild-r1
kayg:archive/fix/carddav-retention-r1
kayg:feat/carddav-writes
kayg:perf/quota-on-tiering
kayg:perf/quota-simple
kayg:perf/cold-growth-on-quota-stack
kayg:feat/calendar-identity
kayg:feat/calendar-event-parser
kayg:feat/calendar-props-maps
kayg:port/glass-when-ring
kayg:feat/tiering-761-s1
kayg:wip/10by32-01-impl-759b-scratch-20261030
kayg:wip/6by32-01-bm3-webkit-pause-20261030
kayg:wip/10by32-01-bm3-chromium-pause-20261030
kayg:wip/6by32-01-tier-761-s1-pause-20261030
kayg:spike/imap-766-s0
kayg:wip/6by32-02-calternal-pause-20261030
kayg:wip/8by64-01-review-688-pause-20261030
kayg:wip/6by32-01-verify-744-pause-20261030
kayg:wip/6by32-01-verify-742-pause-20261030
kayg:fix/private-staging-759b
kayg:wip/6by32-01-review-748-pause-20261030
kayg:wip/6by32-01-review-733c-pause-20261030
kayg:wip/6by32-01-review-733b-pause-20261030
kayg:wip/6by32-01-perf-idle-8-pause-20261030
kayg:wip/6by32-01-perf767-base-pause-20261030
kayg:wip/6by32-01-perf767b-767-pause-20261030
kayg:wip/6by32-01-perf767b-764-pause-20261030
kayg:wip/6by32-01-perf767-767-pause-20261030
kayg:wip/6by32-01-perf767-764-pause-20261030
kayg:wip/6by32-01-lists-b-pause-20261030
kayg:wip/6by32-01-ids-verify5-pause-20261030
kayg:wip/6by32-01-ids-verify4-pause-20261030
kayg:review/calendar-month
kayg:wip/10by32-02-undo-768-20261030
kayg:test/ids-verify3
kayg:wip/10by32-02-bm3-chromium-20261030
kayg:wip/10by32-01-review-753-20261030
kayg:wip/10by32-01-perf-idle-2-20261030
kayg:wip/10by32-01-bm2-webkit2-20261030
kayg:plan/759b-staging
kayg:review/758b-tests
kayg:review/758-tests
kayg:review/764d-tests
kayg:review/767b-tests
kayg:review/preview-2026-10-29
kayg:review/767-tests
kayg:docs/tiering-731-plan
kayg:wip/c6b02-when2
kayg:wip/c6b02-tasks-create-fix5
kayg:wip/c6b02-settings-frost-mock
kayg:wip/c6b02-settings-frost-base
kayg:wip/c6b02-settings-frost
kayg:wip/c6b02-ring
kayg:wip/c6b02-review-733d
kayg:wip/c6b02-bm1-full-a
kayg:wip/compute02-when-field
kayg:wip/compute02-webkit-lists-repro
kayg:wip/compute02-train-bl2-dev
kayg:wip/compute02-dev-green-pw164
kayg:docs/deploy-plan
kayg:review/764c-tests
kayg:review/764b-tests
kayg:review/748g-tests
kayg:review/764-tests
kayg:review/759b-tests
kayg:fix/storage-owner-liveness-642
kayg:fix/storage-fix-7
kayg:wip/compute02-storage-fix-7
kayg:review/759-tests
kayg:feat/tiering-731
kayg:wip/tiering-731-first-attempt
kayg:wip/compute02-storage-fix-1
kayg:review/754g-tests
kayg:perf/idle-honest-2
kayg:review/754f-tests
kayg:review/754e-tests
kayg:review/755-tests
kayg:review/754d-tests
kayg:review/754c-tests
kayg:review/754b-tests
kayg:review/754-tests
kayg:fix/storage-private-tmp-642-dev
kayg:wip/compute02-verify-750
kayg:test/ids-verify5
kayg:test/ids-verify4
kayg:fix/storage-exact-file-quarantine-642
kayg:wip/compute02-verify-740
kayg:perf/one-flush-save
kayg:review/calendar-static
kayg:wip/compute02-verify-737
kayg:review/indexing-ring
kayg:review/when-field-2
kayg:wip/compute02-review-733
kayg:proto/block-identity-2-review
kayg:proto/block-identity-review
kayg:wip/c6b02-tc-design
kayg:review/when-field
kayg:issue/tasks-create-ids
kayg:issue/tasks-create
kayg:review/combined
kayg:wip/compute02-review-combined
kayg:review/task-polish
kayg:review/top-buttons
kayg:review/q1-q5
kayg:train/2026-10-26-bl2
kayg:archive/wt-398h
kayg:archive/train-bm-proptest-seed
kayg:archive/integ325-293
kayg:archive/integ325-ci
kayg:archive/client-auth-review-baseline
