Sharing slice 1, PR 3: UI (float toolbar, Shared with me, view-only), switch removed

kayg commented

2026-11-02 08:49:04 +00:00

Owner

Sharing slice 1, PR 3: the approved sharing UI, restacked on dev and on #909, ported into the current layout. Turns cross-owner sharing on (no switch: CROSS_OWNER_SHARING_ENABLED is gone; owner rule, no feature flags).

Stacks on #909 (fix/sharing-fast-path-hardening). The old head was e38e9a520 (Style-stack era); the earlier version is kept at archive/feat/sharing-s1-pr3.

What it does

Share sheet grows out of Share in the page toolbar: one plain sentence, "Add people" above the people (approved slice 1 fix), each person with Can view / Can edit and remove. No field fill. Named people only; links/QR are slice 2.
Page toolbar. Share sits beside ⋯ in the shared PageToolbar, with the mockup's values on wide screens (DeskPills: 32 px, 72 px wide, 14 px inset). On a note shared with you, the owner's avatar takes Share's place (shared + children; SharedBadge is the shared Pill), with a lock when view-only, the tooltip "Shared by X · level", and a menu with "Remove me".
"Shared with me" sidebar place, shown only when something is shared, with a new-share dot (kept per device). Rows say "Shared by X". Shared rows have their own menu: Open, Open in focus, Remove me.
View-only notes lose Write, Insert, Style and Attach, as in the mockup's RestBar. The phone bar is just Info; the editor takes no typing.
"Your edits to ‹title›" is kept when a share ends or drops to view (share-controls + share-rescue; the durable offline version is #876).
Backend (cherry-picked from the old PR, reconciled with #909):
- sharing actions registered; notes.shared-with-me and notes.hide-shared added;
- notes.history takes owner_id, through the resolver;
- a fresh grant's first view opens without a later write;
- recipients' journals get content-free sharing.granted/sharing.revoked entries;
- a reader's empty sync step is ignored.

First paint (kayg 11-09)

Everything that isn't needed to draw the first screen loads afterwards:

lazy chunks: sharing-sync (list read, journal hook, controls, dot, Remove me, shared-row menu), share-open (the sheet and its host, warmed at idle once a Share button shows), SharedBadge, DeskPills, share-rescue (joins the editor via appendConfig only on an edit-shared note).
first_js_brotli is 222.995 KB vs dev 221.802 KB, so +1.19 KB: the shared-note state and the view-only checks the first screen must draw.
kayg accepted this on 11-09. chunk.index is set to 223.2, offset by the first-paint credits PR from the ports lane. The new lazy lines fit inside the 11-08 lazy ceiling.

Decisions

View-only notes lose Insert/Style (brief + mockup RestBar) rather than showing a disabled Style sheet as in the old PR.
Shared rows have no swipe actions (approved slice 1: nothing of the owner's to pin or delete). The newer "swipe actions on every list" rule would add a "Remove me" swipe; that's a follow-up for kayg.
The AI pill is not in dev's toolbar yet; it's out of scope here, and the toolbar is ready for the mockup's extra slot.

Risks

Shared-note history shows every version, including ones from before the grant (A5 is undecided).
The shell around the sheet is dev's current layout. Only the sharing pieces match the mockup, not the full Float layout.

Gates, screenshots and perf follow in comments.

🤖 Generated with Claude Code

Sharing slice 1, PR 3: the approved sharing UI, restacked on dev and on #909, ported into the current layout. Turns cross-owner sharing on (no switch: `CROSS_OWNER_SHARING_ENABLED` is gone; owner rule, no feature flags). Stacks on #909 (`fix/sharing-fast-path-hardening`). The old head was `e38e9a520` (Style-stack era); the earlier version is kept at `archive/feat/sharing-s1-pr3`. ## What it does - **Share sheet** grows out of Share in the page toolbar: one plain sentence, "Add people" above the people (approved slice 1 fix), each person with Can view / Can edit and remove. No field fill. Named people only; links/QR are slice 2. - **Page toolbar.** Share sits beside ⋯ in the shared `PageToolbar`, with the mockup's values on wide screens (`DeskPills`: 32 px, 72 px wide, 14 px inset). On a note shared with you, the owner's avatar takes Share's place (`shared` + children; `SharedBadge` is the shared `Pill`), with a lock when view-only, the tooltip "Shared by X · level", and a menu with "Remove me". - **"Shared with me"** sidebar place, shown only when something is shared, with a new-share dot (kept per device). Rows say "Shared by X". Shared rows have their own menu: Open, Open in focus, Remove me. - **View-only notes** lose Write, Insert, Style and Attach, as in the mockup's RestBar. The phone bar is just Info; the editor takes no typing. - **"Your edits to ‹title›"** is kept when a share ends or drops to view (share-controls + share-rescue; the durable offline version is #876). - **Backend** (cherry-picked from the old PR, reconciled with #909): - sharing actions registered; `notes.shared-with-me` and `notes.hide-shared` added; - `notes.history` takes `owner_id`, through the resolver; - a fresh grant's first view opens without a later write; - recipients' journals get content-free `sharing.granted`/`sharing.revoked` entries; - a reader's empty sync step is ignored. ## First paint (kayg 11-09) Everything that isn't needed to draw the first screen loads afterwards: - lazy chunks: `sharing-sync` (list read, journal hook, controls, dot, Remove me, shared-row menu), `share-open` (the sheet and its host, warmed at idle once a Share button shows), `SharedBadge`, `DeskPills`, `share-rescue` (joins the editor via `appendConfig` only on an edit-shared note). - `first_js_brotli` is 222.995 KB vs dev 221.802 KB, so **+1.19 KB**: the shared-note state and the view-only checks the first screen must draw. - kayg accepted this on 11-09. `chunk.index` is set to 223.2, **offset by the first-paint credits PR** from the ports lane. The new lazy lines fit inside the 11-08 lazy ceiling. ## Decisions - View-only notes lose Insert/Style (brief + mockup RestBar) rather than showing a disabled Style sheet as in the old PR. - Shared rows have no swipe actions (approved slice 1: nothing of the owner's to pin or delete). The newer "swipe actions on every list" rule would add a "Remove me" swipe; that's a follow-up for kayg. - The AI pill is not in dev's toolbar yet; it's out of scope here, and the toolbar is ready for the mockup's `extra` slot. ## Risks - Shared-note history shows every version, including ones from before the grant (A5 is undecided). - The shell around the sheet is dev's current layout. Only the sharing pieces match the mockup, not the full Float layout. Gates, screenshots and perf follow in comments. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

kayg added 130 commits

2026-11-02 08:49:04 +00:00

test: cover sharing migration from v10 1d99409134

feat(auth): add sharing schema migration 11d9f5b4d6

test: cover independent Notes scopes ef1a3fd23a

test(auth): allow Notes-only app passwords in schema v11 c4486aea25

feat(auth): carry independent Notes app-password scopes 37c52f4ea3

fix(auth): allow Notes-only app passwords 437d8d0de7

style(auth): format scoped password tests 1076d4d8a2

feat(auth): preserve scoped identity through Notes sync d2a665598c

style: format scoped identity changes 8ca295f63d

fix(server): import live response conversion trait 28bfacc15a

fix(backdrops): read the expanded request identity 3def642ad8

test(engine): use a valid Notes append payload fe1a9bc0fe

test(auth): cover sharing admission ordering 4f9a935ee7

feat(auth): resolve note grants and admit writes 014b3e601a

fix(auth): use immediate share transactions 8802b867b1

test(auth): keep revoked shares indistinguishable 5645fd3218

fix(auth): admit active shared editors bb735454ce

test(auth): cover grant retry after revoke 9d991b7910

fix(auth): replay grant admissions idempotently fd193eaaa9

test(auth): randomize grant admission interleavings faf2140c0a

test(auth): recheck note edit permission 04e9385580

feat(auth): recheck write access before replay b849e3423d

test(notes): refuse before mutating room state baffd31ad4

feat(notes): add pre-mutation admission service 60f39c0512

style: format sharing admission changes 31f0c67b9a

test(notes): refuse API edits before room mutation 8131234fb7

test(notes): import edit kind in admission test 0c76bcd9cd

test(notes): refuse sync writes before room mutation d5d04d3ff0

test(notes): refuse server changes before room mutation 35111de492

test(sharing): keep PR1 actions unavailable 4f76966246

feat(notes): admit room and API writes before mutation 4fe31380b2

feat(auth): register unavailable sharing actions 33d196b2c9

docs(api): add sharing action contracts eaf7cb0c26

style: format sharing action admission changes 013c6b71af

test(auth): allow empty DAV scopes for Notes-only apps 9606569fa2

test(auth): use distinct migration credential hashes b0bcead574

test(auth): avoid legacy migration hash collisions 496c3a974b

test(auth): align migration and interleaving fixtures 6fae6898e3

style: format randomized grant test a0f6d81fa9

test(auth): keep write scope out of sharing dispatch d8b7bdaee7

style: format sharing scope dispatch test 09c15d2cd2

refactor(auth): reduce sharing clippy warnings 5d6594f5f3

style: format auth lock type alias 4d0e93ebaa

test(auth): restore v11 schema before v6 migration c1a709dcff

test(auth): strip current sharing schema from legacy fixtures 5cb99c6d12

test(auth): strip sharing schema from v2 migration fixture aa7129846e

test(auth): expect the v11 schema after migration d5659b046c

test(auth): expect v11 after legacy schema recovery 851a02566c

test(auth): deny Notes read password from flushing a note 8975f100ee

fix(auth): require Notes write scope to flush notes cc9b9ee4f4

style(auth): format Notes read scope test a026e66539

test(server): check registered routes in capability inventory d9e65d0d40

style: format route inventory test 6b36fe650a

test(server): detect unlisted router modules 57e1136587

test(auth): retain reader access after late revoke f0949152d0

test(search): initialize caller credential 322cb24582

docs(sharing): outline PR 2 data path 587663f3cc

test(sharing): enforce committed read fences 88f4c1fd11

fix(sharing): enforce committed content fences 01c37fac68

test(sharing): define authorized resource contract 37fef08731

fix(sharing): own fail-closed resolver inputs 020d6eb91d

test(sharing): require per-install control acknowledgements df96948703

feat(sharing): resolve resources and durable controls 64ef07dc11

test(sharing): cover regrant and edit loss controls 8c984e0b90

feat(sharing): use resolver for reads and grants f9803a9d24

style(sharing): format resolver and controls 5c8ef233a9

feat(sharing): resolve note reads and room joins e2b4df530d

feat(sharing): expose durable control sync actions 852d8a04a9

style(sharing): format control acknowledgement action 4a55406c13

fix(sharing): construct actions from auth service dd1fea180b

fix(notes): import owner id for shared reads 40053f93cc

docs(api): refresh sharing action contract 7b7fb95e88

test: exercise enabled sharing actions in isolation suite 973f581ff9

test: use a valid sharing isolation fixture 17e8202eb9

fix(notes): use resolved note id without extra borrow 00734086d8

style: format sharing isolation test eb7b400af1

docs: record PR2 core cutoff and gate results 5c1480bbdb

fix(sharing): keep actions unregistered until UI 6b0a5c02ad

test(sharing): keep review regressions in suite 501cc8ff4c

fix(notes): fence shared room deliveries on sequence 5c2584ea40

fix(sharing): fence room deliveries and order controls 65eb2b9c7b

fix(sharing): bound acknowledged control retention c561e4f81e

style: format sharing reset and room gates 3cbe017ebb

test(sharing): fix retention test imports b0bc0cfc38

fix(sharing): preserve fences after control cleanup 43c24c70e2

fix(sharing): keep server fences beyond control cleanup fac20d028a

test(auth): expect sharing retention schema 92732ee0a0

fix(notes): authorize all room stream output 9d9c64014a

fix(notes): satisfy current clippy lint 67cf2eb1c9

fix(notes): simplify room send fallback 8942bc7ede

test(auth): expect sharing schema version 351efd398a

docs(sharing): record round-one review gates 224951e3d7

fix(sharing): keep cross-owner reads disabled before UI 26bca43552

fix(sharing): bind reset acknowledgements to note cursors 862f9f46ac

fix(sharing): recheck queued room frames at write f97b13de4d

chore(sharing): keep room permit import test-only 44b42e19cf

style(sharing): format fence and frame changes 4d518e2658

refactor(sharing): group room delivery context 2ac8e836b6

test(sharing): keep pre-ui grant reads refused 04b5d01d29

style(sharing): format access gate regression 90ecac984b

test(sharing): assert room admission error directly 61e57a0070

test(auth): expect current sharing schema version 5b4c243bee

test(sharing): cover direct grants with app password 9b68658584

style(sharing): format app password regression 7ba765e069

test(sharing): cover remaining direct-grant read paths 5b01e80c28

refactor(sharing): split room delivery from core 85ed51166f

style(sharing): format core split changes 97c23d7cdf

fix(sharing): remove room eviction from core 8659c5287b

fix(notes): await executor room authorization a0d2512323

fix(notes): await executor room update d455842942

feat(sharing): move room delivery into stacked PR 6a948bc56a

test(sharing): cover recipient room lock progress 22d827923a

fix(sharing): retain recipient for room eviction 5b8934897e

fix(sharing): scope room send locks by recipient a40ece5e76

fix(sharing): import room eviction recipient type 19071be845

feat(sharing): register sharing actions, drop the cross-owner switch, add shared-with-me and hide 4518d49299

feat(sharing): shared note history through the access check b2fddbb22e

feat(sharing): recipient actions live in the notes namespace; tests for the live share path 6293f546ba

test(sharing): unique keys 59cbba2292

test(sharing): restore isolation helpers; keep only the obsolete 'unavailable' tests removed 0312b8639c

feat(web): sharing UI (share sheet, desk pills, shared badge, Shared with me, view-only, rescue) 7665fc3fd9

test(sharing): update tests whose premise was the sharing switch; classify tasks.set-status a3c91ac7a1

fix(sharing): a fresh grant's first view opens without a later write; contracts e5c9512ab3

test(sharing): unit input is null fb95a8e2da

chore(web): regenerate action types cf2376a409

test(web): sharing e2e (admin server, two people) 03177add1c

feat(sharing): tell the recipient's journal when a share is granted or ends cab88179ea

test(web): note info bar check on wide only b6956e8cd5

fix(notes): a reader's empty sync step is ignored, not refused cca400a1cc

feat(web): a shared note's info sheet (read-only for readers, no pin or delete); history check in e2e; sentence unit tests

