Per-account canvas document: server storage and live sync by operations (D178, D180) #98
Open
opened 2026-10-08 11:54:20 +00:00 by kayg
·
193 comments
No Branch/Tag specified
main
j470b-server-mesh-rejoin
mesh-compat-382
j444b-d381-key-wins-flood
j461b-macos-utun-reader-thread
j475b-remove-host-motion
fix-reconnect-new-link
j481-d380
dev
j479-mesh-soak
fix/j476-host-facts
j475-motion-pill-split
j470-mac-node-join
root-upgrade-d376
j474-review-merge
latency-targets-120hz
nightly-suite-shards
gotatun-pin-j469
macos-utun-reader-thread
fix-flood-echo-stall
wip/j416
motion-fast-ease-out
mesh-addhost-j259
takeover-close-terminals-d368
kbd-instant-followups
fix-trust-key-double-click
nightly-suite-partial-report
appwin-icons-j207
rusqlite-slice1
swipe-content-first-d374
mesh-mtu-381
addhost-instant-open
glass-contrast-d365-mock
glass-contrast-d365
signout-followups-442
fix-startup-toast-red
research-gotatun-matrix-j317
themes-sync-j304
fix-load-flakes
fix-nix-zig-patch
fix-compute01-browser-baseline
ratchet-size-baseline-419
predict-auto-d130
revoke-coverage-d367
nightly-suite-queue-timeout
nightly-browser-suite
fix-rustsec-2026-0459
fonts-ioskeley-obel
log-retention-d375
fix-kbd-no-anim-427
fix-dev-red-specs-2
takeover-proof-305-j205
wip/j410-server-pump
ui-consistency-d372
fix-osc52-clipboard
libghostty-vt-1.0
forget-retired-host-d369
j404-merge-426
fix-setup-lock-race
fix-touch-select-426
revoke-access-report-ui
fix-predictive-echo-specs
fix-selinux-agent-exec
wip/j395-checkpoint2
wip/j395
j391-review-scratch
ui-consistency-j195-deferred-rebased
fix-rustc-paths-421
decisions-wording-341
fix-install-suite-red
fix-dev-rtt-specs
fix-pending-removal-align
fix-privileged-skip
fix-install-suite-404
review-j368
mesh-dns-j254
revoke-access-report-d356b
revoke-privilege-round5
fix-removal-confirm
review-j360
gotatun-rotation-367
deps-refresh-340
review-j354
review-J351
review-j350
addhost-takeover-d359
revoke-report-items-347
revoke-end-sessions-d362
review-j348
size-mesh-ssh-346
size-trim-337
revoke-access-diff-d356
j259-pre-rebase-b06c5a6
j305-ended-at-start-spec
addhost-sudo-consent
fix-layout-real-specs-411
fix-shell-open-411
fix-console-hosts-373
fix-shell-exit
fuzz-host-name-353
fix-host-details-410
macos-filter-j197
research-gotatun-tricks
revoke-p3-j216l
stale-state-pill
revoke-followups-j216k
revoke-progress-j216e
backup/macos01-20261106/lume/j197
backup/macos01-20261106/lume/appwin-icons-j207-stash0
backup/macos01-20261106/claude/stash-0
backup/macos01-20261106/claude/stash-1
backup/macos01-20261106/claude/J80-macos-s1
backup/macos01-20261106/claude/J80
backup/macos01-20261106/claude/J80-slice1-20261102
backup/macos01-20261106/claude/J16b-appwin-on-dev
backup/macos01-20261106/claude/appwin-launch-idle-146
backup/macos01-20261106/claude/J80-s1-run
wip/j259
trust-285-p3c
runtime-lock-j216f
mesh-ssh-p3-j175
tun-proof-p3b
trust-285-p3
terminal-polish-j271
tun-proof-p3
ssh-install-flakes-j216i
fuzz-fixes-j264
trust-285-a
trust-285-b
restart-oversized-fixture-j198
backup/macos01-20261106/lume/appwin-icons-j207
restart-bound-j216h
up-preflight-p3-j198
backup/macos01-20261106/lume/j251
up-preflight-j198
wip/up-preflight-j198-j245-p2
wip/up-preflight-j198-j245-p1
agent-fsync-offloop-j196
wip/up-preflight-j198-j245
settings-offscreen-j231
wip/up-preflight-j198-j226-inspection
wip/j103f
themes-j206
wip/up-preflight-j198-j226
flakes-j216c
backup/macos01-20261106/claude/j197
flakes-j216b
backup/macos01-20261106/claude/j197-red
wip/up-preflight-j198-review
flakes-j216
backup/macos01-20261106/claude/appwin-icons-j207
engineering-j208b
appwin-mock-j209
toast-stack-j165
engineering-j208
decisions-d351
decisions-d350
decisions-d349
appearance-presets-mock-j129
decisions-d348
docs-audit-spec
doc-coverage-baseline-raise
decisions-d347
decisions-d346b
decisions-d346
j88h-profile
ui-consistency-j195-deferred
ui-consistency-j195
engineering-practices-j194
preferred-login-ui-j166
signin-pools-263-j174
macos-node-265-s1
decisions-d345
decisions-d344
proxy-cgroup-j164
verify-quick-fuzz-329
proxy-start-io-j168
timing-flakes-j163
up-263-s1
mcp-events-j147
verify-quick-fuzz-j158
proxy-p3-j159
agent-resource-j157-detect
wip/j103d-final
remote-cancel-hang-j155
proxy-traefik-281-j62d
j149-verify-quick
proxy-traefik-281-j62b
j150-drop-unnamed
wip/j79d-red-r4
wip/j103d-d332
rootless-toast-j142
wip/j103d-head
wip/j103d
j125c-mcp
macos-build-j136
backup/macos01-20261106/claude/j136
wip/j79d-red-cli
wip/j79d-red-server
j121-link-liveness
j118c-tracer-failures
wip/j79c-head
release-desktop-j131
j124c-signed-macos
wip/j79c-red-p3
wip/j79c-red-p23
wip/j79c-red-p22
merge-j128-check
perf-deferred-j128
sidebar-toggle-260
j127-shortcut-changed-dot
j125-mcp
j118-tracer-failures
j126-account-summary
settings-sections-mock-j92
j120-pinch-lock
sidebar-292
backup/macos01-20261106/claude/j120
taste-2026-11-03
row-actions-242-215
backup/macos01-20261106/claude/stash-0-untracked
backup/macos01-20261106/claude/J80-265-s1-run
backup/macos01-20261106/claude/J80-macos-s1-20261102
j112-canvas-commands
ui-no-overshoot-scroll
fix-recovery-restart
backup/macos01-20261106/claude/stash-1-untracked
taste-2026-11-02
size-baseline-ratchet
machine-cards-structure-j108
j109-boot-copy-mockups
fix-dev-red
wip/up-263-s1
j95b-settings-rows
proxy-traefik-281
j95-option-rows
docs-human-j91
docs-keys-palette
fix-flood-1013-270-j38d
mesh-ssh-s1
mesh-ssh-s0
addhost-d291-tunnel
test-stability-load
mesh-relay-220
repro-296
shim-thp-off-24
mesh-pins-258-v2
mesh-dns
signin-d311-merged
docs-pages
ui-size-283
fix-ui-batch-specs
wip/j12b-edge-update
gate-on-arm
fix-rename-sync-293
trust-285-j60b
fix-focus-ring-clip
integ-ui-1101
edge-update-v2
signin-d311
taste-2026-11-01
layout-per-tab-250
ui-approved-splitopt-224
ui-approved-splitopt-224-on-dev
icon-text-centre-282
ui-approved-189-212-216
research-reverse-proxy
transfer-budget-320
review-mesh-pins-258-r2
sidebar-pill-259
review-mesh-relay-220
wip/j12-edge-update-v2
nix-package
status-crash-loop-237
fix-dev-test-failures
fix-fixture-socket-path
wip/mesh-relay-220-pre-dev-advance-rebase
fix-canvas-side-clip
research-head-to-head
frosted-real-256
review-mesh-pins-258
wip/mesh-relay-220-pre-final-rebase
review-layout-per-tab-250-r2
broad-suite-triage
nix-devshell
review-status-crash-loop-237-r3
wip/nix-devshell-pre-p3
taste-frosted-real
wip/code-serve-demo-2026-10-30
wip/code-serve-glass-2026-10-30
wip/code-serve-clusters-2026-10-30
wip/code-merge-release94-dev-2026-10-30
wip/rproxy-delta-scratch-2026-10-30
wip/stale-note-257-staged-2026-10-30
wip/d241-size-staged-2026-10-30
review-broad-suite-207
wip/mesh-pins-258-pre-split
wip/mesh-relay-220-pre-rebase
mesh-measure-220
plan-211-update
review-edge-autoupdate-r3
perf24-reconnect
review-stale-note-r2
release-prod-live
d241-shell-marker
review-mesh-pins-server-258
review-revocation-r3
review-setup-token-r2
review-sync-journal-r3
wip/review-mesh-pins-258-prune-review-1995fee46
frosted-scroll-256
sync-journal-r3
revocation-per-account-wip
review-tokio-asyncfd-0386
review-sync-p3s
wip/stash-8by64-stash0-2026-10-30
mesh-drag-r2
setup-token-data-wip
release-9-4
auth-busy-1013
mesh-view-overlap
sync-p3s
review-auth-busy-wake
review-readd-r8-wip
mesh-drag-bounds
audit-auth-93
app-windows-stream-start
review-authority-cap-r3
app-windows-r7-measure
readd-minimal-r6
readd-minimal-r5
app-windows-r7-soak
readd-minimal-r4
app-windows-r7
app-windows-r6
readd-minimal-r3
readd-minimal-r2
readd-minimal
merge-release8-dev
review-busy-page-liveness-r2
review-busy-page-liveness
mesh-view-trim