kayg:archive/wt-sim-4853
kayg:archive/wt-sim-4811
kayg:archive/wt-448m
kayg:archive/wt-398a-allocator
kayg:issue/calendar-adr
kayg:archive/old/train/2026-10-23bk2
kayg:archive/old/train/2026-10-23bk
kayg:issue/469-mockup-9a
kayg:issue/smart-tasks-mockup
kayg:issue/469-menus
kayg:issue/652-signout-flake
kayg:issue/652-history-fix7
kayg:issue/652-history-fix6
kayg:archive/old/issue/spring-check-perf
kayg:issue/spring-check-perf
kayg:issue/659-rename-fast
kayg:archive/old/train/2026-10-21ar
kayg:issue/search-hardening-3
kayg:issue/652-history-fix5
kayg:issue/660-port-sheets-glass
kayg:issue/652-history-fix4
kayg:issue/652-history-fix3
kayg:issue/652-history-fix2
kayg:issue/652-history-flake
kayg:train/2026-10-21an
kayg:issue/settings-admin-port
kayg:issue/search-port
kayg:train/2026-10-20am
kayg:issue/storage-split-fix2
kayg:issue/storage-split
kayg:archive/old/issue/folder-ids-fix
kayg:train/2026-10-20al
kayg:archive/old/issue/folder-ids
kayg:train/2026-10-20ak
kayg:issue/tables-mockup
kayg:train/2026-10-19aj
kayg:train/2026-10-19ai
kayg:issue/469-merge-fixes
kayg:issue/sidebar-band
kayg:archive/old/issue/608-settings-spec
kayg:train/2026-10-19ah
kayg:issue/swipe-offscreen
kayg:train/2026-10-19ag
kayg:archive/old/issue/590-nlp-adr
kayg:archive/old/issue/587-event-after-write-2
kayg:train/2026-10-19af
kayg:archive/old/issue/587-event-after-write
kayg:issue/469-pill-room-c
kayg:issue/469-pill-room
kayg:train/2026-10-19ae
kayg:issue/469-narrow-handle
kayg:issue/397-ios-swipe-2
kayg:archive/old/issue/adrs-photos-files-tasks
kayg:issue/469-desk-fixes
kayg:archive/old/issue/auto-update-adr
kayg:issue/469-filter-gap
kayg:issue/469-port-1b
kayg:issue/442-opacity-flake
kayg:archive/397-ios-swipe-2
kayg:issue/327-web-fast-3
kayg:archive/old/issue/469-port-1
kayg:issue/469-port-1
kayg:issue/327-web-fast-2
kayg:archive/old/issue/327-web-fast
kayg:archive/old/issue/425-stt-bench-vq1
kayg:archive/old/issue/445-no-bleed
kayg:archive/old/issue/400-swipe-mockup-2
kayg:issue/426-client-review
kayg:issue/426-client-2
kayg:issue/426-client
kayg:archive/old/issue/476-safe-area-lab
kayg:archive/445-top-light-2
kayg:archive/old/issue/445-top-light
kayg:issue/471-blocks-mockup
kayg:archive/old/issue/448-links-app-2
kayg:archive/old/issue/448-links-app
kayg:archive/old/issue/398-cold-links
kayg:issue/434-442-small-2
kayg:issue/434-442-small
kayg:archive/old/issue/398-unload
kayg:archive/old/issue/445-bottom-band
kayg:issue/445-bottom-band
kayg:issue/351-rem-3
kayg:archive/312-views-mockup
kayg:issue/351-rem-2
kayg:issue/351-rem
kayg:archive/old/issue/327-first-note
kayg:issue/395-width-phone
kayg:archive/old/issue/327-typing
kayg:issue/396-ios-edges
kayg:issue/397-ios-swipe
kayg:archive/398-allocator
kayg:archive/old/issue/327-notes-index
kayg:issue/345-347-contrast-empty-2
kayg:archive/old/issue/44-arenas
kayg:issue/44-arenas
kayg:archive/integ325
kayg:archive/old/issue/327-perf-harness
kayg:archive/old/issue/44-thp
kayg:issue/44-thp
kayg:archive/old/issue/285-sticky-pills
kayg:archive/old/issue/44-trim-3
kayg:issue/44-trim-3
kayg:archive/old/issue/165-cards
kayg:archive/old/issue/165-picker-2
kayg:archive/old/issue/212-multi-select
No reviewers
Labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".
No due date set.
Dependencies
No dependencies set
Reference
kayg/calternal!770
Loading…
Reference in a new issue
No description provided.