CI / server (pull_request) Has been cancelled

Details

CI / rust (pull_request) Has been cancelled

Details

CI / web (pull_request) Has been cancelled

Details

Markdown extraction contract / markdown-native-contract (pull_request) Has been cancelled

Details

Markdown extraction contract / markdown-editor-contract (pull_request) Has been cancelled

Details

bf616240bd

kayg referenced this pull request

2026-11-02 16:15:27 +00:00

feat: sharing slice 1 PR 1: scoped auth and admission #827

kayg commented

2026-11-02 17:42:43 +00:00

Author

Owner

I reviewed the backend changes against docs/plans/0409-sharing-slice-1.md. Three follow-ups remain:

next_sequence persists share_fanout intents, but there is no worker draining them into recipient journals. The direct sharing.granted and sharing.revoked pushes cover access changes only. Owner note writes therefore do not reach recipient journal catch-up through the ordered fan-out path in the plan. Please wire an idempotent consumer ordered by note sequence and recipient, with the existing acknowledgement and retention behavior.
The full-reset preparation and acknowledgement helpers are not exposed or called by journal sync or the web client. An Installation that needs a reset has no runtime path to apply a full authorized snapshot and acknowledge it. In addition, prepare_full_reset selects active grants for deleted notes and then resolves each as readable; the resolver refuses deleted notes, so one such share can fail the reset preparation. Please connect the reset flow and handle deleted shares in the reset snapshot.
App-password revocation can be missed during WebSocket catch-up after journal lag. Engine::journal_for filters account.installation-revoked from app-password pages, but catch_up advances to the page token and does not run the signs_out check over those entries. The socket keeps a cached Caller, and Engine::execute checks its scopes without revalidating the credential. If revocation lands while the receiver is lagged, the socket can remain usable for scope-allowed actions. Please detect revocation during catch-up or revalidate the credential on each WebSocket message, with a lagged-revocation regression test.

I reviewed the backend changes against `docs/plans/0409-sharing-slice-1.md`. Three follow-ups remain: 1. `next_sequence` persists `share_fanout` intents, but there is no worker draining them into recipient journals. The direct `sharing.granted` and `sharing.revoked` pushes cover access changes only. Owner note writes therefore do not reach recipient journal catch-up through the ordered fan-out path in the plan. Please wire an idempotent consumer ordered by note sequence and recipient, with the existing acknowledgement and retention behavior. 2. The full-reset preparation and acknowledgement helpers are not exposed or called by journal sync or the web client. An Installation that needs a reset has no runtime path to apply a full authorized snapshot and acknowledge it. In addition, `prepare_full_reset` selects active grants for deleted notes and then resolves each as readable; the resolver refuses deleted notes, so one such share can fail the reset preparation. Please connect the reset flow and handle deleted shares in the reset snapshot. 3. App-password revocation can be missed during WebSocket catch-up after journal lag. `Engine::journal_for` filters `account.installation-revoked` from app-password pages, but `catch_up` advances to the page token and does not run the `signs_out` check over those entries. The socket keeps a cached `Caller`, and `Engine::execute` checks its scopes without revalidating the credential. If revocation lands while the receiver is lagged, the socket can remain usable for scope-allowed actions. Please detect revocation during catch-up or revalidate the credential on each WebSocket message, with a lagged-revocation regression test.

kayg referenced this pull request

2026-11-02 17:58:13 +00:00

Sharing slice 1 follow-up: durable offline recovery and lifecycle controls #876

kayg changed target branch from dev to feat/sharing-s1-pr2-rooms

2026-11-02 22:03:35 +00:00

kayg referenced this pull request

2026-11-02 23:09:39 +00:00

Sharing slice 1 follow-up: durable offline recovery and lifecycle controls #876

kayg referenced this pull request

2026-11-03 04:02:19 +00:00

Train BM14 #886

kayg referenced this pull request

2026-11-03 04:03:27 +00:00

Train BM14 #886

kayg referenced this pull request

2026-11-03 05:36:16 +00:00

Train BM14 #886

kayg commented

2026-11-03 08:24:11 +00:00

Author

Owner

Rebased onto the Style stack. New head: 289b972c58c15233a47a61df5224688b3e473698 (was 0fb5e8ed).

Base (decision). #842's own 15 commits now sit on base-bm15 = #852 head 08b6d9ad + --no-ff merge of #835 (3755691d, which carries #829). I did not edit #829/#835/#850-852. The PR base on Forgejo is unchanged (feat/sharing-s1-pr2-rooms), so its diff view also shows the Style stack until those merge.

Conflicts and how they were resolved

bar/Tools.svelte: took the Style stack's bar (phone: Aa, +, Attach; desktop: Log/New, Insert, Aa, Info, Focus; Source mode stays in ⋯). Added only the access wiring: on a view-only note the writing tools (Insert on desktop; Write and Attach on phone) are disabled, not removed, so Aa keeps its fixed slot and the capsule keeps its width and its bar to sheet morph.
lib/lazy-ui.svelte.ts: Style stack's resource list plus shareSheet. The build guard in lazy-ui-plugin.ts still reads 24 and the build passes.
App.svelte: merged without conflict.

Design, UI wiring only

Desktop top right: one glass pill holding two pills. Own note: Share + ⋯. Shared with you: owner's avatar pill (lock badge if view-only) + ⋯. The avatar opens the in-place menu: owner name, "shared this with you · access level", "Remove me".
Icons take --glyph-bar (new token in styles/note-bars.css, 22 px phone / 20 px desktop, same values the bar already used); no hardcoded sizes.
Share sheet: removed the local --glass-float-dense 0.96 overrides. It is plain <Glass dense /> now.
Pill buttons take the pill's radius (999), so hover and press tint match the container.
Tooltips on the pill buttons are centred on their button (spec checks centred, or clamped at the screen edge).
Style sheet on a view-only note opens from Aa, shows its pages dimmed and inert with one line: "View only. You can't change how this note looks."
BottomBar.svelte: a view-only note never switches to the text or block bars (focus or selection kept showing Bold, Undo, Delete).
phone-bars.spec.ts: Chromium note over a photo reads a top-band delta of 4.181636 (was under 4.1) because the right pill now holds Share + ⋯ on a note. All 6 cases give exactly that value; the pre-UI base passes 40/40. Limit for that case set to 4.5 by the file's rule (max + 0.25, rounded up to 0.1).

Access checks. git diff origin/feat/sharing-s1-pr3 HEAD -- crates is empty: server-side checks are byte-identical.

Gates (dev-01 Chromium, dev-02 WebKit; each through ~/bm15-sharing worktree, ~/bin/slot, CI=1 --workers=1 --retries=0)

bun run check: 0 errors, 15 warnings. bun run test web 95 passed, editor 519 passed.
bunx playwright test e2e/note-bars.spec.ts e2e/note-pills.spec.ts e2e/bar-rest.spec.ts e2e/phone-bars.spec.ts e2e/style-sheet.spec.ts e2e/tooltips.spec.ts e2e/glass.spec.ts e2e/admin-sharing.spec.ts --project=chromium-1440 --project=chromium-390 --project=admin-chromium-1440 --project=admin-chromium-390: 299 passed, 0 failed, 282 skipped (final head).
Same command with webkit-* and admin-webkit-*: first run on the final head had 7 failures while a train held the VM (22 min): admin-setup (setup page after 5 s), four style-sheet cases and two phone-bars home/journal cases at webkit-390. Reruns in isolation: style-sheet.spec.ts phone-bars.spec.ts on webkit-390+webkit-1440 248 passed 0 failed; admin-sharing.spec.ts zz capture on admin-webkit-1440+admin-webkit-390 11 passed 0 failed. I read these as load, not as a pass from a single clean run, so treat them as unconfirmed until a train run.
Screenshots (own, shared edit, shared view-only; Aa sheet open; 1440 and 390): on code under ~/Developer/Worktrees/mockup-capture/shots/bm15-sharing/{chromium,webkit}/. Not committed. Shared-note shots are always a Chromium guest (WebKit has no virtual passkeys).

Rebased onto the Style stack. New head: `289b972c58c15233a47a61df5224688b3e473698` (was `0fb5e8ed`). **Base (decision).** #842's own 15 commits now sit on `base-bm15` = #852 head `08b6d9ad` + `--no-ff` merge of #835 (`3755691d`, which carries #829). I did not edit #829/#835/#850-852. The PR base on Forgejo is unchanged (`feat/sharing-s1-pr2-rooms`), so its diff view also shows the Style stack until those merge. **Conflicts and how they were resolved** - `bar/Tools.svelte`: took the Style stack's bar (phone: Aa, +, Attach; desktop: Log/New, Insert, Aa, Info, Focus; Source mode stays in ⋯). Added only the access wiring: on a view-only note the writing tools (Insert on desktop; Write and Attach on phone) are disabled, not removed, so Aa keeps its fixed slot and the capsule keeps its width and its bar to sheet morph. - `lib/lazy-ui.svelte.ts`: Style stack's resource list plus `shareSheet`. The build guard in `lazy-ui-plugin.ts` still reads 24 and the build passes. - `App.svelte`: merged without conflict. **Design, UI wiring only** - Desktop top right: one glass pill holding two pills. Own note: Share + ⋯. Shared with you: owner's avatar pill (lock badge if view-only) + ⋯. The avatar opens the in-place menu: owner name, "shared this with you · access level", "Remove me". - Icons take `--glyph-bar` (new token in `styles/note-bars.css`, 22 px phone / 20 px desktop, same values the bar already used); no hardcoded sizes. - Share sheet: removed the local `--glass-float-dense` 0.96 overrides. It is plain `<Glass dense />` now. - Pill buttons take the pill's radius (999), so hover and press tint match the container. - Tooltips on the pill buttons are centred on their button (spec checks centred, or clamped at the screen edge). - Style sheet on a view-only note opens from Aa, shows its pages dimmed and inert with one line: "View only. You can't change how this note looks." - `BottomBar.svelte`: a view-only note never switches to the text or block bars (focus or selection kept showing Bold, Undo, Delete). - `phone-bars.spec.ts`: Chromium note over a photo reads a top-band delta of 4.181636 (was under 4.1) because the right pill now holds Share + ⋯ on a note. All 6 cases give exactly that value; the pre-UI base passes 40/40. Limit for that case set to 4.5 by the file's rule (max + 0.25, rounded up to 0.1). **Access checks.** `git diff origin/feat/sharing-s1-pr3 HEAD -- crates` is empty: server-side checks are byte-identical. **Gates** (dev-01 Chromium, dev-02 WebKit; each through `~/bm15-sharing` worktree, `~/bin/slot`, `CI=1 --workers=1 --retries=0`) - `bun run check`: 0 errors, 15 warnings. `bun run test` web 95 passed, editor 519 passed. - `bunx playwright test e2e/note-bars.spec.ts e2e/note-pills.spec.ts e2e/bar-rest.spec.ts e2e/phone-bars.spec.ts e2e/style-sheet.spec.ts e2e/tooltips.spec.ts e2e/glass.spec.ts e2e/admin-sharing.spec.ts --project=chromium-1440 --project=chromium-390 --project=admin-chromium-1440 --project=admin-chromium-390`: 299 passed, 0 failed, 282 skipped (final head). - Same command with `webkit-*` and `admin-webkit-*`: first run on the final head had 7 failures while a train held the VM (22 min): `admin-setup` (setup page after 5 s), four `style-sheet` cases and two `phone-bars` home/journal cases at webkit-390. Reruns in isolation: `style-sheet.spec.ts phone-bars.spec.ts` on `webkit-390`+`webkit-1440` 248 passed 0 failed; `admin-sharing.spec.ts zz capture` on `admin-webkit-1440`+`admin-webkit-390` 11 passed 0 failed. I read these as load, not as a pass from a single clean run, so treat them as unconfirmed until a train run. - Screenshots (own, shared edit, shared view-only; Aa sheet open; 1440 and 390): on `code` under `~/Developer/Worktrees/mockup-capture/shots/bm15-sharing/{chromium,webkit}/`. Not committed. Shared-note shots are always a Chromium guest (WebKit has no virtual passkeys).

kayg referenced this pull request

2026-11-03 08:24:11 +00:00

Sharing slice 1 follow-up: durable offline recovery and lifecycle controls #876

kayg referenced this pull request

2026-11-03 08:54:28 +00:00

Merge train BM14b #891

kayg commented

2026-11-03 09:41:57 +00:00

Author

Owner

Update: head is now e38e9a52003ed2ee3349846e156f509414bb7b67 (was 289b972c). The phone-bars limit change is reverted (the 4.5 commit is dropped from the branch; the limit is 4.1 again) and replaced by a fix to what the check measures.

What the number measures. phone-bars.spec.ts "top band" is the colour difference between the very top row (y=0) and the row at y=95, each taken as the median across the whole row. Its intent (from the file) is "a little way in, the screen is still close to its edge colour": it is a page-colour check. But y=95 crosses the top pills, so their pixels were in that median. A note's right pill went from one button (44 px) to Share + ⋯ (92 px), so the pills cover about 35% of the row instead of 23%, the median landed one colour level lower (44 → 43), and the delta went 3.71 → 4.18 against 4.1.