review-authority-read-retry-r2
review-remove-uninstall-r2
release-retry-reattach
release-retry
review-remove-uninstall
review-authority-read-retry
app-windows-ship
mesh-autoswitch-p2
mesh-ssh
mesh-relay
mesh-macos-node
screen-and-control
session-labels
review-real-logins-r5
review-real-logins-r4
review-real-logins-r3
shim-memory-r2
review-real-logins-r2
shim-memory
shadow-addhost-instant
shadow-real-logins
shadow-same-session-flood
shadow-prod-perf-fix
hosts-from-server
app-windows-real
app-windows-transport
release-prod-6w
mesh-policy-verify
quiet-close-toast
dev-merge-r4
review-mesh-agent-transport
review-app-windows-transport
settings-roundtrip
review-release-pipeline-r4
mesh-agent-transport
ended-strip-fix
review-audit-ca-update-d244
settings-rows
phone-width
signout-clear
fix-restart-tests
dev-merge-rp
signer-hardening
review-audit-ca-update
terminal-fidelity
review-audit-ca-update-wip
mesh-integrate
review-mesh-agent-transport-515d3712
review-mesh-dataplane-feec1988
mesh-dataplane
signout
research-canvas-node
wip/review-renderer-cost
wip/review-terminal-fidelity
padlock-glyph
review-release-pipeline-2e95b689
phone-polish
sidebar-polish
inbox-generic
review-mesh-dataplane-378d4055
prod-batch
ui-inbox
ui-ca-unlock
ui-machine-sections
review-mesh-dataplane-a5f744fb
tls-session-prod
session-bounds-prod
fix-dead-session
session-bounds
tls-session
palette-polish
shortcuts-d222
research-appmeta
phone-gutter
ui-centre-button
wip/ui-centre-button
wip/tls-session
review-addhost-breakit
ui-platform
renderer-cost
remote-agents
mesh-api
ssh-bootstrap
prod-hotfix2
prod-fixes
review-remote-agents
review-mesh-dataplane
session-life
research-browser
review-mesh-api
research-capture
review-mesh-api-round3
review-mesh-api-round1
gate-stability
review-gate-stability
review-relay-direct
review-mesh-api-findings
proto-sessions
font-picker
proto-addhost
proto-windows
mesh-core
latency-gate
research-bsd
research-discovery
keytray-mods
mock-core
ui-tweaks
fix-motion-sel
fix-motion
integrate2
fix-robust
t-web
t-server
vt-ghostty
fix-snap-echo
t-web-auth
review-vt2
t-agent
lane-protocol
lane-shim
lane-auth
s1-base
s1-contracts
s1-workspace
No results found.
No labels
launch-qa
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".
No due date set.
Dependencies
No dependencies set
Reference
kayg/infraternal#98
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Store the canvas document (D180) per account on the server and sync it live to every device as small operations (open, close, move, resize, rename) with a revision number; concurrent edits all survive. Sidebar expansion state per account too. Device cameras stay local. Measure op latency at the 300 ms RTT profile and memory per account at the D170 scale. Codex job; schema first (grill if anything is unclear).
Backend decided in D183 (main
4f4acff). Codex job launched on branch canvas-doc from devf27b3fe.Starting #98 on canvas-doc, base
f27b3fe7a4. Read #98 and parent #93 including all comments, repository contract, architecture/process and main decisions through D183. Backend only; no push/deploy. Proposed additive contract: bounded infraternal.canvas v1 layout-only document; stream-0 capability-gated JSON canvas sync/op/ack/update messages. Import appends new views with remapped layout IDs (D182), never replaces existing views. Account sidebar expansion persists; device camera remains local. Excalidraw follow-up deferred as brief allows.Gate findings at infraternal-dev: existing .cargo/musl-{cc,ar}.sh hardcode worktree/target/auth-tools but scripts/auth-toolchain honors CARGO_TARGET_DIR. A worktree-local ignored target symlink to the job scratch target resolves this without changing build code. First gate also failed existing initial_attach_requires_explicit_credit_before_replay (scripts/verify-agent-attach-credit.py); parallel cold builds raised load to 6.20/6.58/5.02. Retrying without concurrent gates. No canvas operation or runtime code is enabled yet; schema-only changes.
Schema-only fast gate: existing auth::tests::review3_tests::review3_backend_reply_has_a_deadline timed out at src/auth/review3_tests.rs:646 (15s wait); 99 passed, 1 failed, 9 ignored. Gate is still building static targets. Host load later reached 36.32/23.51/15.75. The canvas modules are not registered in this gate. Isolated direct-Rust preparation tests found the pre-existing unique users.username default, so new SQLite fixtures now supply explicit usernames.
Contract detail proposed before enabling implementation: 50 views/200 total windows incl graph nodes, 512KiB document/op bounds; snapshot after 100 ops, 30s on next edit, or 512KiB journal bytes. Graph open_node/add_edge/remove_edge complement pin; edges remain grant-name references only. Typed ops validate even if dropped as closed. Lifetime tombstones remain on disk with bounded touched-ID queries. Owned SQL transaction completion protects commit/cache consistency on socket cancellation; 16 outstanding edits/account; 64-entry bounded broadcast. JSON/Markdown export via existing Call canvas.export, import via typed op appending copies. Measurements will justify thresholds; no new engine/library chosen.
Schema step committed at
b08761c53f. Typed model, JSON Schema and golden tiled/graph fixture; AJV draft-2020 validation passed. Static sizes: x86 15,965,520 B; ARM 13,426,192 B. Full fast gate passed with RUST_TEST_THREADS=1, CARGO_BUILD_JOBS=2, CPUWeight=10000 on infraternal-dev. Verbatim gate summary:Storage contract detail: retain only the latest replaceable snapshot, while the operation journal remains append-only. Otherwise one slow edit/minute after the 30s threshold could accumulate a full document per edit (worst bound: 50 accounts × 512KiB × 1440/day = 37,748,736,000 B/day of snapshots). Latest-only bounds retained checkpoint data to 50 × 512KiB = 26,214,400 B. Journal and tombstones are retained; no history is silently deleted. Production edit API now requires a session hash; only cfg(test) engine/benchmark entry points bypass authority. Invalid authority is tested to roll back revision and document.
Migration
187089fpassed its empty/populated real SQLite integration test; both static builds passed (x86 15,965,616 B, ARM 13,426,288 B). Full fast gate failed only existing unaffordable_repaints_park_until_sufficient_credit at crates/infraternal/tests/vt_credit.rs:22, case t1-gate-approximate-1; retry running with no canvas runtime code registered. Load reached 39.19/33.87/28.72. Storage benchmark will match actual runtime.rs:385–389 (WAL/NORMAL, pool 8) and include 50 simultaneous writers as well as sequential latency, rather than only an unloaded per-account number. Eight isolated canvas engine tests currently pass, including authority rollback and punctuated-IP export redaction (the redaction test was observed failing before its fix).Wire reservation for #98: CANVAS Hello capability bit 1 (value 2); stream-zero JSON frames 0x34 CanvasSync, 0x35 CanvasOp, 0x36 CanvasAck, 0x37 CanvasUpdate. Existing types and frozen upgrade range unchanged. Client initiates sync after Welcome; legacy peers receive no unsolicited new messages. Successful acknowledgements and foreign updates will share the ordered per-account broadcast delivery so an own ack cannot jump past/hide another device's earlier independent edit. Reorder rebases stale column permutations by retaining concurrently added columns after the ordered prefix. Isolated existing credit test passed: 2,097,152-byte producer completed in 655.7ms and recovery PASS; migration fast retry continues.