Delete branch "train/2026-10-30-bm2"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Assembles BM2 from dev
d83e54db, merging in order: #759c129eb38, #763628a7dd8, mockup values04a69711, Composer10659f25. Excludes #764/#767 and BM1 #756. No merge or deployment is authorized.Tested head:
ca5b59c40262e7b816dd64ad2209f3d426be8685, pushed before the browser run. Host: 10by32-01-std (arm64), build-pool lease c4d1f0dc28954665b24fb9c646bf9d40, heavy commands through/usr/local/bin/build-slot.shwithCALTERNAL_TRAIN=1. Half B runs separately on 10by32-02-std. Train verdict: FAIL; do not merge.Merge conflicts (all during Composer merge):
apps/web/src/components/Palette.svelte: Composer structure and phone layout, retaining mockup radius token.crates/fsio/src/lib.rs: retain #759 private cleanup/recovery APIs; omit unused Composer conditional-delete helper (Composer uses durable Trash retention instead).crates/fsio/src/tests.rs: retain storage regression helpers; omit tests of that unused helper.crates/notes/src/bulk/mod.rs: keep both placement recovery and undo guard modules.crates/notes/src/deletion.rs: keep Composer Trash-based recovery and reusable daily identity, remove obsolete unlink helper; simulated explicit test deletions use remove_user_file.crates/notes/src/lib.rs: register both regression modules.crates/notes/src/trash.rs: retain storage documentation and merged Composer behavior.Integration fixes: module formatting; retained-undo publication in
crates/fsio/src/swap.rsuses #759 private-storage exclusive publication instead of a direct unlink after hard linking. all_js budget is the approved 315 KB; remaining budgets unchanged.Gates on the merged head
cargo fmt --all --checkcargo clippy --workspace --all-targets --locked -- -D warningscargo test --workspace --locked --no-fail-fastEditor and web typechecksWeb lintEditor unit testsPrimitives unit testsWeb unit testsperf/web.sh --bundle-only --gateBundle gate output
Rust failure evidence and classification
The preliminary Rust command stopped at contacts-actions: case-only rename left
Ravi Kumar.md.conflict-1, and the import-undo sweep retained a card. The final full run used--no-fail-fast, attempted all workspace targets, and failed the following three cases. This is a failed gate even where isolated reruns pass.schema_two_copy_keeps_real_credentials_sessions_and_recoverymigration.rs:86)a_sweep_waits_for_a_copy_selected_before_import_undotests/sweep.rs:103)no_producer_creates_temporary_files_outside_the_private_directoryprivate_tmp_tests.rs:49)case_only_renames(preliminary run only)Browser half A: first-run verdict
App projects use one worker, zero retries. The temporary wrapper selects every project whose name contains
chromium, plusthrottled-*,flow,passkeys,admin-setup,contrast, and bothsidebar-band-*projects. Dependency edges to unselected half-B projects are removed; test cases and assertions are unchanged. The primitives matrix runs both Chromium and WebKit with the repository CI settings. Linux CI intentionally excludes WebKit toast tests as documented in its config.Two app-runner setup attempts stopped before any test ran (external config module mode, then web-server cwd). They are retained as setup-error logs and are not counted as test runs. The first actual app run is the verdict.
Primitives Chromium first run: 47 passed, 1 failed; WebKit: 36 passed.
toast.spec.ts:16, “9 → 10 → 11”: capsule width stayed 214 px rather than increasing. Three isolated reruns all failed; reproducible. First-run verdict remains FAIL.The first app run had 1,218 passed, 36 failed, 755 skipped, and 4 dependency-blocked cases. All 36 failures are runner setup failures:
CALTERNAL_BINwas unset in the sign-out fixture (signout-fixture.ts:217), sospawn(undefined, ...)failed before assertions. The config default starts the shared binary but does not populate that environment variable. Classification reruns supply the explicit merged binary path. The four blocked throttled cases passed their first actual execution with dependency scheduling bypassed (--no-deps). The first-run FAIL verdict is unchanged.App first-run totals:
{"startTime": "2026-10-30T04:24:51.679Z", "duration": 2588508.645, "expected": 1218, "skipped": 759, "unexpected": 36, "flaky": 0}.review4-signout.spec.ts:73— review4-signout.spec.ts › sign-out freezes every editor before asynchronous logout › a remotely ended session refuses typing while its next document is delayedchromium-1440
review4-signout.spec.ts:131— review4-signout.spec.ts › sign-out freezes every editor before asynchronous logout › typing during logout is refused (stuck uplink=true, BroadcastChannel=true)chromium-1440
review4-signout.spec.ts:131— review4-signout.spec.ts › sign-out freezes every editor before asynchronous logout › typing during logout is refused (stuck uplink=true, BroadcastChannel=false)chromium-1440
review4-signout.spec.ts:131— review4-signout.spec.ts › sign-out freezes every editor before asynchronous logout › typing during logout is refused (stuck uplink=false, BroadcastChannel=true)chromium-1440
review4-signout.spec.ts:131— review4-signout.spec.ts › sign-out freezes every editor before asynchronous logout › typing during logout is refused (stuck uplink=false, BroadcastChannel=false)chromium-1440
review4-signout.spec.ts:242— review4-signout.spec.ts › sign-out freezes every editor before asynchronous logout › server too_large refusal stays until a receipt covers the current state, in sibling tabs and after reload (BroadcastChannel=true)chromium-1440
review4-signout.spec.ts:242— review4-signout.spec.ts › sign-out freezes every editor before asynchronous logout › server too_large refusal stays until a receipt covers the current state, in sibling tabs and after reload (BroadcastChannel=false)chromium-1440