Is the wider pill worse? No. Probe on the note over a photo, dark, 393/390/430 wide, base (#852 + backend) vs this branch, Chromium on dev-01:

Page colour at y=95 with the pill columns left out: base [44,43,43], head [44,43,43], delta to the top row 3.7107 in all 16 cases on both.
Whole row (what the test took): base 3.7107–3.8073, head 4.1816 (393 and 390 wide), 3.7107 (430 wide). So the movement is the median's sampling, not the page.
The right pill's own glass: base [38,38,38], head [39,38,37] (within one level; same single <Glass />). Nothing new shows through it, so the glyphs read the same. WebKit and Chromium on dev-02 give 3.7107 for both with or without the exclusion.

The fix, same intent, not a looser bar. The two top rows are now read between the top pills ([data-chrome-pills] .pill, 2 px margin): the page colour next to the pills at that row, so pill width no longer moves it. The limit stays 4.1. On every case I measured, the new reading is at or below the old one (base 3.8073 → 3.7107, head 4.1816 → 3.7107), so the bar is the same or tighter. The bottom rows and every other limit are unchanged. Cases without a pill at that row (none excluded) read exactly as before.

Numbers. Head under test: #876 9fec3d1f (contains this commit). CI=1 CALTERNAL_BIN=… bunx playwright test e2e/phone-bars.spec.ts --project= --workers=1 --retries=0 --repeat-each=5, through ~/bin/slot:

chromium-390: 1200 passed, 0 failed (30.7 min, dev-01).
webkit-390: 1200 passed, 0 failed (33.0 min, dev-02).
(dev-01's /tmp ran out of inodes from another job's fixtures, so that run used TMPDIR=$HOME/bm15-tmp, as BM14 did; my first two Chromium attempts failed for that reason and are not counted.)

Update: head is now `e38e9a52003ed2ee3349846e156f509414bb7b67` (was `289b972c`). **The phone-bars limit change is reverted** (the 4.5 commit is dropped from the branch; the limit is 4.1 again) and replaced by a fix to what the check measures. **What the number measures.** `phone-bars.spec.ts` "top band" is the colour difference between the very top row (y=0) and the row at y=95, each taken as the **median across the whole row**. Its intent (from the file) is "a little way in, the screen is still close to its edge colour": it is a page-colour check. But y=95 crosses the top pills, so their pixels were in that median. A note's right pill went from one button (44 px) to Share + ⋯ (92 px), so the pills cover about 35% of the row instead of 23%, the median landed one colour level lower (44 → 43), and the delta went 3.71 → 4.18 against 4.1. **Is the wider pill worse? No.** Probe on the note over a photo, dark, 393/390/430 wide, base (#852 + backend) vs this branch, Chromium on dev-01: - Page colour at y=95 with the pill columns left out: base `[44,43,43]`, head `[44,43,43]`, delta to the top row **3.7107 in all 16 cases on both**. - Whole row (what the test took): base 3.7107–3.8073, head 4.1816 (393 and 390 wide), 3.7107 (430 wide). So the movement is the median's sampling, not the page. - The right pill's own glass: base `[38,38,38]`, head `[39,38,37]` (within one level; same single `<Glass />`). Nothing new shows through it, so the glyphs read the same. WebKit and Chromium on dev-02 give 3.7107 for both with or without the exclusion. **The fix, same intent, not a looser bar.** The two top rows are now read between the top pills (`[data-chrome-pills] .pill`, 2 px margin): the page colour next to the pills at that row, so pill width no longer moves it. The limit stays **4.1**. On every case I measured, the new reading is at or below the old one (base 3.8073 → 3.7107, head 4.1816 → 3.7107), so the bar is the same or tighter. The bottom rows and every other limit are unchanged. Cases without a pill at that row (none excluded) read exactly as before. **Numbers.** Head under test: #876 `9fec3d1f` (contains this commit). `CI=1 CALTERNAL_BIN=… bunx playwright test e2e/phone-bars.spec.ts --project= --workers=1 --retries=0 --repeat-each=5`, through `~/bin/slot`: - `chromium-390`: 1200 passed, 0 failed (30.7 min, dev-01). - `webkit-390`: 1200 passed, 0 failed (33.0 min, dev-02). (dev-01's `/tmp` ran out of inodes from another job's fixtures, so that run used `TMPDIR=$HOME/bm15-tmp`, as BM14 did; my first two Chromium attempts failed for that reason and are not counted.)

kayg referenced this pull request

2026-11-03 09:41:57 +00:00

Sharing slice 1 follow-up: durable offline recovery and lifecycle controls #876

kayg referenced this pull request

2026-11-04 08:01:57 +00:00

Unify UI primitives in production (audit + plan) #912

kayg commented

2026-11-04 10:05:44 +00:00

Author

Owner

Blockers for turning cross-owner sharing on in this PR, from the sharing review on #829 (#829 (comment)). Each needs a fix and a perf check:

P2: a cleanup step scans every user's sharing tables inside each write to a shared note, while holding the auth DB write lock. That would slow sign-ins for everyone while an owner types.
P2: the live room checks recipients one by one, with one DB call each per update, and checks again per frame. This needs a batched check.
P2: flipping the switch opens note reads and room joins only. History, attachments, search, backlinks, previews, export and sync aren't share-aware yet. Before enabling, add a test that lists every entry point taking a note id and proves each one enforces the grant.

Also fix the two wrong comments in #909 (P3).

Blockers for turning cross-owner sharing on in this PR, from the sharing review on #829 (https://git.kayg.org/kayg/calternal/pulls/829#issuecomment-77631). Each needs a fix and a perf check: 1. **P2:** a cleanup step scans every user's sharing tables inside each write to a shared note, while holding the auth DB write lock. That would slow sign-ins for everyone while an owner types. 2. **P2:** the live room checks recipients one by one, with one DB call each per update, and checks again per frame. This needs a batched check. 3. **P2:** flipping the switch opens note reads and room joins only. History, attachments, search, backlinks, previews, export and sync aren't share-aware yet. Before enabling, add a test that lists every entry point taking a note id and proves each one enforces the grant. Also fix the two wrong comments in #909 (P3).

kayg referenced this pull request

2026-11-04 10:07:48 +00:00

Approved-but-unported UI (ship list, Nov 4) #925

kayg referenced this pull request

2026-11-04 13:06:24 +00:00

Open PR triage (Nov 4) #931

~~kayg referenced this pull request 2026-11-05 23:21:11 +00:00~~

Cleanup 2026-11-06 #978

kayg referenced this pull request

2026-11-05 23:29:33 +00:00

Cleanup 2026-11-06 #978

kayg referenced this pull request

2026-11-07 17:56:31 +00:00

Housekeeping 2026-11-07 #1009

kayg commented

2026-11-07 19:10:10 +00:00

Author

Owner

housekeeping #1009: needs-decision.

Cross-owner sharing enablement remains explicitly blocked by #829/#909: auth-DB scan per write, unbatched recipient checks, and incomplete grant enforcement across note entry points. Its old Style/chrome stack also needs reconciliation with current Float work. Leave feature flags unchanged for the maintainer decision.

original head: e38e9a52003ed2ee3349846e156f509414bb7b67. against dev cd7f84432febfc63b788fbb9b9f9950452982d74, git cherry reports 19 unmatched and 0 equivalent patches. the landing audit lists each candidate missing commit and stable patch match in pr-842.md; unmatched patches can include superseded behavior.

left open, source branch unchanged. no rebase or new test claim for this decision lane.

housekeeping #1009: needs-decision. Cross-owner sharing enablement remains explicitly blocked by #829/#909: auth-DB scan per write, unbatched recipient checks, and incomplete grant enforcement across note entry points. Its old Style/chrome stack also needs reconciliation with current Float work. Leave feature flags unchanged for the maintainer decision. original head: `e38e9a52003ed2ee3349846e156f509414bb7b67`. against dev `cd7f84432febfc63b788fbb9b9f9950452982d74`, git cherry reports 19 unmatched and 0 equivalent patches. the [landing audit](https://git.kayg.org/attachments/fe3c09dc-dea3-47a0-92e2-b44a777083e5) lists each candidate missing commit and stable patch match in `pr-842.md`; unmatched patches can include superseded behavior. left open, source branch unchanged. no rebase or new test claim for this decision lane.

kayg referenced this pull request

2026-11-07 19:10:10 +00:00

Sharing slice 1 follow-up: durable offline recovery and lifecycle controls #876

kayg referenced this pull request

2026-11-07 21:18:43 +00:00

Housekeeping 2026-11-07 #1009

kayg referenced this pull request

2026-11-08 19:01:27 +00:00

Housekeeping 2026-11-07 #1009

kayg referenced this pull request

2026-11-08 19:01:28 +00:00

Housekeeping 2026-11-07 #1009

kayg referenced this pull request

2026-11-08 19:01:29 +00:00

Housekeeping 2026-11-07 #1009

kayg referenced this pull request

2026-11-08 19:01:29 +00:00

Housekeeping 2026-11-07 #1009

kayg referenced this pull request

2026-11-08 19:04:24 +00:00

Housekeeping 2026-11-07 #1009

kayg referenced this pull request

2026-11-09 07:12:29 +00:00

fix(sharing): harden the owner fast path (review of #829/#835) #909

kayg referenced this pull request

2026-11-09 08:09:05 +00:00

flaky: notes_crash kill_nine_mid_append_on_a_long_note (note file missing, only temp file left) #1023

kayg changed target branch from feat/sharing-s1-pr2-rooms to fix/sharing-fast-path-hardening

2026-11-09 08:58:46 +00:00

kayg changed title from ~~Sharing slice 1, PR 3: UI~~ to Sharing slice 1, PR 3: UI (float toolbar, Shared with me, view-only), switch removed

2026-11-09 09:03:37 +00:00

kayg commented

2026-11-09 09:03:50 +00:00

Author

Owner

Screenshots: app (Chromium, 2×) next to the approved mockup (review/calendar-2 `?slice=1`, 2×)

App: admin-sharing.spec with E2E_SHOTS and E2E_THEME, at 6d4c3e67c (the sheet-order fix is in; the head 110314b15 only changes a spec assertion since). Mockup: captured from the preview host. Sample data only. The shell around the sharing pieces is dev's current layout (sidebar, cards), so compare the sharing pieces themselves.

Checked by me against the mockup:

Add people is above the people, with no field fill.
The owner avatar with its lock sits in Share's slot of the [⋯] pill.
View-only has no Insert/Style/Write/Attach.
The rescue note is in the list.
Dark applies (the theme is pinned in the spec).
Not in dev yet: the AI pill and the Collections sidebar.

Share sheet (owner) · 1440 · light

app	mockup

Share sheet (owner) · 1440 · dark

app	mockup

Share sheet (owner) · 390 · light

app	mockup

Share sheet (owner) · 390 · dark

app	mockup

Shared with me · 1440 · light

app	mockup

Shared with me · 1440 · dark

app	mockup

Shared with me · 390 · light

app	mockup

Shared with me · 390 · dark

app	mockup

Shared note, view only · 1440 · light

app	mockup

Shared note, view only · 1440 · dark

app	mockup

Shared note, view only · 390 · light

app	mockup

Shared note, view only · 390 · dark

app	mockup

Shared note, can edit · 1440 · light

app	mockup

Shared note, can edit · 1440 · dark

app	mockup

Shared note, can edit · 390 · light

app	mockup

Shared note, can edit · 390 · dark

app	mockup

"Your edits to ‹title›" · 1440 · light

app	mockup

"Your edits to ‹title›" · 1440 · dark

app	mockup

"Your edits to ‹title›" · 390 · light

app	mockup

"Your edits to ‹title›" · 390 · dark

app	mockup

More app states (Chromium):

shared-history-1440-dark.png
cr/shared-history-1440-dark.png

shared-history-1440-light.png
cr/shared-history-1440-light.png

shared-menu-1440-dark.png
cr/shared-menu-1440-dark.png

shared-menu-1440-light.png
cr/shared-menu-1440-light.png

shared-menu-390-dark.png
cr/shared-menu-390-dark.png

shared-menu-390-light.png
cr/shared-menu-390-light.png

shared-place-1440-dark.png
cr/shared-place-1440-dark.png

shared-place-1440-light.png
cr/shared-place-1440-light.png

shared-view-bar-1440-dark.png
cr/shared-view-bar-1440-dark.png

shared-view-bar-1440-light.png
cr/shared-view-bar-1440-light.png

shared-view-bar-390-dark.png
cr/shared-view-bar-390-dark.png

shared-view-bar-390-light.png
cr/shared-view-bar-390-light.png

WebKit (Playwright WebKit paints no backdrop blur, so judge layout only):