Migration step
187089f: empty/populated SQLite test passed; user identity preserved and FK enforcement checked. Full fast retry passed. Static x86 15,965,616 B; ARM 13,426,288 B (+96 B each over schema). Verbatim summary:Prepared engine tests: 10 passed in 0.53 s against real SQLite, including concurrent edits, reload, copy import, cancellation, and authority rollback. Two export regressions were reproduced before fixes: punctuated IP labels survived default redaction, and pretty JSON for a valid 4-view/1,600-edge graph exceeded the 512 KiB import cap. Regression tests now pass with punctuation-aware redaction and compact JSON. Files: src/canvas/tests.rs and export.rs (infraternal-server). Current host load is 39.41/31.54/25.74 on 8 cores; scale measurements will record their own load.
Completed typed operations (D183): validated server-order edits; close dominates stale move/weight; stale reorder retains concurrently added columns. No new dependency. Isolated engine harness: 10 tests passed in 0.53 s; full repository gate below.
Head:
a9d2c9efc5.scripts/verify fastexited 0.Found a durable-replay precision bug before fixing it. A deterministic 10,000-weight round-trip test fails on weight 970.2739455349383: serde_json default decoding reads serialized JSON as 970.2739455349384. Evidence: crates/infraternal-server/src/canvas/tests.rs::journal_json_preserves_every_valid_relative_weight; red output saved for the verification report. Proposed fix: enable the already-selected serde_json float_roundtrip feature for the server, with the regression test. Reject weight quantization and a second JSON engine; measure decoder cost before/after and include the at-scale operation benchmark. D19, D183.
Store step
7394ae7: workspace clippy passed. The first full fast gate was interrupted with exit 143 after all printed Rust tests/doc-tests passed; it never reached cargo-deny/static/TS. Log ended at 16:50:43 CEST, systemd scope run-p1143209-i13724679.scope reports 3m54.874s CPU and 2.7G peak. No failing assertion was printed. Retrying the unchanged head with native fixture scratch scoped to this job. Prepared file-backed checkpoint/tombstone restart test also passed; isolated harness now 12 passed, 1 ignored in 1.31 s.Retry failed on fixture setup before canvas execution: scoped native socket path was 109 bytes, above AF_UNIX limit (scripts/agent_fixture.py:32). Static builds, clippy, formatting and cargo-deny passed. Shortening the job-local fixture root from canvas-doc/state to canvas-doc/s and rerunning the same commit
7394ae7; no production/test code or budgets changed. Exact float round-trip candidate separately passes all 10,000 deterministic valid weights; matched release decoder medians default 548 ns vs exact 632 ns (+84 ns), loads 23.48 and 33.90 respectively. This tiny measured cost preserves exact durable state; final report will retain both environments.Completed SQLite store
7394ae7(D19,D183): in-transaction authority/revision CAS; cancellation-safe ordered publication; weak account cache and disk tombstones; checkpoints at 100 ops/30 seconds/512 KiB, retaining one snapshot and the full journal. Real SQLite isolated harness: 12 passed, 1 ignored (1.31 s), including file close/reopen. Full gate green with job-local socket scratch canvas-doc/s.Head:
7394ae79f9.scripts/verify fastexited 0.Reconnect regression reproduced: sync(last_revision=2) at revision 3 returned operations [2,3] instead of [3]. Test recent_cursor_receives_only_subsequent_operations is red. For D183 and the brief, refine the sync base to max(latest checkpoint, requested cursor), replaying accepted journal entries up to that base on the server and returning only later operations. A current cursor uses the already-validated cache directly. Old cursors remain bounded by the latest checkpoint. The document always comes from server state; no device document is trusted. This additive canvas contract refinement will land with live sync; new frames/capability remain unchanged.
Completed exact JSON journal precision fix
e412d58: previously red 10,000-weight test passes in the real server (0.12 s). Matched release decoder medians 548 ns default / 632 ns exact (+84 ns indicative; differing load recorded). Reuses serde_json; no quantization or new engine. Full gate green.Head:
e412d5834a.scripts/verify fastexited 0.Export privacy regression: default output retained all three labels before the fix: "Connect 192.0.2.4?", "ssh://user@[fe80::1%eth0]:22", "Connect 2001:db8::1?". Added a failing test first; standard-library address-alphabet scans now redact punctuation, URLs/CIDRs and IPv6 zone suffixes. No new parsing engine. Prepared engine harness: 15 passed, 2 ignored in 1.31 s, including recent-cursor sync, graph edge cleanup, both close/move orders, and file-backed restart.
Export step
a596d38gate: fmt/clippy/cargo-deny/both static builds passed, but unchanged native test unaffordable_repaints_park_until_sufficient_credit failed again at t1-gate-approximate-1 (vt_credit.rs:22). This is the same preexisting probe failure recorded during migration; static binaries remain 16,040,688 / 13,492,672 B. Retrying unchanged head without changing terminal code or deadlines. Separate schema audit reproduced two malformed-nullable-field cases: missing Node.pinned and missing Pin.position were silently accepted. Two tests failed before the fix; existing serde deserialize_with now requires explicit null, matching v1 required fields, and both candidate tests pass (0.03 s).Completed portable exports
a596d38: compact validated v1 JSON, escaped Markdown outline, default IP redaction including punctuation and IPv6 zones, conservative optional label privacy. Prepared engine harness 15 passed/2 ignored (1.31 s); regression cases were reproduced before fixes. Full fast gate green on unchanged retry; terminal probe deadlines were not changed.Head:
a596d38ee2.scripts/verify fastexited 0.b031ed4strict nullable pin tests pass in real server (2/2, 0.00 s). Full fast gate failed only unchanged native credit case t1-gate-faithful-1: verify-vt-credit.py:30, "detached initial producer must finish" (5 s deadline), host load 35.18/31.69/29.07. Approximate case passed (2 MiB producer in 637.9 ms). Fmt/clippy/cargo-deny/static passed; retrying unchanged commit and original deadlines. Wire preview: 21 shared vectors, 5 TS codec tests passed in 65 ms; Rust/TS differential gate will run after integration.Completed strict nullable pin decoding
b031ed4: missing required fields fail, explicit null remains valid (2/2 real server regressions). Full fast gate green after unchanged retry. Wire preview validated 21 vectors with 7 Rust and 5 TS tests.Head:
b031ed4143.scripts/verify fastexited 0.Completed additive wire slice
30894c6: CANVAS bit 1/value 2, stream-zero types 0x34–0x37, borrowed JSON in both codecs, four new golden vectors, explicit canvas API contract. Full fast gate green; differential: 162 streams/17,235 schedules/zero divergences. Existing 30 s gate timeout unchanged; standalone default 5 s was too short for expanded coverage.Head:
30894c6c19.scripts/verify fastexited 0.Live slice first gate: x86_64 static binary 16,500,144 B, exceeding unchanged 16,404,816 B maximum by 95,328 B (live-fast.log). Temporary engine test registration remained after its helper was removed; correcting that registration error before amending this slice. Removing redundant portable JSON -> generic tree -> JSON export encoding and measuring code-size reductions; no size baseline or terminal deadline changes. Real engine/socket tests previously passed 22/22 plus migration.
Import boundary reproduced before fix: valid Document::decode accepts 524,287 B; its typed import operation is 524,341 B and Operation::decode rejects operation size (import-boundary-red.log, failing test exit 101). Proposed additive bound correction: keep document canonical/input cap 512 KiB, allow operation cap 512 KiB + 128 B for its envelope; enforce this cap again after normalization. Final combined-account document bounds still apply after import remaps IDs. Extend decoder differential/fuzz boundary evidence accordingly.
Dependency slice complete: enabled existing serde_json borrowed raw_value support; no new parser engine. This precedes the separately gated decoder and held live-integration slices. Static x86_64 remains 16,040,752 B. Strict raw payload dispatch and original derived deserialization will be checked differentially.
Head:
9b2f0f5b51.scripts/verify fastexited 0.Borrowed decoder module complete: 17 golden operations plus malformed/duplicate/escaped-tag equivalence tests passed (3 tests, 0 failures). Paired precise opt3/LTO measurements on infraternal-dev: small weight 571 -> 773 ns (+202 ns), 50-view/200-window import 538249 -> 514940 ns, load 55 recorded. Fixed size budget unchanged; held live slice will be measured separately.
Head:
b729b32c95.scripts/verify fastexited 0.Import envelope fix complete: red test rejected a valid 524287 B document wrapped in a 524341 B operation. Green regression covers the maximum-width base revision. Document cap stays 512 KiB; bounded operation cap reserves 128 B, rechecked after normalization. Final account bounds and remapped-ID validation remain enforced. No transport or binary budget changes.