review4-signout.spec.ts:242— review4-signout.spec.ts › sign-out freezes every editor before asynchronous logout › server room_error refusal stays until a receipt covers the current state, in sibling tabs and after reload (BroadcastChannel=true)chromium-1440
review4-signout.spec.ts:242— review4-signout.spec.ts › sign-out freezes every editor before asynchronous logout › server room_error refusal stays until a receipt covers the current state, in sibling tabs and after reload (BroadcastChannel=false)chromium-1440
review4-signout.spec.ts:387— review4-signout.spec.ts › sign-out freezes every editor before asynchronous logout › signing in again in the signed-out document restores editingchromium-1440
review4-signout.spec.ts:411— review4-signout.spec.ts › sign-out freezes every editor before asynchronous logout › cancelling the warning restores sibling editingchromium-390
review4-signout.spec.ts:73— review4-signout.spec.ts › sign-out freezes every editor before asynchronous logout › a remotely ended session refuses typing while its next document is delayedchromium-390
review4-signout.spec.ts:131— review4-signout.spec.ts › sign-out freezes every editor before asynchronous logout › typing during logout is refused (stuck uplink=true, BroadcastChannel=true)chromium-390
review4-signout.spec.ts:131— review4-signout.spec.ts › sign-out freezes every editor before asynchronous logout › typing during logout is refused (stuck uplink=true, BroadcastChannel=false)chromium-390
review4-signout.spec.ts:131— review4-signout.spec.ts › sign-out freezes every editor before asynchronous logout › typing during logout is refused (stuck uplink=false, BroadcastChannel=true)chromium-390
review4-signout.spec.ts:131— review4-signout.spec.ts › sign-out freezes every editor before asynchronous logout › typing during logout is refused (stuck uplink=false, BroadcastChannel=false)chromium-390
review4-signout.spec.ts:242— review4-signout.spec.ts › sign-out freezes every editor before asynchronous logout › server too_large refusal stays until a receipt covers the current state, in sibling tabs and after reload (BroadcastChannel=true)chromium-390
review4-signout.spec.ts:242— review4-signout.spec.ts › sign-out freezes every editor before asynchronous logout › server too_large refusal stays until a receipt covers the current state, in sibling tabs and after reload (BroadcastChannel=false)chromium-390
review4-signout.spec.ts:242— review4-signout.spec.ts › sign-out freezes every editor before asynchronous logout › server room_error refusal stays until a receipt covers the current state, in sibling tabs and after reload (BroadcastChannel=true)chromium-390
review4-signout.spec.ts:242— review4-signout.spec.ts › sign-out freezes every editor before asynchronous logout › server room_error refusal stays until a receipt covers the current state, in sibling tabs and after reload (BroadcastChannel=false)chromium-390
review4-signout.spec.ts:387— review4-signout.spec.ts › sign-out freezes every editor before asynchronous logout › signing in again in the signed-out document restores editingchromium-390
review4-signout.spec.ts:411— review4-signout.spec.ts › sign-out freezes every editor before asynchronous logout › cancelling the warning restores sibling editingchromium-1440
review6-signout.spec.ts:7— review6-signout.spec.ts › cancelling one of two sign-outs keeps the other editor frozen (BroadcastChannel=true)chromium-1440
review6-signout.spec.ts:7— review6-signout.spec.ts › cancelling one of two sign-outs keeps the other editor frozen (BroadcastChannel=false)chromium-390
review6-signout.spec.ts:7— review6-signout.spec.ts › cancelling one of two sign-outs keeps the other editor frozen (BroadcastChannel=true)chromium-390
review6-signout.spec.ts:7— review6-signout.spec.ts › cancelling one of two sign-outs keeps the other editor frozen (BroadcastChannel=false)chromium-1440
signout.spec.ts:21— signout.spec.ts › sign out wipes this device › online: disk, other tabs, history and the old server session are clearedchromium-1440
signout.spec.ts:63— signout.spec.ts › sign out wipes this device › offline: one confirmation, cancellation keeps edits, signing out anyway wipes themchromium-1440
signout.spec.ts:91— signout.spec.ts › sign out wipes this device › remote sign-out retains copies for the same account, then a different account wipes themchromium-1440
signout.spec.ts:143— signout.spec.ts › sign out wipes this device › an old-name session opens sign-in and preserves unsent local editschromium-1440
signout.spec.ts:172— signout.spec.ts › sign out wipes this device › opening an already revoked session retains only owned note copieschromium-390
signout.spec.ts:21— signout.spec.ts › sign out wipes this device › online: disk, other tabs, history and the old server session are clearedchromium-390
signout.spec.ts:63— signout.spec.ts › sign out wipes this device › offline: one confirmation, cancellation keeps edits, signing out anyway wipes themchromium-390
signout.spec.ts:91— signout.spec.ts › sign out wipes this device › remote sign-out retains copies for the same account, then a different account wipes themchromium-390
signout.spec.ts:143— signout.spec.ts › sign out wipes this device › an old-name session opens sign-in and preserves unsent local editschromium-390
signout.spec.ts:172— signout.spec.ts › sign out wipes this device › opening an already revoked session retains only owned note copiesCorrected-environment run 1: 40 passed (36 original failures plus the 4 blocked throttled cases). All four throttled cases passed their first actual execution: 2/2 at each width. Original verdict is unchanged.