share-sheet-1440-dark.png
wk/share-sheet-1440-dark.png

share-sheet-1440-light.png
wk/share-sheet-1440-light.png

share-sheet-390-dark.png
wk/share-sheet-390-dark.png

share-sheet-390-light.png
wk/share-sheet-390-light.png

shared-list-390-dark.png
wk/shared-list-390-dark.png

shared-note-1440-light.png
wk/shared-note-1440-light.png

shared-note-390-dark.png
wk/shared-note-390-dark.png

shared-view-bar-390-light.png
wk/shared-view-bar-390-light.png

## Screenshots: app (Chromium, 2×) next to the approved mockup (review/calendar-2 `?slice=1`, 2×) App: `admin-sharing.spec` with `E2E_SHOTS` and `E2E_THEME`, at `6d4c3e67c` (the sheet-order fix is in; the head `110314b15` only changes a spec assertion since). Mockup: captured from the preview host. Sample data only. The shell around the sharing pieces is dev's current layout (sidebar, cards), so compare the sharing pieces themselves. Checked by me against the mockup: - Add people is above the people, with no field fill. - The owner avatar with its lock sits in Share's slot of the [⋯] pill. - View-only has no Insert/Style/Write/Attach. - The rescue note is in the list. - Dark applies (the theme is pinned in the spec). - Not in dev yet: the AI pill and the Collections sidebar. **Share sheet (owner) · 1440 · light** | app | mockup | |---|---| | <img src="https://git.kayg.org/attachments/804d1ae6-707f-424d-b51b-3baa559d6cf9" width="420" alt="app"> | <img src="https://git.kayg.org/attachments/84c42f07-13c5-4222-8d68-57a356cdf632" width="420" alt="mockup"> | **Share sheet (owner) · 1440 · dark** | app | mockup | |---|---| | <img src="https://git.kayg.org/attachments/2fc08b29-9327-4371-8404-abb75c916cdc" width="420" alt="app"> | <img src="https://git.kayg.org/attachments/228ad579-faf1-4bbe-b0db-f7fa7dc9c1b8" width="420" alt="mockup"> | **Share sheet (owner) · 390 · light** | app | mockup | |---|---| | <img src="https://git.kayg.org/attachments/f2668411-af98-4cf3-970b-e3ebc2bc78fc" width="420" alt="app"> | <img src="https://git.kayg.org/attachments/d1409cca-71a7-469d-9b74-e643956a96da" width="420" alt="mockup"> | **Share sheet (owner) · 390 · dark** | app | mockup | |---|---| | <img src="https://git.kayg.org/attachments/9436432b-0646-45e4-8370-aeca91972899" width="420" alt="app"> | <img src="https://git.kayg.org/attachments/2926701d-4cab-4e45-828d-7f8b32267774" width="420" alt="mockup"> | **Shared with me · 1440 · light** | app | mockup | |---|---| | <img src="https://git.kayg.org/attachments/0b6301c0-7eaa-48ae-9076-b26ecb0bd28c" width="420" alt="app"> | <img src="https://git.kayg.org/attachments/32cff597-4aab-4960-8d1e-332e4baf11d8" width="420" alt="mockup"> | **Shared with me · 1440 · dark** | app | mockup | |---|---| | <img src="https://git.kayg.org/attachments/ed597fc8-ec3b-4e35-8a54-fd0c94710c06" width="420" alt="app"> | <img src="https://git.kayg.org/attachments/3e7a84ea-a241-4cc5-86e6-cfb172df31b1" width="420" alt="mockup"> | **Shared with me · 390 · light** | app | mockup | |---|---| | <img src="https://git.kayg.org/attachments/9f6cc032-3cf3-490b-a1d6-c8e300e1d694" width="420" alt="app"> | <img src="https://git.kayg.org/attachments/442c5330-f351-4124-835c-318687572243" width="420" alt="mockup"> | **Shared with me · 390 · dark** | app | mockup | |---|---| | <img src="https://git.kayg.org/attachments/23589442-3465-4bdd-a953-8433c49df25e" width="420" alt="app"> | <img src="https://git.kayg.org/attachments/934de9e8-582e-422b-8f1a-d4d357e7078f" width="420" alt="mockup"> | **Shared note, view only · 1440 · light** | app | mockup | |---|---| | <img src="https://git.kayg.org/attachments/d8b93f37-a050-4527-9f93-8e6e77af466e" width="420" alt="app"> | <img src="https://git.kayg.org/attachments/17a3122d-e401-4d75-86a3-358cdf1df19f" width="420" alt="mockup"> | **Shared note, view only · 1440 · dark** | app | mockup | |---|---| | <img src="https://git.kayg.org/attachments/852c93aa-26be-4fb7-abae-55282f862203" width="420" alt="app"> | <img src="https://git.kayg.org/attachments/07e8b216-2147-43a8-8c63-1bd2be013303" width="420" alt="mockup"> | **Shared note, view only · 390 · light** | app | mockup | |---|---| | <img src="https://git.kayg.org/attachments/839c40b2-bffd-46d2-b4b0-60389fee2e98" width="420" alt="app"> | <img src="https://git.kayg.org/attachments/37f94f98-4cc7-4d23-b887-64e156eeb200" width="420" alt="mockup"> | **Shared note, view only · 390 · dark** | app | mockup | |---|---| | <img src="https://git.kayg.org/attachments/16dfac09-36c9-41cd-9406-10e75b26ce68" width="420" alt="app"> | <img src="https://git.kayg.org/attachments/96ebeb48-bf1e-4991-aab1-e18a6888f3d4" width="420" alt="mockup"> | **Shared note, can edit · 1440 · light** | app | mockup | |---|---| | <img src="https://git.kayg.org/attachments/6eb3d309-4701-4e0a-8f9e-3d8251ac26df" width="420" alt="app"> | <img src="https://git.kayg.org/attachments/816da88f-749d-40cc-9743-3bc35a3bb92e" width="420" alt="mockup"> | **Shared note, can edit · 1440 · dark** | app | mockup | |---|---| | <img src="https://git.kayg.org/attachments/7527ea25-d965-4c9b-bdb8-da71517694e3" width="420" alt="app"> | <img src="https://git.kayg.org/attachments/086f9935-4fe8-41bb-bdb0-56eaa5a20a2f" width="420" alt="mockup"> | **Shared note, can edit · 390 · light** | app | mockup | |---|---| | <img src="https://git.kayg.org/attachments/9d66f9b7-c778-481b-88e1-320b9cf3c5b9" width="420" alt="app"> | <img src="https://git.kayg.org/attachments/a2c8d085-7c9a-46a1-97b9-1bce6bb57531" width="420" alt="mockup"> | **Shared note, can edit · 390 · dark** | app | mockup | |---|---| | <img src="https://git.kayg.org/attachments/0bd3611d-db95-48d0-9273-6b0d2ae3735f" width="420" alt="app"> | <img src="https://git.kayg.org/attachments/2176f37d-81c4-4d68-8ece-9b172c4c2486" width="420" alt="mockup"> | **"Your edits to ‹title›" · 1440 · light** | app | mockup | |---|---| | <img src="https://git.kayg.org/attachments/4418ee51-0bee-4118-bdbf-726d9dfa7821" width="420" alt="app"> | <img src="https://git.kayg.org/attachments/85e7efaf-9733-4095-ba69-f4c5fac2fae9" width="420" alt="mockup"> | **"Your edits to ‹title›" · 1440 · dark** | app | mockup | |---|---| | <img src="https://git.kayg.org/attachments/296036ba-a08d-4da8-a996-e00b088872ef" width="420" alt="app"> | <img src="https://git.kayg.org/attachments/cbf23692-5705-496a-a966-53e98d41adb5" width="420" alt="mockup"> | **"Your edits to ‹title›" · 390 · light** | app | mockup | |---|---| | <img src="https://git.kayg.org/attachments/11047f20-496c-4a6a-87b5-6136ce648caf" width="420" alt="app"> | <img src="https://git.kayg.org/attachments/d0792ee3-2280-46af-83bd-a90c298dd4be" width="420" alt="mockup"> | **"Your edits to ‹title›" · 390 · dark** | app | mockup | |---|---| | <img src="https://git.kayg.org/attachments/0f3e89d1-8ab8-411f-997a-152397891dc5" width="420" alt="app"> | <img src="https://git.kayg.org/attachments/08b86f60-c245-4f88-b82b-e2b414a0696d" width="420" alt="mockup"> | **More app states (Chromium):** shared-history-1440-dark.png <img src="https://git.kayg.org/attachments/b1b35e31-ed38-4f12-bd76-d453282625a7" width="420" alt="cr/shared-history-1440-dark.png"> shared-history-1440-light.png <img src="https://git.kayg.org/attachments/891167fd-81dc-47ed-acf0-e503061be873" width="420" alt="cr/shared-history-1440-light.png"> shared-menu-1440-dark.png <img src="https://git.kayg.org/attachments/455eab6e-e2e6-47f7-acf1-a6b10f76169c" width="420" alt="cr/shared-menu-1440-dark.png"> shared-menu-1440-light.png <img src="https://git.kayg.org/attachments/fb27f35b-2572-48d5-a8e2-ca476e2229c5" width="420" alt="cr/shared-menu-1440-light.png"> shared-menu-390-dark.png <img src="https://git.kayg.org/attachments/deefa504-3161-4606-9eb7-83f96575da1a" width="420" alt="cr/shared-menu-390-dark.png"> shared-menu-390-light.png <img src="https://git.kayg.org/attachments/41cbe807-2143-47f4-8742-dddb04b15de9" width="420" alt="cr/shared-menu-390-light.png"> shared-place-1440-dark.png <img src="https://git.kayg.org/attachments/4a70e63c-2889-4628-b7ed-c17659929bda" width="420" alt="cr/shared-place-1440-dark.png"> shared-place-1440-light.png <img src="https://git.kayg.org/attachments/1eb9459e-59ea-4c38-8ff6-3892520e77b1" width="420" alt="cr/shared-place-1440-light.png"> shared-view-bar-1440-dark.png <img src="https://git.kayg.org/attachments/93bc62f4-771e-4121-8035-1bccab58a8cf" width="420" alt="cr/shared-view-bar-1440-dark.png"> shared-view-bar-1440-light.png <img src="https://git.kayg.org/attachments/6aa5d2c0-c2dd-492f-bd39-0b0d514abf29" width="420" alt="cr/shared-view-bar-1440-light.png"> shared-view-bar-390-dark.png <img src="https://git.kayg.org/attachments/09afc114-e8f6-4383-a33f-775745ff0767" width="420" alt="cr/shared-view-bar-390-dark.png"> shared-view-bar-390-light.png <img src="https://git.kayg.org/attachments/71d388a0-1b72-45b7-9b9a-37e81bddf268" width="420" alt="cr/shared-view-bar-390-light.png"> **WebKit (Playwright WebKit paints no backdrop blur, so judge layout only):** share-sheet-1440-dark.png <img src="https://git.kayg.org/attachments/ddbbc9a9-887d-42e4-b523-09bf22545f27" width="420" alt="wk/share-sheet-1440-dark.png"> share-sheet-1440-light.png <img src="https://git.kayg.org/attachments/390942c4-f152-4a30-a292-7f5a11b0639b" width="420" alt="wk/share-sheet-1440-light.png"> share-sheet-390-dark.png <img src="https://git.kayg.org/attachments/51854271-5411-4fa1-9987-3ac9a768a248" width="420" alt="wk/share-sheet-390-dark.png"> share-sheet-390-light.png <img src="https://git.kayg.org/attachments/31bd7e6c-0b7a-4300-a7b1-fc11aa9f66cc" width="420" alt="wk/share-sheet-390-light.png"> shared-list-390-dark.png <img src="https://git.kayg.org/attachments/043ef497-eefa-49a9-8265-e2913eb0df04" width="420" alt="wk/shared-list-390-dark.png"> shared-note-1440-light.png <img src="https://git.kayg.org/attachments/d20d5c79-70da-4089-b3f4-1acececed89a" width="420" alt="wk/shared-note-1440-light.png"> shared-note-390-dark.png <img src="https://git.kayg.org/attachments/6aecf663-9b29-440e-9ffe-cac18334f212" width="420" alt="wk/shared-note-390-dark.png"> shared-view-bar-390-light.png <img src="https://git.kayg.org/attachments/60357e55-8145-4afa-b982-61bd81ea88bd" width="420" alt="wk/shared-view-bar-390-light.png">

cr-rescue-note-1440-dark.png

722 KiB

cr-rescue-note-1440-light.png

796 KiB

cr-rescue-note-390-dark.png

85 KiB

cr-rescue-note-390-light.png

126 KiB

cr-share-sheet-1440-dark.png

615 KiB

cr-share-sheet-1440-light.png

862 KiB

cr-share-sheet-390-dark.png

95 KiB

cr-share-sheet-390-light.png

174 KiB

cr-shared-history-1440-dark.png

812 KiB

cr-shared-history-1440-light.png

911 KiB

cr-shared-list-1440-dark.png

705 KiB

cr-shared-list-1440-light.png

778 KiB

cr-shared-list-390-dark.png

73 KiB

cr-shared-list-390-light.png

112 KiB

cr-shared-menu-1440-dark.png

734 KiB

cr-shared-menu-1440-light.png

828 KiB

cr-shared-menu-390-dark.png

98 KiB

cr-shared-menu-390-light.png

143 KiB

cr-shared-note-1440-dark.png

704 KiB

cr-shared-note-1440-light.png

778 KiB

cr-shared-note-390-dark.png

62 KiB

cr-shared-note-390-light.png

92 KiB

cr-shared-note-edit-1440-dark.png

723 KiB

cr-shared-note-edit-1440-light.png

802 KiB

cr-shared-note-edit-390-dark.png

72 KiB

cr-shared-note-edit-390-light.png

108 KiB

cr-shared-place-1440-dark.png

775 KiB

cr-shared-place-1440-light.png

777 KiB

cr-shared-view-bar-1440-dark.png

704 KiB

cr-shared-view-bar-1440-light.png

778 KiB

cr-shared-view-bar-390-dark.png

62 KiB

cr-shared-view-bar-390-light.png

92 KiB

mock-mock-01-share-sheet-1440-dark.png

2.8 MiB

mock-mock-01-share-sheet-1440-light.png

3.3 MiB

mock-mock-01-share-sheet-390-dark.png

714 KiB

mock-mock-01-share-sheet-390-light.png

837 KiB

mock-mock-02-shared-with-me-1440-dark.png

1.4 MiB

mock-mock-02-shared-with-me-1440-light.png

1.6 MiB

mock-mock-02-shared-with-me-390-dark.png

159 KiB

mock-mock-02-shared-with-me-390-light.png

190 KiB

mock-mock-03a-shared-note-view-only-1440-dark.png

1.4 MiB

mock-mock-03a-shared-note-view-only-1440-light.png

1.6 MiB

mock-mock-03a-shared-note-view-only-390-dark.png

101 KiB

mock-mock-03a-shared-note-view-only-390-light.png

113 KiB

mock-mock-03b-shared-note-can-edit-1440-dark.png

1.5 MiB

mock-mock-03b-shared-note-can-edit-1440-light.png

1.7 MiB

mock-mock-03b-shared-note-can-edit-390-dark.png

132 KiB

mock-mock-03b-shared-note-can-edit-390-light.png

146 KiB

mock-mock-04-rescue-note-1440-dark.png

1.4 MiB

mock-mock-04-rescue-note-390-dark.png

252 KiB

mock-mock-04-rescue-note-390-light.png

283 KiB

wk-share-sheet-1440-light.png

1.1 MiB

wk-shared-note-1440-light.png

788 KiB

wk-shared-note-390-dark.png

62 KiB

wk-shared-view-bar-390-light.png

92 KiB

wk-shared-list-390-dark.png

72 KiB

mock-mock-04-rescue-note-1440-light.png

1.6 MiB

wk-share-sheet-1440-dark.png

798 KiB

wk-share-sheet-390-light.png

167 KiB

wk-share-sheet-390-dark.png

96 KiB

kayg referenced this pull request

2026-11-09 10:01:45 +00:00

fix(sharing): harden the owner fast path (review of #829/#835) #909

kayg commented

2026-11-09 11:08:13 +00:00

Author

Owner

Gates on `8e2e3a948` (head; the last commits since the shots are spec-only)