Head:
5f067297c7.scripts/verify fastexited 0.Live integration complete: 27 canvas tests plus migration passed against real SQLite/WebSockets, including distinct devices, revocation isolation, account-isolated fan-out and normalized copy imports. Borrowed dispatch reduced x86_64 live binary by 105888 B: final 16394064 B, 10752 B below unchanged maximum. Both static targets and the full gate are green; no deadline/budget changes. Ordered publication avoids skipped foreign edits and per-device JSON decoding.
Head:
e9291aa097.scripts/verify fastexited 0.Verification slice complete: registered 27 canvas tests plus migration, 17 operation golden vectors and real multi-device/account isolation cases; full gate green. Added ignored release harnesses for 50 accounts × 50 views × 200 windows, 250 real session rows, eight runtime workers, concurrent writes, snapshot/replay and five-device delivery. Production static sizes remain 16394064/13787616 B, within unchanged limits. Scale measurements follow in their own recorded finding.
Head:
b20359853f.scripts/verify fastexited 0.Scale measured on infraternal-dev, musl opt3/LTO, 8 cores/workers, CPUWeight=10000, WAL/NORMAL pool=8, 50 accounts × 50 views × 200 windows, 250 live sessions; load 29.60 -> 29.37. apply p50/p99 1.110/9.282 ms (9900); snapshot writes 1.600/20.624 ms (100); 50-concurrent p50/p99 38.418/190.276 ms (1000); replay 69 ops 56.065/100.973 ms (50). Snapshot encode 235.872/375.022 us (1000), five-ring receive 1.304/5.215 us (10000). Op JSON 85 B / mux 88 B; document 31907 B. Loaded RSS delta 6033408 B across 50 (120668 B/account), peak delta 6721536 B. scale.log passed.
Five-device delayed benchmark red: unexpected Close during setup (network.log, exit 101, 1.25 s). The shared fixture has one memory connection; a cold 49-op replay holds it across 25 ms busy authority reads. Production uses disk pool=8. Seed via the existing live API and keep the account alive until the delayed peers join; cold replay is measured separately on WAL pool=8. No production timeout or auth relaxation.
Delayed network benchmark green after live seeding: musl opt3/LTO, 8 cores/workers, 50 views/200 windows, five distinct sessions, CPUWeight=10000, RTT300 +/-30ms; load31.28 ->27.90. 100 edits: ack p50/p99 301672/343790 us; all-five delivery 314987/353098 us (network-green.log).
Fixture-fix full gate hit the previously observed unchanged terminal credit probe t1-gate-faithful-1 (vt_credit.rs:22, network-fixture-fast.log, 14.40s). Clippy, license checks and both static size gates passed. Retrying the unchanged tree; no terminal code, deadline or binary baseline changes.
Existing wire hot-path comparison (20 Criterion samples, 200ms warmup, 500ms measurement, CPUWeight10000) completed. Before/after full-input estimate 17.012 ->27.998 ns; full-output64 estimate15.927 ->37.349 ns; output encoding31.009 ->19.327 ns. Final host load26.07 ->45.59, so differences are indicative rather than isolated code attribution; raw intervals/outliers retained in protocol-before/after.log and verification evidence. At1000 input frames/s across50 users, observed full-input delta is10.986 us CPU/s. Four negotiated canvas types add the required control exchange; no performance gate or deadline is widened. Production musl exact borrowed weight decode: median805 ns across11 x200000, load23.08 ->22.75.
Delayed fixture correction complete: red setup failure replaced by live API seeding with a retained account, then exactly five distinct sessions during measurement. Production deadlines unchanged. 100 edits at RTT300 +/-30 ms: ack301672/343790 us p50/p99; all-five314987/353098 us, load31.28 ->27.90. Unchanged full-gate retry is green after the known terminal-credit flake; static sizes still16394064/13787616 B.
Head:
141882577a.scripts/verify fastexited 0.Dependency-step fast gate: unchanged native test unaffordable_repaints_park_until_sufficient_credit failed after 20.61s (crates/infraternal/tests/vt_credit.rs:22). All other Rust gates passed; x86 static 16394064B, ARM 13787616B. Retrying unchanged under shared-host load; no timeout changes.
Fuzz dependency step: reuse existing serde/serde_json/thiserror with production exact-float and borrowed-value features; no new engine.
Head:
e80f4c5b39.scripts/verify fastexited 0.Decoder fuzz evidence (
de7ada6): nightly AddressSanitizer, existing libFuzzer, production model/ops/borrowed decoder, derived-serde acceptance oracle and exact round trips. All-target clippy passed. 26 seeds include all 17 operations, required pins, precision and 524287B document/524341B import. No crash/mismatch.Full fast gate running for this atomic target step.
Fuzz target step complete: production-source differential decoder, 26 golden/boundary seeds, 20000 ASAN executions in 54s, no crash or mismatch.
Head:
de7ada68b2.scripts/verify fastexited 0.Final docs-head gate (
90a1cea): unchanged native repeated_tiny_credit_pauses_preserve_shell_progress failed at crates/infraternal/tests/agent_review.rs:13 / scripts/verify-agent-snapshot.py:48, after catch-up 0 passed (481B Snapshot). Agent review suite: 5 pass/1 fail, 41.56s. Load after run 29.91/26.46/29.19. fmt/native fmt/clippy/deny/static passed. Retrying unchanged; no terminal code, timeouts or budgets altered.Final docs-head retry (
90a1cea): prior native snapshot regression passed (agent_review 6/6,25.80s), but unchanged shim attached_backpressure_and_detached_progress failed at crates/infraternal/tests/shim.rs:193: attached producer stalled at head 944 below minimum 1835. Shim suite 6/7,13.90s. Post-run load 13.56/21.56/26.88. Other fast Rust gates passed. Retrying unchanged; no native test or production changes.Final docs-head retry 2 (
90a1cea): prior snapshot and shim regressions passed, but unchanged vt_credit failed case t1-gate-approximate-16384 (21.99s suite). target/review-vt3-fixes/t1-gate-approximate-16384.stdout.log: producer=2097152 bytes completed=False elapsed_ms=1517.0 notices=0 repaints=0; stderr assertion is producer progress within existing 1.5s observation. Post-run load 34.37/28.71/28.13. Other Rust gates passed. Retrying unchanged; deadlines retained.Final docs-head retry 3 (
90a1cea): snapshot/shim regressions passed; unchanged vt_credit failed t1-gate-approximate-1, suite 9.32s. Post-run load 42.51/36.24/31.39 on 8 cores. Formatting/clippy/deny/static passed. Canvas code is identical to greende7ada6; only documentation follows that head. Waiting briefly for shared load before another unchanged full gate. Deadlines and budgets retained.Finished backend #98; documentation step complete at
90a1cea(17 atomic commits fromf27b3fe). Typed v1 schema/goldens, SQLite migration/journal/checkpoints, validated ordered edits/tombstones, capability-gated live sync in both codecs, import copies and JSON/Markdown exports are implemented. Author backend review complete. At 50 accounts x50 views/200 windows: apply p50/p99 1.110/9.282ms; checkpoint encode 235.872/375.022us; 85B op/88B mux; loaded RSS 120668B/account (6033408B total); five-receiver delivery 1.304/5.215us, real 300ms-jitter all-five p50/p99 314.987/353.098ms. ASAN fuzz:20000 runs/54s, no crash/mismatch. Evidence and reproduction: docs/verification/canvas.md and canvas-evidence.txt; contracts/canvas.md. Final gate passed unchanged after recorded native regressions; no timeout/budget relaxation. How to test: run canvas_migration; run cargo test -p infraternal-server canvas; negotiate CANVAS capability 2 and use CanvasSync/CanvasOp or Call(canvas.export), per contracts/canvas.md. Excalidraw/image export is follow-up. No push/deploy; issue left open.Head:
90a1cea8cf.scripts/verify fastexited 0.Starting independent break-it review of #98 on review-canvas-doc, detached target
90a1cea8cf; merge base with devf27b3fe7a4. Read contracts, repository rules, main decisions D170/D178/D180/D182/D183, all #98 and parent #93 comments, and author report. Tests/evidence only; implementation remains unchanged. No push/deploy.Verification review run 1 of canvas-doc
90a1ceastopped early (provider filter) without findings. Its in-progress test edits are on local branch review-canvas-doc-wip (21fa879); the next review should start by reading them (git diff90a1ceareview-canvas-doc-wip) and keep any that expose real gaps.Resuming independent verification of #98 on review-canvas-doc at
90a1cea8cf; merge basef27b3fe7a4. Read all #98/#93 comments and prior review-canvas-doc-wip tests. Verify prior candidates before retaining them; tests and evidence only. No push/deploy.Independent decoder verification at