Completed classification
All 36 original app failures received exactly three isolated attempts with
CALTERNAL_BINset. Outcomes: {'passed': 108}. These were runner configuration failures, not product assertions. The first-run FAIL verdict remains unchanged. The explicit list selected only the original 36 failures for repetitions 2 and 3.Logs, JSON reports and retained traces:
/tmp/train-bm2-resultson 10by32-01-std. No merge or deployment performed. Cleanup complete: this worktree’starget/and generated Python cache were deleted, the lease heartbeat was stopped, and the worktree is clean. The primitives frontend tree is identical to the final tested head; the final integration correction changed only Rust publication code. No Forgejo check statuses or reviews were present at handback.WebKit half of Train BM2 on
10by32-02-std(arm64), detached worktree/home/agent/wt/train-bm2-b.Tested SHA:
f3a4845033ae29fcbc9e4338ac393d93db46a15e.Origin moved during the run: first observed
ca5b59c40262e7b816dd64ad2209f3d426be8685; at completion9041b509486dff0da2b56a1285074dbe869ec1c2. All tests remained on the tested SHA.The first app run is inconclusive, not a clean full-suite pass. Frozen installation and
cargo build -p calternal --lockedsucceeded. Both CI browser scripts ran through/usr/local/bin/build-slot.sh, withCI=true,--project='*webkit*',--workers=1,--retries=0and dependencies enabled. The app built once in the Playwright harness. Appearance/look cases remain included in the app projects.I omitted CI's
CALTERNAL_BINenvironment variable from the first app invocation. The regular config found the built binary through its fallback, but the sign-out fixture reads that variable directly. This produced 18 fixture failures per app width (36 total), allTypeError: The "file" argument must be of type string. Received undefinedatsignout-fixture.ts:217. These are invocation failures, not established product regressions.First-run results:
*All 2,008 app test starts were logged, including every requested WebKit project and its dependencies. The app command then exited 143 (SIGTERM), before the final summary and JSON report were emitted. Exact passed/skipped totals and the final test's terminal outcome cannot be recovered from the line reporter.
0 unstartedmeans no collected test lacked a start record; it does not assert completion. No full-suite rerun was performed.Verbatim primitive summary:
The first app run emitted no final summary. Its verbatim final lines were:
Failure classification only: the exact 36 failing cases were rerun three times (
--test-list,--repeat-each=3,--retries=0, one worker), on the same SHA and existing app build, withCALTERNAL_BIN=/home/agent/wt/train-bm2-b/target/debug/calternalsupplied. Because the environment was corrected, these do not replace the first-run results or establish flaky original failures.Classification under the corrected CI environment: 34 cases consistently passed 3/3; two cases consistently skipped 3/3 (
signing in again in the signed-out document restores editing, one per width). No flaky behavior observed. The original 36 failures are attributed to the missing invocation variable.Verbatim failure-only rerun summary:
Created
target/and all fivenode_modulesdirectories have been deleted. No pushes, merges, or deployments. Evidence retained on this machine in/tmp/train-bm2-b/(first-run logs, primitive JSON, rerun JSON and incremental case results).BM2 implementation and Chromium-half rerun. Final head:
3cf6ac568fb8339a646f26a7149f52a86387c46b. Host:10by32-01-std(arm64), leasefb6aeb48cbf249d3899130082f944149; heavy commands use/usr/local/bin/build-slot.shwithCALTERNAL_TRAIN=1. No merge or deployment.Chromium half PASS: 1,258 app tests passed, 755 skipped, no failures or retries; primitives 84 passed. Rust gate FAIL: the upload crash-test contract remains unresolved. Do not merge.