gate	where	result
`cargo fmt --all --check`	dev-01, `~/bin/slot`, nix	clean
`cargo clippy --workspace --all-targets --locked -j4 -- -D warnings`	dev-01	clean
`cargo test --locked -j4 -p calternal-core -p calternal-auth -p calternal-notes -p calternal-server -p calternal -p calternal-attachments --no-fail-fast`	dev-01	926 passed, 1 failed: `notes_crash::kill_nine_mid_append_on_a_long_note`. Not reproduced 10× on the branch or 10× on dev → flaky rule; #1023 opened
grant enforcement per entry point (`isolation::grants`, 16 tests incl. the positive case)	dev-01	all pass with cross-owner sharing ON
`svelte-check`	dev-01	only the 4 errors dev `661123e94` had (InsertSheet, TaskCard; fixed on dev by #1024)
`bun run --cwd apps/web test`	dev-01	only dev's `icons.test` (tasks icons, fixed by #1024)
`action-types.mjs --check`	dev-01	ok after the regen (`d0a50787d`)
`admin-sharing.spec`, `CI=1 --workers=1 --retries=0`	dev-01 admin-chromium-1440 / 390	3/3, 3/3 passed
same	dev-02 admin-webkit-1440 / 390	3/3, 3/3 passed
`admin-sharing.spec --repeat-each=5`	dev-01 admin-chromium-1440	11/11 passed
2× shots light/dark vs mockup	both	posted above (#issuecomment-88552)
first paint (`perf/web.sh --bundle-only`)	dev-01	first_js_brotli 222.995 vs dev 221.802 (+1.19 KB), accepted by kayg 11-09, offset by the credits PR; CSS +0.09
perf ABAB ×5 vs dev with a control (contains #909)	perf-01	running since 16:19 IST (perf-turn `sharing-842`); numbers follow

Fixes found by the gates (all on the branch):

The Share sheet needed an idle warm-up. The first press waited for the sheet's chunk, which the tests caught as a missing dialog.
"Add people" moved above the people, with no field fill (approved slice 1).
Review shots now pin the theme, so dark is really dark.
The owner-tooltip check now judges where the tooltip settles.
The spec types the full name: the shared server keeps people from earlier repeats, and the picker shows four matches at most.

## Gates on `8e2e3a948` (head; the last commits since the shots are spec-only) | gate | where | result | |---|---|---| | `cargo fmt --all --check` | dev-01, `~/bin/slot`, nix | clean | | `cargo clippy --workspace --all-targets --locked -j4 -- -D warnings` | dev-01 | clean | | `cargo test --locked -j4 -p calternal-core -p calternal-auth -p calternal-notes -p calternal-server -p calternal -p calternal-attachments --no-fail-fast` | dev-01 | 926 passed, 1 failed: `notes_crash::kill_nine_mid_append_on_a_long_note`. Not reproduced 10× on the branch or 10× on dev → flaky rule; #1023 opened | | grant enforcement per entry point (`isolation::grants`, 16 tests incl. the positive case) | dev-01 | all pass with cross-owner sharing ON | | `svelte-check` | dev-01 | only the 4 errors dev `661123e94` had (InsertSheet, TaskCard; fixed on dev by #1024) | | `bun run --cwd apps/web test` | dev-01 | only dev's `icons.test` (tasks icons, fixed by #1024) | | `action-types.mjs --check` | dev-01 | ok after the regen (`d0a50787d`) | | `admin-sharing.spec`, `CI=1 --workers=1 --retries=0` | dev-01 admin-chromium-1440 / 390 | 3/3, 3/3 passed | | same | dev-02 admin-webkit-1440 / 390 | 3/3, 3/3 passed | | `admin-sharing.spec --repeat-each=5` | dev-01 admin-chromium-1440 | 11/11 passed | | 2× shots light/dark vs mockup | both | posted above (#issuecomment-88552) | | first paint (`perf/web.sh --bundle-only`) | dev-01 | first_js_brotli 222.995 vs dev 221.802 (+1.19 KB), **accepted by kayg 11-09, offset by the credits PR**; CSS +0.09 | | perf ABAB ×5 vs dev with a control (contains #909) | perf-01 | running since 16:19 IST (perf-turn `sharing-842`); numbers follow | Fixes found by the gates (all on the branch): - The Share sheet needed an idle warm-up. The first press waited for the sheet's chunk, which the tests caught as a missing dialog. - "Add people" moved above the people, with no field fill (approved slice 1). - Review shots now pin the theme, so dark is really dark. - The owner-tooltip check now judges where the tooltip settles. - The spec types the full name: the shared server keeps people from earlier repeats, and the picker shows four matches at most.

kayg referenced this pull request

2026-11-09 12:07:24 +00:00

perf(web): first-paint credits for the port stacks #1022

kayg commented

2026-11-09 12:08:38 +00:00

Author

Owner

perf-VM ABAB ×5: #842 head `110314b15` (contains #909) vs dev `661123e94`, with a byte-identical dev control

Setup:

perf-turn ticket sharing-842; perf-01 + perf-02 locks held together, measured on perf-01, 11-09 16:19–17:35 IST.
calternal-perf from dev for every variant: --sizes 10k,100k --runs 4 --cold-runs 0 --idle-secs 0 --seed 1. --runs 4 keeps the turn under 90 minutes.
5 sessions, rotating order.
Binaries: dev = ctl f66e5c90…, head 10b2d476…. Commits after 110314b15 change only specs.
Cells: median of the per-session values [min–max], ms.

size	metric	stat	dev	head842	ctl (control)	head842 vs dev	control vs dev	verdict
10k	sync.save_ack	p50	3.695 [3.660-3.730]	3.700 [3.621-3.726]	3.752 [3.688-3.815]	+0.1%	+1.5%	flat
10k	sync.save_ack	p95	5.081 [4.619-5.474]	5.259 [4.424-5.547]	5.499 [4.781-6.480]	+3.5%	+8.2%	flat
10k	sync.durable_write	p50	24.921 [24.511-25.955]	24.686 [24.322-25.373]	24.942 [24.759-25.357]	-0.9%	+0.1%	flat
10k	sync.durable_write	p95	35.629 [34.666-42.519]	29.332 [28.916-35.059]	30.237 [28.396-38.037]	-17.7%	-15.1%	flat
10k	sync.round_trip	p50	0.216 [0.209-0.225]	0.215 [0.211-0.224]	0.220 [0.212-0.225]	-0.3%	+2.2%	flat
10k	sync.round_trip	p95	0.352 [0.348-0.365]	0.341 [0.336-0.351]	0.349 [0.336-0.369]	-3.1%	-0.9%	flat
10k	storm.typing	p50	2.793 [2.761-2.843]	2.818 [2.755-2.848]	2.800 [2.734-2.846]	+0.9%	+0.3%	flat
10k	storm.typing	p95	2.862 [2.818-4.409]	3.078 [2.894-4.017]	2.958 [2.838-4.306]	+7.5%	+3.3%	flat
10k	storm.save_ack	p50	7.434 [7.310-7.516]	7.395 [7.302-7.488]	7.462 [7.385-7.521]	-0.5%	+0.4%	flat
10k	storm.save_ack	p95	14.908 [14.032-15.680]	14.427 [13.904-15.105]	14.614 [14.177-15.811]	-3.2%	-2.0%	flat
10k	search.query	p50	1.539 [1.443-1.582]	1.583 [1.333-1.657]	1.507 [1.400-1.843]	+2.9%	-2.1%	flat
10k	search.query	p95	4.077 [3.956-4.343]	4.026 [3.909-4.113]	4.251 [4.096-4.509]	-1.2%	+4.3%	flat
10k	search.first_query	p50	3.901 [3.633-4.663]	3.829 [3.405-4.235]	3.940 [3.841-4.327]	-1.8%	+1.0%	flat
10k	search.first_query	p95	29.433 [25.914-34.059]	27.422 [26.875-31.067]	28.189 [27.296-29.140]	-6.8%	-4.2%	flat
10k	open.note	p50	0.740 [0.684-0.752]	0.726 [0.688-0.759]	0.702 [0.683-0.788]	-1.9%	-5.1%	flat
10k	open.note	p95	1.335 [1.293-1.388]	1.329 [1.229-1.380]	1.536 [1.304-2.224]	-0.4%	+15.1%	flat
10k	open.api_get	p50	3.914 [3.795-4.030]	3.963 [3.949-4.252]	3.959 [3.882-4.069]	+1.2%	+1.1%	flat
10k	open.api_get	p95	7.619 [7.302-10.359]	12.023 [11.066-14.300]	8.674 [7.311-10.150]	+57.8%	+13.8%	CHECK
10k	startup.healthz	p50	4.920 [4.839-5.547]	4.855 [4.817-5.086]	4.902 [4.890-5.577]	-1.3%	-0.4%	flat
10k	startup.healthz	p95	7.080 [6.168-10.748]	5.190 [4.992-7.474]	7.880 [6.009-9.397]	-26.7%	+11.3%	flat
10k	home.first_page	p50	2.317 [2.093-2.969]	2.123 [1.846-2.632]	2.231 [2.175-2.665]	-8.4%	-3.7%	flat
10k	home.first_page	p95	2.966 [2.445-4.326]	2.915 [2.329-7.865]	2.845 [2.472-7.582]	-1.8%	-4.1%	flat
10k	journal.catch_up	p50	28.575 [27.988-30.487]	29.394 [27.586-30.937]	30.195 [28.006-30.766]	+2.9%	+5.7%	flat
10k	journal.catch_up	p95	31.321 [30.410-32.766]	31.656 [29.305-32.160]	32.378 [30.830-46.861]	+1.1%	+3.4%	flat
100k	sync.save_ack	p50	3.711 [3.653-3.736]	3.717 [3.674-3.798]	3.707 [3.676-3.743]	+0.2%	-0.1%	flat
100k	sync.save_ack	p95	5.224 [4.719-5.580]	5.260 [4.919-5.565]	4.992 [4.733-5.084]	+0.7%	-4.4%	flat
100k	sync.durable_write	p50	24.795 [24.486-24.983]	24.720 [24.346-24.857]	24.872 [24.779-25.068]	-0.3%	+0.3%	flat
100k	sync.durable_write	p95	31.105 [28.027-34.482]	30.833 [29.331-34.587]	29.363 [28.202-32.008]	-0.9%	-5.6%	flat
100k	sync.round_trip	p50	0.220 [0.209-0.226]	0.214 [0.206-0.245]	0.217 [0.204-0.227]	-2.7%	-1.4%	flat
100k	sync.round_trip	p95	0.353 [0.343-0.384]	0.349 [0.333-0.384]	0.355 [0.339-0.375]	-1.0%	+0.6%	flat
100k	storm.typing	p50	2.806 [2.750-2.903]	2.801 [2.774-2.882]	2.846 [2.730-2.867]	-0.2%	+1.4%	flat
100k	storm.typing	p95	3.007 [2.867-3.568]	2.902 [2.877-2.968]	2.954 [2.877-3.234]	-3.5%	-1.8%	flat
100k	storm.save_ack	p50	7.535 [7.321-7.617]	7.413 [7.359-7.542]	7.425 [7.343-7.657]	-1.6%	-1.5%	flat
100k	storm.save_ack	p95	13.972 [12.569-15.301]	13.682 [13.356-15.102]	14.313 [13.009-15.419]	-2.1%	+2.4%	flat
100k	search.query	p50	1.734 [1.637-1.863]	1.741 [1.549-1.822]	1.692 [1.613-1.817]	+0.4%	-2.4%	flat
100k	search.query	p95	3.772 [3.665-4.196]	3.808 [3.800-4.073]	3.985 [3.731-4.290]	+0.9%	+5.7%	flat
100k	search.first_query	p50	3.960 [3.789-4.132]	4.108 [3.944-4.889]	4.027 [3.922-4.886]	+3.7%	+1.7%	flat
100k	search.first_query	p95	26.728 [25.508-27.740]	27.093 [26.429-34.387]	27.723 [24.880-35.939]	+1.4%	+3.7%	flat
100k	open.note	p50	1.050 [0.886-1.715]	1.066 [1.018-1.179]	1.014 [0.974-1.110]	+1.6%	-3.5%	flat
100k	open.note	p95	3.421 [3.112-3.999]	3.128 [2.900-3.997]	3.126 [2.511-3.342]	-8.6%	-8.6%	flat
100k	open.api_get	p50	4.222 [4.139-4.245]	4.236 [4.161-4.373]	4.274 [4.125-4.312]	+0.3%	+1.2%	flat
100k	open.api_get	p95	7.742 [7.312-10.907]	10.705 [7.818-14.064]	11.342 [9.924-14.131]	+38.3%	+46.5%	flat
100k	startup.healthz	p50	4.879 [4.814-4.926]	5.056 [4.845-6.837]	5.137 [4.981-5.580]	+3.6%	+5.3%	flat
100k	startup.healthz	p95	7.074 [5.100-9.760]	7.101 [6.874-28.272]	7.610 [5.218-11.064]	+0.4%	+7.6%	flat
100k	home.first_page	p50	3.029 [2.792-3.344]	2.940 [2.839-3.704]	2.763 [2.728-3.486]	-2.9%	-8.8%	flat
100k	home.first_page	p95	4.628 [3.690-7.790]	8.234 [6.546-16.380]	4.412 [3.881-9.853]	+77.9%	-4.7%	flat
100k	journal.catch_up	p50	278.285 [274.909-295.639]	275.643 [274.691-288.765]	284.853 [265.082-301.638]	-0.9%	+2.4%	flat
100k	journal.catch_up	p95	287.533 [278.312-349.689]	303.964 [282.468-380.376]	312.176 [285.343-393.489]	+5.7%	+8.6%	flat

Reading.