90a1cea: production-source canvas_op_decode ASAN fuzz target completed 20000 executions in 30 seconds; cov=4365, ft=12173, corpus=594/51MB, RSS=497MB, no crash or differential mismatch. Used installed nightly-2026-10-01 and documented pinned Zig Nix shell under local CPUWeight=10000. The undated nightly lacked a usable rustc; this was a setup failure. Unmodified-head fast gate is now compiling its test profile. Prior import/control candidates still awaiting fresh reproduction; no findings committed yet.Fresh author-head fast gate: fmt/native fmt/Clippy passed; existing unaffordable_repaints_park_until_sufficient_credit failed at crates/infraternal/tests/vt_credit.rs:22, case t1-gate-approximate-1, suite 9.55s. Earlier native suites passed (including agent review 6/6 and shim 7/7). This failure is already recorded on #98 by the author; not a new canvas finding. Gate continues through static checks. Baseline test binaries compiled before review tests were appended; production implementation remains exactly
90a1cea. Host load sampled nearby: 21.04/26.14/27.37, 8 cores.CDR-01 P2 confirmed; failing test committed at
1e7704a6f4. crates/infraternal-server/src/canvas/tests.rs::review_exported_layout_imports_into_empty_account_at_column_bound: 50 views, 10000 legal empty columns, 0 windows. Real source edits/export produce 428555 B JSON; 428609 B operation passes typed decoding. Empty recipient import is refused with invalid canvas: operation size after store.rs UUID remapping; 0 pass/1 fail, 2.61s. D180/D182 export-import interoperability gap. Implementation unchanged.CDR-02 P1 confirmed and committed at
2155080038. websocket.rs:335 awaits canvas dispatch inside the only multiplexed loop. Failing test auth::tests::socket_tests::canvas::review_canvas_waiting_for_writer_does_not_block_control_frames: real authenticated WebSocket, disk SQLite WAL/NORMAL pool=8. Hold unrelated writer 350ms; Ping before CanvasOp=748us, Ping after CanvasOp=433082us; generous 100ms isolation ceiling fails (0 pass/1 fail, 1.65s). Local CPUWeight=10000, 8 cores, load 33.12/29.08/27.82. WAL authority reads remained available. Same loop routes terminal input/output, so canvas contention stalls that path too (D11/D41/D183). Production unchanged; fixture-only disk backup setup corrected before confirming the finding.CDR-03 P2 confirmed; failing test committed at
0e0effb13b. canvas/export.rs:18 absorbs the hex-only db: label prefix into an expanded IPv6 token, which then fails whole-token parsing. Valid view label db:2001:db8:0:0:0:0:0:1 survives default JSON and Markdown exports. Test canvas::tests::review_export_redacts_ipv6_after_colon_delimited_label reports json=true markdown=true, 0 pass/1 fail, 0.00s. D180 default IP-redaction gap; production unchanged.Review regressions independently reproduced together at
0e0effb: canvas suite 27 original tests passed, 3 confirmed review tests failed, 3 ignored, 10.74s. CDR-02 repeated baseline=963us versus CanvasOp-queued Ping=431974us, local load=28.32/29.68/28.40. CDR-01 export/envelope=428555/428609 B; CDR-03 default JSON/Markdown both retain the IPv6 literal. Formatting and workspace all-target Clippy passed. Separately original author-head server binary: 127 passed/12 ignored, 223.13s; real migration 1/1 passed, 0.12s. TS compiler/production build/transfer budgets passed; differential 162 streams/17235 schedules/zero divergences. Release measurements queued behind static build.Independent musl opt3/LTO remeasurement at review head
0e0effb(production identical to90a1cea), local CPUWeight=10000, 8 cores. Scale: 50 accounts x50 views x200 windows, WAL/NORMAL pool=8, 250 live sessions. Load30.28->35.41; apply p50/p99 0.793/9.690ms, checkpoints1.178/28.611ms, concurrent50 writers26.063/232.170ms, 69-op replay42.114/63.723ms, encode179.696/1120.410us, ring fanout0.672/2.767us. Loaded RSS delta6569984B/50=131399B/account, peak7045120B; document31907B, op85B/mux88B. Five-device 300ms +/-30ms: ack306364/328572us, all-five315466/331549us; load47.67->45.17, 100 edits, port4498. Exact decoder median1225ns/op at load45.17 (11x200000). All three measurement tests passed. Tail/RSS variability versus author numbers is documented; these shared-host runs do not isolate a causal regression. ARM static check and full latency gate still in progress; x86 static16394064B passes unchanged budget.Latency gate native phase exceeded budgets on infraternal-dev (8 cores), load 74.20/73.68/65.49. Real PTY baseline p99 563.96 ms (334 ms budget); same-session flood p99 3765.26 ms, growth 3201.30 ms (16.67 ms budget). Confirmed echo baseline p99 407.66 ms. These measurements do not isolate canvas causality under shared-host load. Browser phases still running. Fast gate completed: fmt/native fmt/Clippy/deny/static PASS; tests FAIL (101), previously reported vt_credit t1-gate-approximate-1. Static sizes x86 16394064 B, ARM 13787616 B, both within gates. Full output will be committed with review evidence.
Verification review of
90a1cea(run 2, stopped by me for disk space after it had finished its write-up): merge after fixes — CDR-02 P1 inline durable dispatch blocks the device socket loop; CDR-01 P2 legal export refused on import after ID remap; CDR-03 P2 IPv6 redaction skipped after a hex-colon label prefix. Tests on review-canvas-doc-round2. Repair run queued.Starting repair round #98 on canvas-doc, base
90a1cea8cf. Read all #98/#93 comments and saved review. Merging dev459070fefirst; then reproduce and fix CDR-02, CDR-01, CDR-03 with separate gated commits. No push/deploy.CDR-02 reproduced after dev merge: baseline Ping 405us, CanvasOp-queued Ping 479796us with a 350ms WAL writer hold; 0 pass/1 fail. Candidate account queue now passes that test: baseline514us/queued48465us, 28 canvas tests passed/3 ignored (7.55s). Evidence: src/websocket.rs and src/canvas/store.rs; scratch cdr02-red.log/cdr02-green.log. Proposed additive contract: 16 outstanding FIFO edits/account, immediate canvas busy error on saturation; connection-origin metadata keeps ACK/update ordering. Sync/export waits also leave the multiplexed socket loop. Real-PTY 300ms burst gate and queue lifetime/order checks are being added.
New real-PTY burst probe initially failed at p99 478944us. Its no-canvas baseline also failed (p99 379935us), revealing that the harness omitted production runtime.rs TCP_NODELAY. Updating the harness listener to match production; no production transport setting or budget changes. Initial metrics use debug code, disk WAL/NORMAL pool8, 50 views/200 windows, 100 samples, RTT300 +/-30ms, local CPUWeight10000, load9.39->7.09 (burst) and recorded baseline environment in burst-baseline.log. Queue bounded/order/lifetime test passes.
First repair fast run: fmt/VT fmt/clippy/deny pass; native tests failed only expired_handshake_releases_user_permits at socket_tests.rs:151 (pre-Hello capacity assertion), 128 server tests passed/13 ignored. Same targeted test passed on the repair tree (0.81s) and detached dev459070fe baseline (0.64s); baseline preparation load8.22/10.24/11.12. No handshake code changed; a full unchanged retry is required. Native terminal/credit/snapshot tests passed. Static builds and optimized canvas burst compilation are still running. Initial debug-scale run is recorded separately and is not an optimized latency claim.
CDR-01 repair approach while P1 gates compile: retain document/operation byte caps and remap imported IDs without increasing their byte widths in a fresh recipient. Use a randomized bijection of the existing permitted ASCII ID alphabet, then reserve against live IDs; handle collisions with fresh IDs and preserve edge/sidebar references. Imported IDs are layout names, never authority. Reject enlarging normalized-operation/document limits, which would merely move the refusal to final document validation. Retired window IDs remain protected by existing bounded tombstone queries; no tombstone set is loaded into live memory.
CDR-02 optimized isolation now passes: musl opt3/LTO server harness, real local PTY, disk WAL/NORMAL pool8, 50 views/200 windows, 100 bursts x16 edits, RTT300 +/-30ms. Echo p50/p99 312910/342546us <=350000us; load14.85->13.09, CPUWeight10000, 8 cores (burst-ack-release.log). A second cause was inline terminal Ack persistence waiting on the canvas writer before forwarding Output. Persistence now runs outside the loop, one active write plus one coalesced range/attachment; authority-predicated ledger writes complete before Ack. Completion generation rejects retired attachment results. Deterministic writer-hold test passed: echo75391us, 16 accepted FIFO edits/16 busy replies, no input Ack before commit; ordered revisions after release. First static candidate exceeded x86 budget by16928B (16421744/16404816B), so completion delivery is consolidated through existing mpsc and cold account reads are shared; limits unchanged. Final gates in progress.