Culprits and fixes
BM2 failure attribution, dev
d83e54db, original trainca5b59c4.contacts-actions::tests::break_links::case_only_renames: #759's private staging/lease cleanup. Exact conflict reproduced at Composer merged5000d47; standalone case passes do not disprove a transient descriptor race. #759 adds exclusive cleanup leases and directory ownership. A fork can inherit an open description until exec, defeating cleanup after the parent closes its writer and keeping ownership locks alive. Two deterministic inherited-descriptor tests fail on #759 before fixes, pass afterward. Explicit guard unlock + bounded EAGAIN lease acquisition, with all ownership/hash checks retained.contacts-actions::tests::sweep::a_sweep_waits_for_a_copy_selected_before_import_undo: first fails at Composer merged5000d47. #759 adds this regression; Composer alone lacks it. Porting the original test unchanged onto dev+Composer reproduces failure. Composer intentionally moves completed-import undo to Trash; therefore its card must remain. Correct scenario explicitly permanently forgets that retained note before testing sweep-vs-paused-copy ordering. Original 1s negative assertion, 30s bound, and final empty-store assertion remain; added Trash-presence and removal assertions. Existing retention tests remain unchanged.fsio::private_tmp_tests::no_producer_creates_temporary_files_outside_the_private_directory: #759, same transient inherited descriptor issue in exclusive upload verification. Original isolated checks pass, full #759 stress independently fails with private leftovers. New deterministic regressions fail before fix and pass after. Persistent outside-reader/writer safety tests remain unchanged and pass.schema_two_copy_keeps_real_credentials_sessions_and_recovery: pre-existing on dev. v2->v3 migration ordered tied millisecond creation times by UUID, potentially making the later member admin; owner then sees only itself in people.list. Deterministic tied-time/reversed-ID regression fails on dev (a-membervsz-owner). Preserve insertion order via rowid when times tie.9 → 10 → 11: pre-existing on dev, not Composer or mockup-values. Toast source is byte-identical on all inputs. Original test repeated on dev: 9 passed, 1 failed. Glass resize began in ResizeObserver after a frame could appear settled. Start fit/spring in the content update. Unchanged original test passes 10/10 after fix, full first-run matrix 48/48 Chromium + 36/36 WebKit.Each branch was merged alone on dev: #759
c129eb38, #763628a7dd8, mockup04a69711, Composer10659f25. Each successive first-parent mergeb71b0d88,6207cb3e,0846eba8,d5000d47, and finalca5b59c4was tested. Logs distinguish tests absent on earlier branches; zero selected tests are not counted as passes. This exhaustive merge-stage check brackets the sweep failure immediately to the Composer merge.The first full Rust run on
84cb1a4eexposed two additional fixture failures:beneath::tests::upload_marker_still_finds_an_image_after_a_crash_during_publicationandbeneath::tests::temp_files_persist_without_replacing_and_vanish_when_dropped. Both shared one nanosecond-timestamp-only root (/tmp/calternal-beneath-2631287-1793338351622575182); the marker test observed the other test's Photos directory. This timestamp-only fixture also predates the train. Commit9041b509makes the shared fsio test root allocator unique with a per-process atomic sequence, and uses that allocator in beneath tests. No assertions, retry counts, or bounds changed. All production code and browser inputs are identical between84cb1a4eand9041b509; these last two files change only cfg(test) code. Browser first-run SHA is honestly retained as84cb1a4e; final full Rust gates run on9041b509. WebKit half should rerun3cf6ac568f.d83e54dbc129eb38628a7dd804a6971110659f25b71b0d886207cb3e0846eba8d5000d47ca5b59c4These are individual diagnostic attempts, not claims that intermittent bugs are absent when one attempt passes. The unchanged regression port, deterministic red tests and dev toast repetitions establish attribution. Harness failure reproduces on every table row.
Commit
3cf6ac56makes the new binary-resolver unit test independent of the Rust build, as CI lints before waiting for its server binary. It preserves the default-path/environment assertions and verifies the executable-access call using a scoped filesystem mock. Real missing/non-executable checks remain in the second unit test; the full browser run tests the real default executable. Both tests also pass in a copied tree with no built binary. This commit changes no production or browser inputs.Browser first-run results
App selection includes every
chromiumproject,throttled-*,flow,passkeys,admin-setup,contrast, andsidebar-band-*. One worker, zero retries; dependency edges to unselected half-B projects only were removed. Test cases and assertions were unchanged.CALTERNAL_BINwas explicitly unset. Primitives ran the complete repository CI matrix (Chromium and WebKit, with its existing Linux WebKit toast exclusion).Browser run recorded starting SHA
84cb1a4e93346684ea1a9da5688a36fc90c6a056. Final test-only changes are documented above and verified withruntime-equivalence.log; production Rust, web code, browser tests/config and dependencies are unchanged. WebKit-half rerun needed on3cf6ac568fb8339a646f26a7149f52a86387c46b, including the final test fixture corrections.Gates and verbatim output
fmt-final
clippy-final
rust-tests-final
web-check
web-lint-final
harness-without-binary
web-unit
editor-check
editor-unit
primitives-unit
bundle
primitives-first
app-first
Additional Rust contract conflict
The first workspace run on