#909's two questioned rows are flat here: 10k open.note p50 −1.9%, and 100k startup.healthz p95 +0.4% (one 28 ms outlier in the head range, median equal). This run contains #909's code, so #909 is clear.
One row is outside the control: 10k open.api_get p95 12.0 ms vs 7.6 (control 8.7). All five head sessions [11.1–14.3] sit above dev+control [7.3–10.4]. p50 is flat (+1.2%), and max is equal (~45 ms in all three).
- With 24 calls per run, p95 is the second-slowest notes.get, which is a tail figure.
- At 100k the same metric moves +38% for head and +46% for the control, so this p95 is noisy in this harness.
- More to the point, #842 changes nothing on the owner's notes.get path. Its server diff vs #909 is only new action registrations (notes.shared-with-me, notes.hide-shared, the sharing plugin), notes.history with an owner, and the reader's empty sync step in the room.
- My read: tail noise or a binary-layout effect, not code. Under the no-regression rule I'm not calling it flat on my own. #876's turn (it contains #842) runs dev vs #876 next with the same harness, which is a second sample of this row on a different binary.
Everything else is flat or better. That includes saves (sync.*, storm.*), search, open in the editor, the journal and startup.

## perf-VM ABAB ×5: #842 head `110314b15` (contains #909) vs dev `661123e94`, with a byte-identical dev control Setup: - perf-turn ticket `sharing-842`; perf-01 + perf-02 locks held together, measured on perf-01, 11-09 16:19–17:35 IST. - `calternal-perf` from dev for every variant: `--sizes 10k,100k --runs 4 --cold-runs 0 --idle-secs 0 --seed 1`. `--runs 4` keeps the turn under 90 minutes. - 5 sessions, rotating order. - Binaries: dev = ctl `f66e5c90…`, head `10b2d476…`. Commits after `110314b15` change only specs. - Cells: median of the per-session values [min–max], ms. | size | metric | stat | dev | head842 | ctl (control) | head842 vs dev | control vs dev | verdict | |---|---|---|---|---|---|---|---|---| | 10k | sync.save_ack | p50 | 3.695 [3.660-3.730] | 3.700 [3.621-3.726] | 3.752 [3.688-3.815] | +0.1% | +1.5% | flat | | 10k | sync.save_ack | p95 | 5.081 [4.619-5.474] | 5.259 [4.424-5.547] | 5.499 [4.781-6.480] | +3.5% | +8.2% | flat | | 10k | sync.durable_write | p50 | 24.921 [24.511-25.955] | 24.686 [24.322-25.373] | 24.942 [24.759-25.357] | -0.9% | +0.1% | flat | | 10k | sync.durable_write | p95 | 35.629 [34.666-42.519] | 29.332 [28.916-35.059] | 30.237 [28.396-38.037] | -17.7% | -15.1% | flat | | 10k | sync.round_trip | p50 | 0.216 [0.209-0.225] | 0.215 [0.211-0.224] | 0.220 [0.212-0.225] | -0.3% | +2.2% | flat | | 10k | sync.round_trip | p95 | 0.352 [0.348-0.365] | 0.341 [0.336-0.351] | 0.349 [0.336-0.369] | -3.1% | -0.9% | flat | | 10k | storm.typing | p50 | 2.793 [2.761-2.843] | 2.818 [2.755-2.848] | 2.800 [2.734-2.846] | +0.9% | +0.3% | flat | | 10k | storm.typing | p95 | 2.862 [2.818-4.409] | 3.078 [2.894-4.017] | 2.958 [2.838-4.306] | +7.5% | +3.3% | flat | | 10k | storm.save_ack | p50 | 7.434 [7.310-7.516] | 7.395 [7.302-7.488] | 7.462 [7.385-7.521] | -0.5% | +0.4% | flat | | 10k | storm.save_ack | p95 | 14.908 [14.032-15.680] | 14.427 [13.904-15.105] | 14.614 [14.177-15.811] | -3.2% | -2.0% | flat | | 10k | search.query | p50 | 1.539 [1.443-1.582] | 1.583 [1.333-1.657] | 1.507 [1.400-1.843] | +2.9% | -2.1% | flat | | 10k | search.query | p95 | 4.077 [3.956-4.343] | 4.026 [3.909-4.113] | 4.251 [4.096-4.509] | -1.2% | +4.3% | flat | | 10k | search.first_query | p50 | 3.901 [3.633-4.663] | 3.829 [3.405-4.235] | 3.940 [3.841-4.327] | -1.8% | +1.0% | flat | | 10k | search.first_query | p95 | 29.433 [25.914-34.059] | 27.422 [26.875-31.067] | 28.189 [27.296-29.140] | -6.8% | -4.2% | flat | | 10k | open.note | p50 | 0.740 [0.684-0.752] | 0.726 [0.688-0.759] | 0.702 [0.683-0.788] | -1.9% | -5.1% | flat | | 10k | open.note | p95 | 1.335 [1.293-1.388] | 1.329 [1.229-1.380] | 1.536 [1.304-2.224] | -0.4% | +15.1% | flat | | 10k | open.api_get | p50 | 3.914 [3.795-4.030] | 3.963 [3.949-4.252] | 3.959 [3.882-4.069] | +1.2% | +1.1% | flat | | 10k | open.api_get | p95 | 7.619 [7.302-10.359] | 12.023 [11.066-14.300] | 8.674 [7.311-10.150] | +57.8% | +13.8% | CHECK | | 10k | startup.healthz | p50 | 4.920 [4.839-5.547] | 4.855 [4.817-5.086] | 4.902 [4.890-5.577] | -1.3% | -0.4% | flat | | 10k | startup.healthz | p95 | 7.080 [6.168-10.748] | 5.190 [4.992-7.474] | 7.880 [6.009-9.397] | -26.7% | +11.3% | flat | | 10k | home.first_page | p50 | 2.317 [2.093-2.969] | 2.123 [1.846-2.632] | 2.231 [2.175-2.665] | -8.4% | -3.7% | flat | | 10k | home.first_page | p95 | 2.966 [2.445-4.326] | 2.915 [2.329-7.865] | 2.845 [2.472-7.582] | -1.8% | -4.1% | flat | | 10k | journal.catch_up | p50 | 28.575 [27.988-30.487] | 29.394 [27.586-30.937] | 30.195 [28.006-30.766] | +2.9% | +5.7% | flat | | 10k | journal.catch_up | p95 | 31.321 [30.410-32.766] | 31.656 [29.305-32.160] | 32.378 [30.830-46.861] | +1.1% | +3.4% | flat | | 100k | sync.save_ack | p50 | 3.711 [3.653-3.736] | 3.717 [3.674-3.798] | 3.707 [3.676-3.743] | +0.2% | -0.1% | flat | | 100k | sync.save_ack | p95 | 5.224 [4.719-5.580] | 5.260 [4.919-5.565] | 4.992 [4.733-5.084] | +0.7% | -4.4% | flat | | 100k | sync.durable_write | p50 | 24.795 [24.486-24.983] | 24.720 [24.346-24.857] | 24.872 [24.779-25.068] | -0.3% | +0.3% | flat | | 100k | sync.durable_write | p95 | 31.105 [28.027-34.482] | 30.833 [29.331-34.587] | 29.363 [28.202-32.008] | -0.9% | -5.6% | flat | | 100k | sync.round_trip | p50 | 0.220 [0.209-0.226] | 0.214 [0.206-0.245] | 0.217 [0.204-0.227] | -2.7% | -1.4% | flat | | 100k | sync.round_trip | p95 | 0.353 [0.343-0.384] | 0.349 [0.333-0.384] | 0.355 [0.339-0.375] | -1.0% | +0.6% | flat | | 100k | storm.typing | p50 | 2.806 [2.750-2.903] | 2.801 [2.774-2.882] | 2.846 [2.730-2.867] | -0.2% | +1.4% | flat | | 100k | storm.typing | p95 | 3.007 [2.867-3.568] | 2.902 [2.877-2.968] | 2.954 [2.877-3.234] | -3.5% | -1.8% | flat | | 100k | storm.save_ack | p50 | 7.535 [7.321-7.617] | 7.413 [7.359-7.542] | 7.425 [7.343-7.657] | -1.6% | -1.5% | flat | | 100k | storm.save_ack | p95 | 13.972 [12.569-15.301] | 13.682 [13.356-15.102] | 14.313 [13.009-15.419] | -2.1% | +2.4% | flat | | 100k | search.query | p50 | 1.734 [1.637-1.863] | 1.741 [1.549-1.822] | 1.692 [1.613-1.817] | +0.4% | -2.4% | flat | | 100k | search.query | p95 | 3.772 [3.665-4.196] | 3.808 [3.800-4.073] | 3.985 [3.731-4.290] | +0.9% | +5.7% | flat | | 100k | search.first_query | p50 | 3.960 [3.789-4.132] | 4.108 [3.944-4.889] | 4.027 [3.922-4.886] | +3.7% | +1.7% | flat | | 100k | search.first_query | p95 | 26.728 [25.508-27.740] | 27.093 [26.429-34.387] | 27.723 [24.880-35.939] | +1.4% | +3.7% | flat | | 100k | open.note | p50 | 1.050 [0.886-1.715] | 1.066 [1.018-1.179] | 1.014 [0.974-1.110] | +1.6% | -3.5% | flat | | 100k | open.note | p95 | 3.421 [3.112-3.999] | 3.128 [2.900-3.997] | 3.126 [2.511-3.342] | -8.6% | -8.6% | flat | | 100k | open.api_get | p50 | 4.222 [4.139-4.245] | 4.236 [4.161-4.373] | 4.274 [4.125-4.312] | +0.3% | +1.2% | flat | | 100k | open.api_get | p95 | 7.742 [7.312-10.907] | 10.705 [7.818-14.064] | 11.342 [9.924-14.131] | +38.3% | +46.5% | flat | | 100k | startup.healthz | p50 | 4.879 [4.814-4.926] | 5.056 [4.845-6.837] | 5.137 [4.981-5.580] | +3.6% | +5.3% | flat | | 100k | startup.healthz | p95 | 7.074 [5.100-9.760] | 7.101 [6.874-28.272] | 7.610 [5.218-11.064] | +0.4% | +7.6% | flat | | 100k | home.first_page | p50 | 3.029 [2.792-3.344] | 2.940 [2.839-3.704] | 2.763 [2.728-3.486] | -2.9% | -8.8% | flat | | 100k | home.first_page | p95 | 4.628 [3.690-7.790] | 8.234 [6.546-16.380] | 4.412 [3.881-9.853] | +77.9% | -4.7% | flat | | 100k | journal.catch_up | p50 | 278.285 [274.909-295.639] | 275.643 [274.691-288.765] | 284.853 [265.082-301.638] | -0.9% | +2.4% | flat | | 100k | journal.catch_up | p95 | 287.533 [278.312-349.689] | 303.964 [282.468-380.376] | 312.176 [285.343-393.489] | +5.7% | +8.6% | flat | **Reading.** - #909's two questioned rows are **flat** here: 10k `open.note` p50 −1.9%, and 100k `startup.healthz` p95 +0.4% (one 28 ms outlier in the head range, median equal). This run contains #909's code, so #909 is clear. - **One row is outside the control: 10k `open.api_get` p95** 12.0 ms vs 7.6 (control 8.7). All five head sessions [11.1–14.3] sit above dev+control [7.3–10.4]. p50 is flat (+1.2%), and max is equal (~45 ms in all three). - With 24 calls per run, p95 is the second-slowest `notes.get`, which is a tail figure. - At 100k the same metric moves +38% for head and **+46% for the control**, so this p95 is noisy in this harness. - More to the point, #842 changes nothing on the owner's `notes.get` path. Its server diff vs #909 is only new action registrations (`notes.shared-with-me`, `notes.hide-shared`, the sharing plugin), `notes.history` with an owner, and the reader's empty sync step in the room. - My read: tail noise or a binary-layout effect, not code. Under the no-regression rule I'm not calling it flat on my own. **#876's turn (it contains #842) runs dev vs #876 next with the same harness**, which is a second sample of this row on a different binary. - Everything else is flat or better. That includes saves (`sync.*`, `storm.*`), search, open in the editor, the journal and startup.

kayg referenced this pull request

2026-11-09 12:08:58 +00:00

fix(sharing): harden the owner fast path (review of #829/#835) #909

kayg referenced this pull request

2026-11-09 12:09:10 +00:00

Sharing slice 1 follow-up: durable offline recovery and lifecycle controls #876

kayg changed target branch from fix/sharing-fast-path-hardening to dev

2026-11-09 12:18:20 +00:00

kayg commented

2026-11-09 12:56:32 +00:00

Author

Owner

Re-measure (orchestrator's option b): 10k, dev / head / control, ABAB ×5, perf-turn `sharing-842b`, 17:58–18:25 IST

Same binaries as before (dev = ctl f66e5c90…, head 10b2d476…), --sizes 10k --runs 4. The harness has no open-only switch, so every scenario ran at 10k.