CDR-02 gates: all Rust rows pass except unchanged static size cap; current candidate16443344B exceeds16404816B by38528B. Reducing task/channel specializations without changing release settings or budgets. FIFO admission now uses a bounded oneshot baton chain (no idle account worker and no mpsc edit payload); socket completions reuse the existing four-slot output channel. SQLite writer admission also occurs before connection acquisition: one writer matches SQLite and leaves the WAL pool available for authority reads across 50 concurrent accounts. Terminal Ack shares that gate. Pending counts still bound completed producers and retired attachments. No new engine/library. Re-run scale, isolation and full gate before committing.
CDR-02: baton FIFO + writer admission before pool acquisition pass all canvas tests (30 passed, 4 ignored). Last static x86 candidate is 16,445,616 B, 40,800 B over the unchanged D41 gate. Measuring a shared boxed Tokio task representation for the four new database tasks; permits still bound allocations, no dependency/profile changes. Re-running optimized real-PTY burst, scale and full gate before committing.
CDR-02 latest boxed-task measurements (musl release, infraternal-dev, 8 workers, CPUWeight=10000): 100 real-PTY bursts ×16 canvas writes at RTT300±30ms, echo p50=310878us p99=331894us <=350000us; load12.14/17.19/15.30 ->9.25/15.91/14.94. 50 accounts ×50 views ×200 windows, 250 device sessions: edit p99=6195076ns (9900), 50 concurrent writers p99=77658278ns (1000), loaded RSS delta=6238208B (124764B/account), peak delta=6549504B; load12.78/17.73/15.42 ->12.67/17.38/15.35. Prior boxed burst closed without a result while builds ran; latest completed 1 pass/0 fail. Latest fast has 129 pass/1 fail/13 ignored in server: only unchanged expired_handshake_releases_user_permits pre-Hello 503 assertion. Detached dev459070fe baseline and current targeted reruns both pass in the same load window (0.61s, 0.34s). Not claiming a baseline-failure exemption; rerunning full gate. Static builds still running, no budget/profile changes.
CDR-02 committed
ee4fe02573. Bounded ordered account queue and independent sync/export + terminal Ack persistence; shared writer admission protects WAL read connections. Added FIFO/idle-release, writer isolation and real-PTY burst regressions. Latest echo p99=331894us (100×16 edits, RTT300±30ms), 50-account concurrent apply p99=77658278ns, RSS delta=6238208B. Writer lock test: echo50386us, queued16/busy16, no Ack before durability. Static x86=16383472B, ARM=13775888B, PT_INTERP absent. Correct previous targeted handshake duration: current rerun 0.51s; ten detached dev459070fe baseline samples passed. Full fast rerun exits0; no exemption used. Gate output verbatim:CDR-01 review test cherry-picked as
b9caac92after gated CDR-02ee4fe025. Confirmed failure: legal 50-view/10,000-column export428555B, accepted operation428609B; durable import returns invalid operation size, 0 pass/1 fail, 2.71s. Width-preserving randomized ASCII bijection now keeps copied IDs and references within the same serialized width in fresh recipients. Live collisions use reserved fresh IDs; retired-window collisions are queried/repaired inside the existing transaction, then the final operation is reserialized and byte-checked. Caps unchanged. Added real-engine tests for a 524287B graph import/reload and deliberately saturated one-byte live/retired namespaces; running those and full gate.CDR-01 committed
fe007049c2. Width-preserving copied IDs fix the durable column-bound import; reserved live IDs and targeted retired-window repair retain graph/sidebar/target references and journal replay. Real SQLite import/export/reload preserves 524287B; forced 66-ID live/retired collision fixtures pass. Optimized bound sample copy/commit/export49896us, memory/pool1, 8 cores, load13.76/19.74/18.61. Full fast exits0; server132 pass/0 fail/13 ignored, static x86=16397776B ARM=13787296B without PT_INTERP, unchanged caps. Gate output verbatim:CDR-03 review test cherry-picked
e752457aafter gated CDR-01fe007049. Confirmed default leak: json=true markdown=true, 0 pass/1 fail. Delimiter-bounded standard IpAddr parses fix absorbed hex prefixes, including IPv4 tails, URL/CIDR/zone wrappers and leading compression markers; each candidate is at most45B, opaque IDs untouched. Eight targeted export tests pass, including 1024 generated expanded/compressed IPv6 forms. Measured first candidate at 50 views/200 windows: 251B-prefix portable p99=14961268ns vs buggy baseline4177528ns; export-pair p99=22782327ns vs11132103ns, on shared-host loads12.14/12.01/14.90 ->12.61/12.11/14.89 vs16.84/14.67/16.87 ->17.72/14.93/16.93. Added an early rejection for a component longer than four undelimited bytes so impossible hex-label starts incur no parse calls; measuring final candidate and full gate. No engine/dependency/timeout/cap change.CDR-03 form audit caught a candidate regression: combined hex tokens absorb adjacent IPv4 label letters. Added db192.0.2.1 / 192.0.2.1db cases; targeted test failed before correction (left db192.0.2.1, expected [IP], 0 pass/1 fail). Restored the existing digit/dot IPv4 boundary pass. Full current server tests pass. Latest musl export benchmark (8 workers, CPUWeight=10000): 50 views/200 windows, 251B prefix label, portable p50/p99=1608250/2927887ns, JSON+Markdown pair6578978/7825302ns, 50 simultaneous pairs p99=209155320ns (500); load7.71/8.79/11.31 ->8.05/8.84/11.31. JSON141005B ->29855B, Markdown JSON118014B ->8664B. Plain-label pair p99=2864626ns. Extending existing canvas_op_decode fuzz target to production export code, generated IPv6 spellings and IPv4 hex-letter neighbours; dated nightly2026-10-01 works around incomplete default nightly. Static gates still running; unchanged caps.
CDR-03 completed:
a9c0f407. Preserved review failure then fixed colon-prefix IPv6; retained IPv4 adjacency after its additional failing regression. Tests cover all readable labels, 15 wrappers/forms and 1,024 generated IPv6 spellings. Production 50-concurrent hostile-label export pairs p50/p99 107.522/209.155 ms; JSON shrinks 141,005→29,855 B. Load and baseline caveats are in docs/verification/canvas.md.Extended production-export fuzz oracle: nightly-2026-10-01, 20,000 runs in 96 s, cov 4629, ft 11765, corpus 681/63 MB, peak RSS 515 MB, no crashes. No engine/dependency changes.
scripts/verify fast exit 0; static x86/ARM 16,398,640/13,788,496 B. Verbatim gate summary:
Repair round complete on canvas-doc; head
d1faaab838. Merged dev459070feand retained all three failing review tests. Fixes:ee4fe025CDR-02,fe007049CDR-01,a9c0f407CDR-03; documentationd1faaab8. No push/deployment, issue remains open.Evidence: real PTY 100×16 canvas-write bursts at RTT 300±30 ms give echo p50/p99 310.878/331.894 ms (≤350 ms); writer-lock test admits 16/rejects 16 busy and echoes before release. At 50 accounts/250 devices, normal write p99 6.195 ms and loaded RSS +6,238,208 B (124,764/account). Real-engine import preserves a 524,287 B document and reloads its checkpoint; collision/replay tests pass. Default exports remove prefixed IPv6 and adjacent IPv4 labels while preserving opaque IDs. Extended fuzz target: 20,000 cases in 96 s, cov 4629, ft 11765, RSS 515 MB, no crash. Full workload/load/cost caveats and reproduction: docs/verification/canvas.md. Author backend checklist completed; no foundational or budget changes.
How to test:
Final scripts/verify fast exited 0, no baseline-failure exemption. Server: 135 passed/0 failed/14 optional measurements ignored. Static x86/ARM 16,398,640/13,788,496 B, both no PT_INTERP, unchanged caps. Verbatim gate output:
Job-local build targets/corpus and detached baseline are being removed after preserving this evidence.