84cb1a4ehad 1,273 passed / 2 failed / 20 ignored; both failures were the now-fixed shared-root collision. The full workspace rerun on9041b509(Rust sources identical to final3cf6ac56) had 1,274 passed / 1 failed / 20 ignored:kill_nine_mid_upload_leaves_nothing_half_written, cleanup timeout. Diagnostic isolated reproduction confirmed pending markers are retired (0) while an interrupted private image hasuser.calternal.writing.v1=1. #759 intentionally retains these ambiguous bytes privately; its deterministic interrupted-write safety test requires this across repeated recovery. The real-binary test instead requires all staging gone, so it fails depending on the exact SIGKILL boundary. I have not loosened its assertion or its 20-second deadline. Clarification on this conflicting contract is pending. Rust gate remains FAIL; do not merge.Standalone crash-test diagnostics:
Logs, JSON reports, first-run traces, branch-isolation logs, deterministic red-test output, runtime-equivalence proof and full verbatim logs:
/tmp/train-bm2-fix-resultson10by32-01-std. Both created target directories are deleted and the lease heartbeat is stopped at handback. Worktree remains/home/agent/wt/train-bm2-fixon the requested train branch.Resolved the BM2 Rust upload crash failure. Fix commit:
1ee44c4b1a35ff277828105af2e8e59dc7d93533, based on the requested3cf6ac568fb8339a646f26a7149f52a86387c46b. Production code changed; both browser halves need a rerun on the new head. The concurrent 10by32-01 WebKit run at3cf6ac56was not touched. No merge or deployment.Machine: 10by32-02-std (arm64, shared). Worktree:
/home/agent/wt/bm2-crash. Build-pool lease12a015143f404d96944085f310f643eewas heartbeated throughout. Every Cargo command used/usr/local/bin/build-slot.shwithCALTERNAL_TRAIN=1,CARGO_BUILD_JOBS=3, and descriptor limit 8192. Diagnostic repetitions used one test thread; final gates used four test threads.Five-run attribution matrix
Each cell is an actual invocation of
cargo test -p calternal --test attachments_crash kill_nine_mid_upload_leaves_nothing_half_written -- --exactat that revision, with that revision's unchanged test. Each invocation selected exactly one test; no absent-test passes. FAIL means the reported 20-second cleanup timeout, not a visibility assertion or a build failure.d83e54dbc129eb38ca5b59c484cb1a4e3cf6ac56The failure is already present in #759 alone. Neither
84cb1a4enor3cf6ac56introduced it. These five-attempt samples establish reproduction, not a statistical flake-rate comparison.Root cause and contract
This is indefinite retention, not cleanup running slightly late. #759 changed
RecordedFile::writeto put a one-byteuser.calternal.writing.v1marker on the inode, write the payload, then update the creation receipt and clear the marker. SIGKILL between the payload syscall and receipt update leaves a receipt for the previous prefix. Recovery successfully claims the dead owner's transaction with a non-blocking kernel lock attempt, but the content/length proof fails.Quarantine::restoresees the writing marker and retains the image privately. Every subsequent recovery repeats that choice; there is no expiry or bounded retention period. A stale PID is not the cause, and increasing the test timeout would not fix it.Contracts relied on:
The old decision preserves genuinely ambiguous outside bytes, but supplies no bounded-retention justification for ordinary app-written upload prefixes. The fix supplies the missing creator proof instead of changing the wait or publishing the prefix.
Fix and deterministic evidence
RecordedFilerecords a bounded append intent before changing the payload: previous size/hash plus up to 2 KiB of intended bytes. Under the existing exclusive kernel file lease, recovery verifies either the completed receipt or the receipted prefix plus any short prefix of that intent. This covers a stop before the syscall, inside a short write, after the syscall, or during receipt update. The existing inode/path binding, single-link requirement, live-owner exclusion, lease checks and final unlink boundary remain in force. Same-length outside modifications fail the proof and remain private. No receipt is invented by hashing an unknown image.The existing real-child SIGKILL reviewer regression now also requires an empty private root after recovery; its public-visibility assertion is unchanged. Against pre-fix production code, the added cleanup assertion fails deterministically with
left: 1, right: 0; with the fix it passes. New proof checks cover 0, 1, 1024, 2047 and 2048 written bytes, repeated recovery, and same-length outside changes in both the previous prefix and pending suffix. The originalattachments_crash.rsassertions and 20-second wait are unchanged.The first four-thread attachment/fsio gate also exposed prepared-directory ownership that still used descriptor-close lifetime. A sibling fork could retain the open description after the owner guard ended, causing a single recovery pass to skip the directory.
PreparedDirectoryand its root construction handshake now use an explicit-unlock guard. A deterministic duplicate-descriptor regression fails with the unlock disabled and passes while the duplicate stays open. The final gates include this fix; the initial failure is disclosed below.Limits and cost: old one-byte interrupted images have no recoverable intent, and unmatched outside bytes still cannot safely be discarded or published; they retain the pre-existing conservative private treatment. The new proof fixes newly interrupted app writes without fabricating provenance for old unknown bytes. This is process-death validation, not a physical power-loss experiment. A single local debug 128 MiB upload measured 302 MiB/s before and 150 MiB/s after the bounded write change; both bounded-memory checks passed. These shared-host samples are a disclosed throughput cost, not a formal performance gate.