size	metric	stat	dev	head842	ctl (control)	head842 vs dev	control vs dev	verdict
10k	sync.save_ack	p50	3.695 [3.645-3.725]	3.705 [3.642-3.796]	3.722 [3.686-3.768]	+0.3%	+0.7%	flat
10k	sync.save_ack	p95	5.218 [4.672-5.558]	5.007 [4.587-9.177]	5.422 [4.588-6.814]	-4.0%	+3.9%	flat
10k	sync.durable_write	p50	24.787 [24.575-24.908]	24.538 [24.420-24.778]	24.397 [23.925-25.327]	-1.0%	-1.6%	flat
10k	sync.durable_write	p95	30.503 [28.429-32.749]	31.625 [28.752-37.434]	30.399 [27.282-33.913]	+3.7%	-0.3%	flat
10k	sync.round_trip	p50	0.214 [0.206-0.229]	0.210 [0.204-0.215]	0.213 [0.205-0.219]	-1.9%	-0.4%	flat
10k	sync.round_trip	p95	0.337 [0.329-0.378]	0.347 [0.340-0.349]	0.341 [0.335-0.366]	+2.9%	+1.4%	flat
10k	storm.typing	p50	2.764 [2.722-2.800]	2.783 [2.727-2.835]	2.768 [2.734-2.834]	+0.7%	+0.2%	flat
10k	storm.typing	p95	2.940 [2.797-3.410]	2.830 [2.770-4.382]	2.934 [2.852-3.059]	-3.8%	-0.2%	flat
10k	storm.save_ack	p50	7.315 [7.274-7.368]	7.395 [7.238-7.497]	7.382 [7.318-7.437]	+1.1%	+0.9%	flat
10k	storm.save_ack	p95	14.417 [13.371-15.670]	14.066 [12.863-16.218]	14.108 [13.735-14.292]	-2.4%	-2.1%	flat
10k	search.query	p50	1.488 [1.358-1.613]	1.417 [1.353-1.731]	1.504 [1.341-1.536]	-4.8%	+1.1%	flat
10k	search.query	p95	4.133 [3.714-4.310]	3.875 [3.679-4.195]	4.050 [3.810-4.130]	-6.3%	-2.0%	flat
10k	search.first_query	p50	3.907 [3.537-5.818]	3.936 [3.594-4.215]	3.977 [3.716-4.608]	+0.7%	+1.8%	flat
10k	search.first_query	p95	26.985 [26.127-32.078]	26.796 [26.415-31.439]	28.751 [26.322-35.393]	-0.7%	+6.5%	flat
10k	open.note	p50	0.753 [0.704-0.810]	0.722 [0.676-0.769]	0.721 [0.684-0.752]	-4.1%	-4.2%	flat
10k	open.note	p95	1.443 [1.279-1.646]	1.376 [1.356-1.612]	1.322 [1.157-1.438]	-4.7%	-8.4%	flat
10k	open.api_get	p50	3.928 [3.876-4.143]	3.901 [3.861-4.008]	3.947 [3.880-3.998]	-0.7%	+0.5%	flat
10k	open.api_get	p95	8.842 [7.537-11.558]	10.635 [7.447-12.921]	7.977 [7.156-12.259]	+20.3%	-9.8%	flat
10k	startup.healthz	p50	4.930 [4.823-5.096]	4.846 [4.777-7.859]	4.842 [4.775-5.013]	-1.7%	-1.8%	flat
10k	startup.healthz	p95	8.278 [5.561-9.322]	7.724 [4.959-9.789]	8.110 [7.723-8.452]	-6.7%	-2.0%	flat
10k	home.first_page	p50	2.462 [2.266-2.684]	2.193 [1.992-3.425]	2.258 [1.855-2.703]	-10.9%	-8.3%	flat
10k	home.first_page	p95	4.406 [2.512-6.257]	5.974 [2.351-6.184]	3.907 [2.521-9.832]	+35.6%	-11.3%	flat
10k	journal.catch_up	p50	27.668 [26.588-28.659]	27.854 [26.844-29.433]	28.583 [27.544-28.944]	+0.7%	+3.3%	flat
10k	journal.catch_up	p95	31.337 [29.042-47.329]	31.576 [28.841-33.188]	31.340 [29.272-35.172]	+0.8%	+0.0%	flat

open.api_get p95 per session: dev [7.54, 8.84, 8.07, 11.06, 11.56], head [7.45, 11.06, 10.63, 7.74, 12.92], control [12.26, 7.74, 7.98, 8.13, 7.16]. The head range overlaps both dev and the control; dev itself reaches 11.6 and the control 12.3. That fits a 24-sample tail (p95 ≈ the second-slowest call) on a path this PR doesn't change. No row is outside the control.

READY FOR MERGE: head `479df9153` (merged with dev `3f079de39`, which has #909)

Gates on the merged head:

gate	result
fmt / clippy `-D warnings`	clean / clean
Rust tests (core, auth, notes, server, calternal, attachments)	927 passed, 0 failed
svelte-check / `action-types --check` / web unit / editor check	0 errors / ok / pass / pass
bundle gate (`perf/web.sh --bundle-only --gate`)	pass: first_js 222.991 KB (+1.19 over dev, kayg-approved, offset by credits), CSS 17.791
`admin-sharing.spec` + `admin.spec`, Chromium 1440/390, WebKit 1440/390	10/10 on all four
perf	flat (this comment + #issuecomment-88749)
2× shots vs mockup	#issuecomment-88552

🤖 Generated with Claude Code

## Re-measure (orchestrator's option b): 10k, dev / head / control, ABAB ×5, perf-turn `sharing-842b`, 17:58–18:25 IST Same binaries as before (dev = ctl `f66e5c90…`, head `10b2d476…`), `--sizes 10k --runs 4`. The harness has no open-only switch, so every scenario ran at 10k. | size | metric | stat | dev | head842 | ctl (control) | head842 vs dev | control vs dev | verdict | |---|---|---|---|---|---|---|---|---| | 10k | sync.save_ack | p50 | 3.695 [3.645-3.725] | 3.705 [3.642-3.796] | 3.722 [3.686-3.768] | +0.3% | +0.7% | flat | | 10k | sync.save_ack | p95 | 5.218 [4.672-5.558] | 5.007 [4.587-9.177] | 5.422 [4.588-6.814] | -4.0% | +3.9% | flat | | 10k | sync.durable_write | p50 | 24.787 [24.575-24.908] | 24.538 [24.420-24.778] | 24.397 [23.925-25.327] | -1.0% | -1.6% | flat | | 10k | sync.durable_write | p95 | 30.503 [28.429-32.749] | 31.625 [28.752-37.434] | 30.399 [27.282-33.913] | +3.7% | -0.3% | flat | | 10k | sync.round_trip | p50 | 0.214 [0.206-0.229] | 0.210 [0.204-0.215] | 0.213 [0.205-0.219] | -1.9% | -0.4% | flat | | 10k | sync.round_trip | p95 | 0.337 [0.329-0.378] | 0.347 [0.340-0.349] | 0.341 [0.335-0.366] | +2.9% | +1.4% | flat | | 10k | storm.typing | p50 | 2.764 [2.722-2.800] | 2.783 [2.727-2.835] | 2.768 [2.734-2.834] | +0.7% | +0.2% | flat | | 10k | storm.typing | p95 | 2.940 [2.797-3.410] | 2.830 [2.770-4.382] | 2.934 [2.852-3.059] | -3.8% | -0.2% | flat | | 10k | storm.save_ack | p50 | 7.315 [7.274-7.368] | 7.395 [7.238-7.497] | 7.382 [7.318-7.437] | +1.1% | +0.9% | flat | | 10k | storm.save_ack | p95 | 14.417 [13.371-15.670] | 14.066 [12.863-16.218] | 14.108 [13.735-14.292] | -2.4% | -2.1% | flat | | 10k | search.query | p50 | 1.488 [1.358-1.613] | 1.417 [1.353-1.731] | 1.504 [1.341-1.536] | -4.8% | +1.1% | flat | | 10k | search.query | p95 | 4.133 [3.714-4.310] | 3.875 [3.679-4.195] | 4.050 [3.810-4.130] | -6.3% | -2.0% | flat | | 10k | search.first_query | p50 | 3.907 [3.537-5.818] | 3.936 [3.594-4.215] | 3.977 [3.716-4.608] | +0.7% | +1.8% | flat | | 10k | search.first_query | p95 | 26.985 [26.127-32.078] | 26.796 [26.415-31.439] | 28.751 [26.322-35.393] | -0.7% | +6.5% | flat | | 10k | open.note | p50 | 0.753 [0.704-0.810] | 0.722 [0.676-0.769] | 0.721 [0.684-0.752] | -4.1% | -4.2% | flat | | 10k | open.note | p95 | 1.443 [1.279-1.646] | 1.376 [1.356-1.612] | 1.322 [1.157-1.438] | -4.7% | -8.4% | flat | | 10k | open.api_get | p50 | 3.928 [3.876-4.143] | 3.901 [3.861-4.008] | 3.947 [3.880-3.998] | -0.7% | +0.5% | flat | | 10k | open.api_get | p95 | 8.842 [7.537-11.558] | 10.635 [7.447-12.921] | 7.977 [7.156-12.259] | +20.3% | -9.8% | flat | | 10k | startup.healthz | p50 | 4.930 [4.823-5.096] | 4.846 [4.777-7.859] | 4.842 [4.775-5.013] | -1.7% | -1.8% | flat | | 10k | startup.healthz | p95 | 8.278 [5.561-9.322] | 7.724 [4.959-9.789] | 8.110 [7.723-8.452] | -6.7% | -2.0% | flat | | 10k | home.first_page | p50 | 2.462 [2.266-2.684] | 2.193 [1.992-3.425] | 2.258 [1.855-2.703] | -10.9% | -8.3% | flat | | 10k | home.first_page | p95 | 4.406 [2.512-6.257] | 5.974 [2.351-6.184] | 3.907 [2.521-9.832] | +35.6% | -11.3% | flat | | 10k | journal.catch_up | p50 | 27.668 [26.588-28.659] | 27.854 [26.844-29.433] | 28.583 [27.544-28.944] | +0.7% | +3.3% | flat | | 10k | journal.catch_up | p95 | 31.337 [29.042-47.329] | 31.576 [28.841-33.188] | 31.340 [29.272-35.172] | +0.8% | +0.0% | flat | **`open.api_get` p95 per session:** dev [7.54, 8.84, 8.07, 11.06, 11.56], head [7.45, 11.06, 10.63, 7.74, 12.92], control [12.26, 7.74, 7.98, 8.13, 7.16]. The head range overlaps both dev and the control; dev itself reaches 11.6 and the control 12.3. That fits a 24-sample tail (p95 ≈ the second-slowest call) on a path this PR doesn't change. **No row is outside the control.** ## READY FOR MERGE: head `479df9153` (merged with dev `3f079de39`, which has #909) Gates on the merged head: | gate | result | |---|---| | fmt / clippy `-D warnings` | clean / clean | | Rust tests (core, auth, notes, server, calternal, attachments) | 927 passed, 0 failed | | svelte-check / `action-types --check` / web unit / editor check | 0 errors / ok / pass / pass | | bundle gate (`perf/web.sh --bundle-only --gate`) | pass: first_js 222.991 KB (+1.19 over dev, kayg-approved, offset by credits), CSS 17.791 | | `admin-sharing.spec` + `admin.spec`, Chromium 1440/390, WebKit 1440/390 | 10/10 on all four | | perf | flat (this comment + #issuecomment-88749) | | 2× shots vs mockup | #issuecomment-88552 | 🤖 Generated with [Claude Code](https://claude.com/claude-code)

kayg commented

2026-11-09 13:36:31 +00:00

Author

Owner

Cross-cutting + navigation specs vs dev `3f079de39` (merge gate from train #1026)

Specs: preload lazy-ui lazy-offline glass shortcuts switching list-chrome list-fit sidebar-edge pane-transition note-pills note-bars tabs, CI=1 --workers=1 --retries=0, compared by test title. #842 at 479df9153; the fix below is 1f018f69a.

project	#842	dev	new on #842
chromium-1440	50 passed, 0 failed, 40 skipped	50 passed, 0 failed, 40 skipped	none
chromium-390	58 passed, 8 failed, 24 skipped	60 passed, 6 failed, 24 skipped	`preload:118` ×2 (palette Control/Meta) → fixed in `1f018f69a`, see below
webkit-1440	48 passed, 0 failed, 42 skipped	48 passed, 0 failed, 42 skipped	none
webkit-390	57 passed, 7 failed, 26 skipped	59 passed, 5 failed, 26 skipped	`preload:118` ×2 → fixed in `1f018f69a`

preload:118. The palette's modifier intent fetched Palette and page-dim. page-dim (the dim behind a sheet) is now shared by the Palette and the Share sheet, so the bundler gives it its own 0.12 KB chunk. It's a dependency of the Palette, the same way the test already lets dates ride along; it isn't a second screen prepared early. The test now allows it, with the reason in the comment.
preload.spec rerun at 1f018f69a: chromium-1440 9 passed; chromium-390 8 passed, 3 failed; webkit-1440 9 passed; webkit-390 8 passed, 3 failed. The 3 failures are dev's known preload:89 phone Search reds, so there are no new failures.

The other failures common to both branches are dev's known phone reds from #1026: glass:76, lazy-ui:70, lazy-offline:3 and preload:89 ×3.