Resuming requested repair verification on canvas-doc at
d1faaab838. All #98 and parent #93 comments read. Prior run already merged dev459070fe, reproduced and committed all three fixes with measurements and final gate; worktree is clean. Re-running scripts/verify fast on the existing completed head; no push/deploy. Saved review path in brief no longer exists; issue and docs/verification/canvas.md retain the evidence.Independent repair verification starts on review-canvas-doc at
d1faaab838; merge base dev459070fe3b75548382e8e19fba86af20439cf607. Read all #98 and parent #93 comments and author report. Earlier review branch preserved as review-canvas-doc-previous-0e0effb. Reverify CDR-01/02/03, inspect ordering/durability/access paths, and record any new confirmed gaps as failing tests. No implementation fixes or push/deploy.Repair verification at
d1faaab8: production-source canvas_op_decode ASAN fuzz run exit0, 15111 executions in121s (120s bound), cov4551 ft11586 corpus613/80MB RSS539MB; no crash or differential mismatch. First setup lacked Zig, corrected using documented Nix shell. First fast gate native fixture setup refused112B Unix-socket path; retry uses job-local shorter cdr98 scratch alias, no source/deadline changes. Current tests/static builds continue.Repair verification at
d1faaab8: fresh full-workspace native run passed server135/0failed/14ignored, migration1/1, preserved CDR-01/02/03 regressions, near-cap import/copy-collision/reload, FIFO/idle-release and writer-lock echo/undurable-Ack tests. Initial x86 static16402992B<=16404816B, PT_INTERP absent; ARM/build completion pending. No new confirmed finding. Raw outputs will be preserved in review evidence before scratch cleanup.Fresh target-head fast gate completed at
d1faaab838, exit0; no baseline-failure exemption. Static x86/ARM16402992/13788496B, PT_INTERP absent. Release measurements and latency gate next. Verbatim output:Independent musl opt3/LTO measurements at target
d1faaab8, infraternal-dev8cores/workers, CPUWeight10000, sequential execution. Scale50accounts×50views×200window references, WAL/NORMAL pool8 and250live sessions: normal edit p50/p99=.997/9.225ms;50concurrent writers27.462/118.987ms;69-op replay54.791/98.967ms; RSS loaded delta6004736B (120094/account), peak6189056B; load17.83->18.08. Five-device300ms±30ms ack303.477/330.737ms, all-five313.753/331.268ms, load17.91->13.66. Real-PTY100×16-edit bursts echo313.432/336.302ms<=350ms, load13.28->12.22;0-edit control307.636/331.416ms, load12.22->11.51 (indicative p99 difference4.886ms, shared-host comparison). All six measurement runs exit0. Extended latency gate still running. No new confirmed finding; full numbers/paths will be committed in evidence.Extended scripts/verify latency at
d1faaab8: native baseline echo p99=323.04ms and other-session flood319.56ms pass; same-session flood424.24ms, growth101.19ms exceeds334ms absolute/16.67ms growth budgets. Setup/native loads11.51/10.57 (8cores). No canvas operations are sent by this native daemon/PTy gate. Preparing detached dev459070fe comparator before attributing a regression. Auth browser checks passed. Broad tracer suite runs319cases, including existing add-host visual failure; outcome pending. Fast gate and six canvas release measurements remain green.Evidence step committed on review-canvas-doc at
df8cb76a75: docs/verification/canvas-doc-review.md and canvas-doc-review-evidence.txt. Source/test code remains targetd1faaab8. Fresh fast exit0, server135/0failed, migration1/1, all CDR regressions pass; ASAN15111 cases/121s/no mismatch; six release measurements exit0, 16-edit real-PTY p99=336.302ms<=350ms and loaded50-account RSSdelta6004736B. Native dev comparison and319-case broad browser run continue; final verdict pending.Native latency comparator completed: preserved targetd1faaab8 and detached dev459070fe, musl opt3/LTO,100samples/phase,CPUWeight10000, both exit1 on the same existing same-session-flood checks. Target baseline/flood p99=330.13/445.65ms,growth115.52ms; dev327.80/475.97ms,growth148.17ms. Both baseline and other-session rows pass. Target load11.87/15.97/19.76->15.11/15.55/19.20; dev15.11/15.55/19.20->22.41/17.76/19.63; broad browser suite active during both, no compilation during probes. Same-case baseline failure is evidence against attributing the broad native red row to canvas; comparison is not controlled enough to quantify a causal delta. Browser suite continues. This is not a fast-gate baseline exception: target fast is independently green.
Focused production-browser baseline at detached dev459070fe, unique TRACER_TEST_PORT4501, CPUWeight10000:14selected cases,4failed/10passed in2.5m. Same failures as target: add-host dimmed flow window, view-flight budget,4x frame budget,hidden-surface release. Other selected target failures did not all reproduce on baseline; apps/tracer production/test sources are unchanged in canvas-doc diff. These shared-host samples are not controlled causal attribution. Target319-case broad suite continues (ghost-text checks currently passing). No new confirmed canvas-document finding.
CDR-04 (P1): near-limit imports delay terminal input on the multiplexed socket. websocket.rs:400 decodes inline before advancing to Input. Seven valid 524275-byte documents fit one <4 MiB message; recipient has 50 views/200 windows and refuses imports with view limit. Release real-PTY probe at 300±30 ms RTT, 8 workers, WAL/NORMAL pool 8, CPUWeight=10000: 100 samples, echo p50 489522 us / p99 698037 us, fails unchanged 350000 us budget. Equal JSON bytes in opaque unknown-action Calls: p50 326719 / p99 363491 us (also slightly over budget under load); median canvas overhead 162803 us. Loads: canvas 24.13/26.89/23.63→17.23/23.98/22.86; control 20.90/19.41/20.78→17.66/18.79/20.51. No source fix or load generator. Repeat running. Failing test review_near_limit_imports_keep_keystroke_echo_within_budget committed d48526b498d984ffe5beae838f39cdf26a77da38 on review-canvas-doc. Logs will be preserved in docs/verification/canvas-doc-review-evidence.txt.
CDR-04 repeat confirmed: same release real-PTY test, 100 samples, p50 500280 us / p99 657966 us > 350000 us. Load 15.82/16.83/19.19→20.88/18.04/19.42; 300±30 ms RTT, CPUWeight=10000, 8 workers, WAL/NORMAL pool8. Failing test remains d48526b498d984ffe5beae838f39cdf26a77da38; no implementation change. Verdict will be merge after fixes, P0=0 P1=1 P2=0 P3=0. Broad latency profile exits1: production browser262passed/31failed/26skipped; paired native same-session flood fails target115.52ms growth and dev148.17ms (16.67ms budget). Focused dev browser10passed/4failed reproduces four target failures; remaining browser failures unattributed. Fast gate on evidence branch running.
Target
d1faaab838: independent scripts/verify fast exited 0. Verbatim output part 1/3 (short socket scratch alias; no baseline exception).Full gate output
Target
d1faaab838: independent scripts/verify fast exited 0. Verbatim output part 2/3 (short socket scratch alias; no baseline exception).Full gate output
Target
d1faaab838: independent scripts/verify fast exited 0. Verbatim output part 3/3 (short socket scratch alias; no baseline exception).Full gate output
Verdict: merge after fixes. New findings P0=0 P1=1 P2=0 P3=0.
Target canvas-doc
d1faaab838; merge base dev459070fe3b75548382e8e19fba86af20439cf607. Review head4f73975cb9on review-canvas-doc. CDR-04 must be fixed: inline Operation::decode at websocket.rs:400 delays following real-PTY input for seven valid near-cap imports (524275 B each, one <4 MiB message). Two 100-sample release runs p99 698037/657966 us vs unchanged350000 us budget; equal-payload opaque control p50 326719 us versus import489522/500280 us. Failing test commita8eebb6f00(amended from d48526b only to satisfy numeric-literal lint). Earlier CDR-01/02/03 regressions pass. No implementation fix.Source-head scripts/verify fast exit0; complete output posted verbatim in preceding three comments. Corrected evidence-branch fast also exit0: server135passed/0failed/15ignored, static x86/ARM16402992/13788496 B,162streams/17235schedules/zero codec divergences. No baseline-failure exemption. Source-head gate summary verbatim:
Broad scripts/verify latency exit1: browser262passed/31failed/26skipped; native same-session flood fails both target115.52ms growth and dev148.17ms vs16.67ms. Focused dev browser10passed/4failed reproduces four target failures; others remain unattributed. This gate is red. ASAN fuzz15111runs/121s, no crash or mismatch. Six earlier release canvas measurements pass, including small-edit realPTYp99336.302ms. Full metrics, loads and outputs: docs/verification/canvas-doc-review.md and canvas-doc-review-evidence.txt. State findings: /home/kayg/.local/state/codex-jobs/infraternal/review-canvas-doc/findings.md. Owned baseline/scratch removed after evidence retained. No push/deploy or remote benchmark host.