Gates
Final gates passed with four test threads, including the full workspace and documentation tests. Existing configured ignored tests remain ignored; no test was disabled for this change. The crash case passed 20 consecutive invocations on the final production implementation (60 upload/restart kill rounds, plus completed-upload verification). Full attachment/fsio sets, storage startup, full attachment crash binary, fmt, Clippy with warnings denied, and workspace tests are included below.
Final gate exit output, verbatim:
cargo test -p calternal-attachments -p calternal-fsio — exit 0
cargo test -p calternal --test storage_startup — exit 0
cargo test -p calternal --test attachments_crash -- --nocapture — exit 0
cargo fmt --all -- --check — exit 0
cargo clippy --workspace --all-targets -- -D warnings — exit 0
cargo test --workspace — exit 0
cargo test -p calternal --test attachments_crash kill_nine_mid_upload_leaves_nothing_half_written -- --exact (repeat 1/20) — exit 0
cargo test -p calternal --test attachments_crash kill_nine_mid_upload_leaves_nothing_half_written -- --exact (repeat 2/20) — exit 0
cargo test -p calternal --test attachments_crash kill_nine_mid_upload_leaves_nothing_half_written -- --exact (repeat 3/20) — exit 0
cargo test -p calternal --test attachments_crash kill_nine_mid_upload_leaves_nothing_half_written -- --exact (repeat 4/20) — exit 0
cargo test -p calternal --test attachments_crash kill_nine_mid_upload_leaves_nothing_half_written -- --exact (repeat 5/20) — exit 0
cargo test -p calternal --test attachments_crash kill_nine_mid_upload_leaves_nothing_half_written -- --exact (repeat 6/20) — exit 0
cargo test -p calternal --test attachments_crash kill_nine_mid_upload_leaves_nothing_half_written -- --exact (repeat 7/20) — exit 0
cargo test -p calternal --test attachments_crash kill_nine_mid_upload_leaves_nothing_half_written -- --exact (repeat 8/20) — exit 0
cargo test -p calternal --test attachments_crash kill_nine_mid_upload_leaves_nothing_half_written -- --exact (repeat 9/20) — exit 0
cargo test -p calternal --test attachments_crash kill_nine_mid_upload_leaves_nothing_half_written -- --exact (repeat 10/20) — exit 0
cargo test -p calternal --test attachments_crash kill_nine_mid_upload_leaves_nothing_half_written -- --exact (repeat 11/20) — exit 0
cargo test -p calternal --test attachments_crash kill_nine_mid_upload_leaves_nothing_half_written -- --exact (repeat 12/20) — exit 0
cargo test -p calternal --test attachments_crash kill_nine_mid_upload_leaves_nothing_half_written -- --exact (repeat 13/20) — exit 0
cargo test -p calternal --test attachments_crash kill_nine_mid_upload_leaves_nothing_half_written -- --exact (repeat 14/20) — exit 0
cargo test -p calternal --test attachments_crash kill_nine_mid_upload_leaves_nothing_half_written -- --exact (repeat 15/20) — exit 0
cargo test -p calternal --test attachments_crash kill_nine_mid_upload_leaves_nothing_half_written -- --exact (repeat 16/20) — exit 0
cargo test -p calternal --test attachments_crash kill_nine_mid_upload_leaves_nothing_half_written -- --exact (repeat 17/20) — exit 0
cargo test -p calternal --test attachments_crash kill_nine_mid_upload_leaves_nothing_half_written -- --exact (repeat 18/20) — exit 0
cargo test -p calternal --test attachments_crash kill_nine_mid_upload_leaves_nothing_half_written -- --exact (repeat 19/20) — exit 0
cargo test -p calternal --test attachments_crash kill_nine_mid_upload_leaves_nothing_half_written -- --exact (repeat 20/20) — exit 0
Initial failure, negative controls and throughput evidence
These are diagnostic outputs, not final gate failures. The first parallel gate failure was fixed by the explicit prepared-directory unlock, and the whole final gate sequence was rerun.
attachments-fsio-initial — verbatim diagnostic output
deterministic-before — verbatim diagnostic output
directory-before — verbatim diagnostic output
baseline-upload — verbatim diagnostic output
intent-upload — verbatim diagnostic output
Superseded for merging by BM3: #772 (
train/2026-10-30-bm3→dev, head14bd77f0b9f5da7ad6de41c3b159be74db55507a). BM3 excludes #759 and its storage follow-up fixes, retaining the independent toast/auth/binary-resolver fixes. All non-browser gates pass. Both complete Playwright halves ran on that head; half A has one first-run throttled-390 layout-shift failure, with 3/3 failure-only reruns passing and no reproducible merge-stage boundary; half B and primitives pass. Full evidence and limitations are in #772. No merge or deployment performed; kayg approves.Closing: BM2 was replaced by BM3 (#772, merged into dev). Branch kept.
Pull request closed