Shots at the current head (`479df9153`, Chromium 2×)

Add people is above the people and the field has no fill. One observation for the glass owners: at 390 the bottom bar's icons read faintly through the sheet's glass. That's the shared glass's read-through; this PR doesn't change it.

share-sheet-1440-dark.png

share-sheet-1440-light.png

share-sheet-390-dark.png

share-sheet-390-light.png

shared-note-1440-dark.png

shared-note-1440-light.png

shared-view-bar-390-dark.png

shared-view-bar-390-light.png

## Cross-cutting + navigation specs vs dev `3f079de39` (merge gate from train #1026) Specs: `preload lazy-ui lazy-offline glass shortcuts switching list-chrome list-fit sidebar-edge pane-transition note-pills note-bars tabs`, `CI=1 --workers=1 --retries=0`, compared by test title. #842 at `479df9153`; the fix below is `1f018f69a`. | project | #842 | dev | new on #842 | |---|---|---|---| | chromium-1440 | 50 passed, 0 failed, 40 skipped | 50 passed, 0 failed, 40 skipped | none | | chromium-390 | 58 passed, 8 failed, 24 skipped | 60 passed, 6 failed, 24 skipped | `preload:118` ×2 (palette Control/Meta) → **fixed in `1f018f69a`**, see below | | webkit-1440 | 48 passed, 0 failed, 42 skipped | 48 passed, 0 failed, 42 skipped | none | | webkit-390 | 57 passed, 7 failed, 26 skipped | 59 passed, 5 failed, 26 skipped | `preload:118` ×2 → **fixed in `1f018f69a`** | **`preload:118`.** The palette's modifier intent fetched `Palette` **and** `page-dim`. `page-dim` (the dim behind a sheet) is now shared by the Palette and the Share sheet, so the bundler gives it its own 0.12 KB chunk. It's a dependency of the Palette, the same way the test already lets `dates` ride along; it isn't a second screen prepared early. The test now allows it, with the reason in the comment. `preload.spec` rerun at `1f018f69a`: chromium-1440 9 passed; chromium-390 8 passed, 3 failed; webkit-1440 9 passed; webkit-390 8 passed, 3 failed. The 3 failures are dev's known `preload:89` phone Search reds, so there are **no new failures**. The other failures common to both branches are dev's known phone reds from #1026: glass:76, lazy-ui:70, lazy-offline:3 and preload:89 ×3. ## Shots at the current head (`479df9153`, Chromium 2×) Add people is above the people and the field has no fill. One observation for the glass owners: at 390 the bottom bar's icons read faintly through the sheet's glass. That's the shared glass's read-through; this PR doesn't change it. share-sheet-1440-dark.png <img src="https://git.kayg.org/attachments/df9810ff-22bc-4934-994d-937671fc72be" width="380"> share-sheet-1440-light.png <img src="https://git.kayg.org/attachments/019bedb6-2ba3-459c-bc86-ea5f75b330f9" width="380"> share-sheet-390-dark.png <img src="https://git.kayg.org/attachments/042839c1-83de-4688-b395-c0f5acce45e0" width="380"> share-sheet-390-light.png <img src="https://git.kayg.org/attachments/d865dac1-ebcd-4bf6-a615-2d042380da9e" width="380"> shared-note-1440-dark.png <img src="https://git.kayg.org/attachments/b8f95aed-9d58-4233-adce-4fa9057caa62" width="380"> shared-note-1440-light.png <img src="https://git.kayg.org/attachments/2667193f-76e9-42a6-b596-589d8f264bce" width="380"> shared-view-bar-390-dark.png <img src="https://git.kayg.org/attachments/506e7c62-484f-4835-9434-a9eb79972f40" width="380"> shared-view-bar-390-light.png <img src="https://git.kayg.org/attachments/bd59f959-0052-4c0b-9d61-1c0dbc1fd453" width="380">

head-share-sheet-1440-dark.png

615 KiB

head-share-sheet-1440-light.png

842 KiB

head-share-sheet-390-dark.png

93 KiB

head-share-sheet-390-light.png

174 KiB

head-shared-note-1440-dark.png

699 KiB

head-shared-note-1440-light.png

760 KiB

head-shared-view-bar-390-dark.png

60 KiB

head-shared-view-bar-390-light.png

93 KiB

kayg commented

2026-11-09 13:40:12 +00:00

Author

Owner

`preload:118` fixed in the build, not the test: head `1a05bbe1f`

The test allowance is reverted (bc596aa9a), so preload.spec is the same as on dev.
page-dim joins the small dates chunk (apps/web/vite.config.ts), the same fix #1029 made for the phrase reader. A Control/Meta intent fetches the palette's own set again: Palette + dates. The Share sheet fetches that small chunk with its own.
Budgets: the page-dim line is gone, and dates 1.48 → 1.63. The total is unchanged (512.88 = sum of the lines).

gate (head `1a05bbe1f`)	result
`perf/web.sh --bundle-only --gate`	pass: first_js_brotli 222.909 KB (−0.08 vs before), CSS 17.791, `dates` 1.578
`preload.spec` chromium-1440 / webkit-1440	9 passed / 9 passed
`preload.spec` chromium-390 / webkit-390	8 passed + `preload:89` ×3 failing, as on dev `3f079de39` (known #1026 phone reds); `preload:118` passes

Everything else in #issuecomment-88850 stands. There are no new failures vs dev on the cross-cutting and navigation set.

## `preload:118` fixed in the build, not the test: head `1a05bbe1f` - The test allowance is reverted (`bc596aa9a`), so `preload.spec` is the same as on dev. - `page-dim` joins the small `dates` chunk (`apps/web/vite.config.ts`), the same fix #1029 made for the phrase reader. A Control/Meta intent fetches the palette's own set again: `Palette` + `dates`. The Share sheet fetches that small chunk with its own. - Budgets: the `page-dim` line is gone, and `dates` 1.48 → 1.63. The total is unchanged (512.88 = sum of the lines). | gate (head `1a05bbe1f`) | result | |---|---| | `perf/web.sh --bundle-only --gate` | pass: first_js_brotli 222.909 KB (−0.08 vs before), CSS 17.791, `dates` 1.578 | | `preload.spec` chromium-1440 / webkit-1440 | 9 passed / 9 passed | | `preload.spec` chromium-390 / webkit-390 | 8 passed + `preload:89` ×3 failing, as on dev 3f079de39 (known #1026 phone reds); **`preload:118` passes** | Everything else in #issuecomment-88850 stands. There are no new failures vs dev on the cross-cutting and navigation set.

kayg commented

2026-11-09 13:47:58 +00:00

Author

Owner

Invite a friend: first test after deploy (kayg)

What to do, and what you should see at each step. It assumes #842 (sharing) is deployed. #1025 (invite defaults: 1 GB, group preselect, Groups hint) lands with the same train or the next; until then the invite starts at Unlimited and has no hint.

0. One-time setup (recommended). Settings → Admin → Groups → make a group, e.g. "Friends", and put yourself in it.
Why: a person sees only people who share a group with them (admins see everyone). You can always share to a friend. For the friend to find you in "Add people" (to share back), you both need a common group.

1. Invite. Settings → Admin → People → Invite someone.

The sheet grows out of the button.
With #1025: storage starts at 1 GB, and if "Friends" is your only group it's already picked; if you have no group, an accent line reads "Put friends in a group so they can find each other."
The link expires after 7 days, and you can change that.
Create shows the link once, with Copy, QR and Share. Send it to your friend.
"Invites waiting" then lists it as "Friends · Expires in 7 days · 1 GB", with Copy again and Revoke.

2. Your friend redeems. They open the link on their phone or laptop.

They see "You're invited. Choose your name, then make a passkey." with a Your name field.
They type their name and tap Create passkey. The device asks for Face ID, Touch ID or the device PIN, and they land in their own empty Journal.
No password, no email. The link works once.
Expect: the invite leaves your "Invites waiting", and they appear in People as a member with "0 B of 1 GB".

3. Share a note. Open one of your notes and press Share in the top-right pill.

Wide screen: the pill is [Share ⋯] at the card's top right. Phone: it's the top-right pill.
The sheet says "Only you can see this."
Type their name in Add people and pick them. The sentence becomes "‹Name› can view."
Switch their row to Can edit: "‹Name› can edit."
The × removes them.

4. Your friend sees it.

A Shared with me place appears in their sidebar, with an accent dot.
The row says "Shared by kayg".
Opening it clears the dot. Where Share would be, the pill shows your avatar, with a lock if it's view-only. Hover says "Shared by kayg · Can edit"; tapping opens a small menu ("kayg shared this with you", "Remove me").
View-only: no Write, Insert, Style or Attach in the bar, and typing does nothing.

5. Your friend edits, and you see it.

With Can edit, their typing shows up in your open note live, the same way your own two devices sync.
Note info → history names who changed what.
Live cursors are not in this slice.

6. Ending a share (optional check). Remove them in the Share sheet.

The note leaves their Shared with me right away.
If they had edits the server hadn't got yet (e.g. offline at that moment), their device keeps them in a new note of their own, "Your edits to ‹title›". Its first line says "Kept when kayg stopped sharing." (The fully durable offline version is #876, coming next.)

If something looks off: take a screenshot, and note the time (IST) and which step. Every access check is on the server, so a wrong-looking UI never means the wrong person can read the note.

## Invite a friend: first test after deploy (kayg) What to do, and what you should see at each step. It assumes #842 (sharing) is deployed. **#1025** (invite defaults: 1 GB, group preselect, Groups hint) lands with the same train or the next; until then the invite starts at Unlimited and has no hint. **0. One-time setup (recommended).** Settings → Admin → **Groups** → make a group, e.g. "Friends", and put yourself in it. Why: a person sees only people who share a group with them (admins see everyone). You can always share *to* a friend. For the friend to find *you* in "Add people" (to share back), you both need a common group. **1. Invite.** Settings → Admin → **People** → **Invite someone**. - The sheet grows out of the button. - With #1025: storage starts at **1 GB**, and if "Friends" is your only group it's already picked; if you have no group, an accent line reads "Put friends in a group so they can find each other." - The link expires after 7 days, and you can change that. - **Create** shows the link once, with **Copy**, **QR** and **Share**. Send it to your friend. - "Invites waiting" then lists it as "Friends · Expires in 7 days · 1 GB", with Copy again and Revoke. **2. Your friend redeems.** They open the link on their phone or laptop. - They see "You're invited. Choose your name, then make a passkey." with a **Your name** field. - They type their name and tap **Create passkey**. The device asks for Face ID, Touch ID or the device PIN, and they land in their own empty Journal. - No password, no email. The link works once. - Expect: the invite leaves your "Invites waiting", and they appear in **People** as a member with "0 B of 1 GB". **3. Share a note.** Open one of your notes and press **Share** in the top-right pill. - Wide screen: the pill is [Share ⋯] at the card's top right. Phone: it's the top-right pill. - The sheet says "Only you can see this." - Type their name in **Add people** and pick them. The sentence becomes "‹Name› can view." - Switch their row to **Can edit**: "‹Name› can edit." - The × removes them. **4. Your friend sees it.** - A **Shared with me** place appears in their sidebar, with an accent dot. - The row says "Shared by kayg". - Opening it clears the dot. Where Share would be, the pill shows your **avatar**, with a lock if it's view-only. Hover says "Shared by kayg · Can edit"; tapping opens a small menu ("kayg shared this with you", "Remove me"). - View-only: no Write, Insert, Style or Attach in the bar, and typing does nothing. **5. Your friend edits, and you see it.** - With Can edit, their typing shows up in your open note live, the same way your own two devices sync. - Note info → history names who changed what. - Live cursors are not in this slice. **6. Ending a share (optional check).** Remove them in the Share sheet. - The note leaves their Shared with me right away. - If they had edits the server hadn't got yet (e.g. offline at that moment), their device keeps them in a new note of their own, **"Your edits to ‹title›"**. Its first line says "Kept when kayg stopped sharing." (The fully durable offline version is #876, coming next.) **If something looks off:** take a screenshot, and note the time (IST) and which step. Every access check is on the server, so a wrong-looking UI never means the wrong person can read the note.

kayg referenced this pull request

2026-11-09 14:46:52 +00:00

Sharing slice 1 follow-up: durable offline recovery and lifecycle controls #876

kayg referenced this pull request

2026-11-09 16:00:15 +00:00

fix(web): desk Share loads the sheet on press; sheet helpers in their own chunk (lazy-offline red from #842) #1036

kayg referenced this pull request

2026-11-09 16:32:23 +00:00

Sharing slice 1 follow-up: durable offline recovery and lifecycle controls #876

kayg referenced this pull request

2026-11-09 18:53:14 +00:00

Housekeeping 2026-11-09 night #1045

kayg commented

2026-11-09 18:55:06 +00:00

Author

Owner

Merged into dev locally (head 1a05bbe1f is in origin/dev); closing.

Merged into dev locally (head `1a05bbe1f` is in origin/dev); closing.

kayg closed this pull request

2026-11-09 18:55:06 +00:00

CI / server (pull_request) Has been cancelled

Details

CI / rust (pull_request) Has been cancelled

Details

CI / web (pull_request) Has been cancelled

Details

Markdown extraction contract / markdown-native-contract (pull_request) Has been cancelled

Details

Markdown extraction contract / markdown-editor-contract (pull_request) Has been cancelled

Details

Pull request closed

Please reopen this pull request to perform a merge.

Rows
Columns

Sharing slice 1, PR 3: UI (float toolbar, Shared with me, view-only), switch removed #842

What it does

First paint (kayg 11-09)

Decisions

Risks

Screenshots: app (Chromium, 2×) next to the approved mockup (review/calendar-2 ?slice=1, 2×)

Gates on 8e2e3a948 (head; the last commits since the shots are spec-only)

perf-VM ABAB ×5: #842 head 110314b15 (contains #909) vs dev 661123e94, with a byte-identical dev control

Re-measure (orchestrator's option b): 10k, dev / head / control, ABAB ×5, perf-turn sharing-842b, 17:58–18:25 IST

READY FOR MERGE: head 479df9153 (merged with dev 3f079de39, which has #909)

Cross-cutting + navigation specs vs dev 3f079de39 (merge gate from train #1026)

Shots at the current head (479df9153, Chromium 2×)

preload:118 fixed in the build, not the test: head 1a05bbe1f

Invite a friend: first test after deploy (kayg)

Pull request closed

Screenshots: app (Chromium, 2×) next to the approved mockup (review/calendar-2 `?slice=1`, 2×)

Gates on `8e2e3a948` (head; the last commits since the shots are spec-only)

perf-VM ABAB ×5: #842 head `110314b15` (contains #909) vs dev `661123e94`, with a byte-identical dev control

Re-measure (orchestrator's option b): 10k, dev / head / control, ABAB ×5, perf-turn `sharing-842b`, 17:58–18:25 IST

READY FOR MERGE: head `479df9153` (merged with dev `3f079de39`, which has #909)

Cross-cutting + navigation specs vs dev `3f079de39` (merge gate from train #1026)

Shots at the current head (`479df9153`, Chromium 2×)

`preload:118` fixed in the build, not the test: head `1a05bbe1f`