Starting repair round 2 on canvas-doc, base
d1faaab838. Read #98 and parent #93 comments, repository contract, architecture/process, and review2 findings. Merge local dev7d6df447first, retaina8eebb6fCDR-04 regression and confirm red before fixing bounded import work outside the multiplexed socket loop (D11). Re-run CDR-02/CDR-04 locally under CPUWeight=10000, report load and final fast gate. No push/deploy.Merged dev
7d6df447at b28c7cc0; no conflicts. Retained CDR-04 testa8eebb6fby cherry-pick (same existing ignored real-engine harness, seven 524275-byte imports before PTY input). Fresh fast gate is compiling dependencies; implementation remains unchanged while preparing the red release measurement. Proposed additive execution detail: reserve existing 16-entry FIFO before JSON parsing; bounded background work owns parsing/validation/remapping and transaction, with cooperative checkpoints. Atomic revision/publication and authority checks remain unchanged; no new library or wire change.Merge/test history now 228e8b19/fa06d890 (merge commit body corrected to include rationale and Refs; trees unchanged). Native gate formatting/Clippy and daemon/queue/snapshot/shim/credit suites pass so far. Optimized prebuild failed before any measurement: .cargo/musl-cc.sh requires target/auth-tools/zig/zig, not just Zig on PATH (red-build.log). Run scripts/auth-toolchain to stage the existing pinned compiler, then retry. No implementation change or credentials investigation.
Initial merge/test fast exits 1 solely in the merged tracer deferred transfer budget: gzip 51871/51200 B, Brotli 45352/45056 B (apps/tracer/transfer-budget.ts:67; merge-fast.log). All Rust rows PASS, server135/0failed/15ignored, static x86/ARM16402992/13788496 B (no PT_INTERP). Canvas-doc has no tracer source diff relative to merged dev7d6df447. No baseline exception applies to this row; repair the integration budget without widening it. Unchanged CDR-04 release reproduction now running on port4898, after all compilation finished.
CDR-04 reproduced on fa06d890 before production edits: release musl opt3/LTO, 100 real-PTY samples, seven valid524275-byte imports/message, 50-view/200-window recipient, RTT300±30ms, WAL/NORMAL pool8,8workers,CPUWeight10000,port4898. Echo p50=453292us/p99=609258us > unchanged350000us; exit101. Load9.22/16.07/22.99→14.85/16.74/22.78, no job compilation during measurement. Evidence: cdr04-red.log (to retain in verification report). Proceed with bounded background admission; keep atomic commit/publication and decoder unchanged.
Inherited dev transfer failure repaired by loading the existing share dialog/recipient input only on explicit Share action (D188). No UI primitive or budget duplication. Deferred gzip49497/51200B, Brotli43448/45056B; critical283676/307200B and235295/256000B; largest on-demand8494/20480B and7625/18432B. TS compiler/build/transfer pass. Production Playwright sharing/team-layout cases: initial1pass/1dialog-visibility timeout; unchanged retry2/2pass(36.6s), port4899, no deadline changes. Production screenshot captured (share-dialog.png); no visual-quality judgment. Full fast gate in progress, integration step will be committed separately before the import modules.
Integration/test step green: normalized history to merge
b4d1254e(dev7d6df447 plus inherited transfer fix, per PROCESS§4) and retained review-test child80403af8. Final tree identical to checked cdbd0aff; supersedes provisional228e8b19/fa06d890/cdbd0aff history. budget-fast.log scripts/verify fast exit0, all Rust rowsPASS, server135/0failed/15ignored; static16402992/13788496 B; differential162streams/17235schedules/zero divergences. Deferred49502/43458B below51200/45056B. Browser unchanged retry2/2pass, screenshot retained. Now gate store module separately: same16-entry FIFO plus raw-byte submissions and two shared blocking workers; socket still decodes inline until this module is gated. No decoder/wire/budget change.First store gate found a new lifecycle regression in existing account_queue_is_bounded_ordered_and_releases_idle_account: completion was sent from the blocking worker while its admission permit waited for the async join, so the next16-edit batch saw canvas busy. Move permit release/FIFO completion before reply. Same gate also failed the known expired_handshake_releases_user_permits pre-Hello503 assertion; no exemption claimed. Static x86 candidate16411792B exceeds16404816B by6976B. Type-erase the runtime-polled future as unit (as well as the blocking closure) to reduce specialization; no release-profile/size-budget change. queue-green.log and store-fast.log retained; store not committed until green.
Queue lifecycle fix passes targeted test(0.04s), full server135/0failed/15ignored. Targeted handshake repair/baseline dev7d6df447 bothpass(0.72/0.57s); no baseline exemption. The baseline shared CARGO_TARGET_DIR and overwrote protocol artifacts during repair doctests (missing CANVAS_CAP); setup error, baseline checkout removed and no further shared-target comparisons. Added error branch triggered single_match_else; corrected to if let. Second static candidate16413520B,8704B above cap; measure an erased deferred decoder to keep queued/task frames small. Budgets/profiles/decoder semantics unchanged; no store commit yet. Logs: store-fast-retry, handshake-target, handshake-baseline-retry, store-size3.
Erasing the queued decoder gives x86 static16413040B, still8224B over unchanged16404816B cap. Blocking a runtime over the entire async transaction adds too much runtime machinery. Next measured implementation reuses CDR-02's owned async FIFO for the durable phase, offloads strict JSON decode/validation to a bounded blocking task, and yields cooperatively between remapped views and CPU phases. Two shared job permits still bound work across accounts;16 FIFO permits and atomic transaction/publication remain. Existing Tokio/parser/SQLite only; no engine, profile, budget or wire change. Re-run correctness, static size and CDR-02/CDR-04 before accepting.
CDR-04 design refinement: extra blocking-parser executor/limiter candidates exceeded the unchanged 16,404,816-byte x86 cap (16,413,040 and 16,417,200 bytes). Measuring the existing detached account FIFO instead: sixteen submissions/account, raw input capped at 512 KiB + 128 before copying, yields around parsing and per remapped view, durable transaction off the device socket task. No engine/dependency change. Acceptance still requires CDR-02/CDR-04 <=350 ms at 300 +/-30 ms, full fast gate and scale evidence. The additional global limiter is removed; the existing per-account admission bound remains.
Completed store module:
d6bafdd0f5. Raw or typed edits share the detached, 16-submission/account FIFO; raw size checked at admission; parsing yields before its bounded unit, remapping yields per view, publication remains after durable commit. Permits release before completion. scripts/verify fast exit 0 (store-fast8.log): all six Rust rows PASS, server 135 passed/15 ignored, TypeScript/differential checks PASS. Static x86 16,404,720 B / ARM 13,790,352 B against unchanged caps; frontend critical gzip/brotli 283674/235318, deferred 49502/43458. Cache invalidation fixed stale baseline protocol artifacts; no failure exemption used. Socket still uses typed admission in this commit; raw socket wiring is next.Raw socket admission functional gate: all Rust rows except size PASS; server135 passed/15 ignored, including both deterministic CDR-02 writer/control tests. x86 binary 16,407,600 B, 2,784 B over unchanged cap. Measuring boxed decoder results to avoid moving a large Operation through erased-call/task state. No acceptance, deadline/profile adjustment, or new dependency.
CDR-04 boxed-result candidate (not accepted): real binary, 100 samples, 524275-byte valid imports x7, 300 +/-30 ms, CPUWeight10000, no own compilation during timing. p50 319678 us / p99 350007 us, still FAIL against 350000 us by 7 us; load15.60/16.48/18.78 ->8.82/14.37/17.89. Binary16407792 B also over cap. Replacing erased decoder closures with a typed/raw enum to reduce admission/task overhead and measuring again; neither limit is relaxed.
CDR-04 execution candidate now passes both unchanged budgets: x86 static16403184 B (<16404816); 100 real-PTY samples p50/p99 312656/343992 us (<350000), 524275-byte imports x7, 300 +/-30 ms, CPUWeight10000, no own compilation during timing. Load7.98/10.96/8.99 ->5.89/9.71/8.67. CDR-02 small-edit bursts16 x100:309016/338710 us PASS; load6.18/9.19/8.55 ->6.05/8.82/8.45. Reused detached FIFO with per-view yielding, direct ASCII ID indexing and one outlined borrowed-byte admission method; blocking/erased-decoder/nested-future candidates exceeded size cap. Gate/commit the store module independently next, then socket wiring, raw-queue tests and evidence. No timeout/size cap changed.
Completed compact/cooperative store module
d3b868fbc6. Borrowed/owned/typed adapters reuse one bounded FIFO; oversized slices allocate nothing; strict parsing and validation run in the background; remapping yields per view and uses direct ASCII indexing. Admission stays out of socket coroutine code. scripts/verify fast exit0 (store-adapter-fast.log): six Rust rows PASS, server135 passed/15 ignored, TypeScript/transfer/differential PASS (162 streams/17235 schedules/zero divergences). Static x86/ARM16403888/13789520 B, no PT_INTERP, unchanged caps. Store-only gate initially found an unused helper; replacing it with the existing input adapter avoided a lint suppression or wider public API. Socket remains typed in this independently gated commit; its borrowed-byte wiring follows.Completed socket module
567e092855: CanvasOp admits bounded borrowed bytes and leaves parsing/validation/remapping/durable work to the detached FIFO. Capability, selected account, device16-completion bound and existing ack/update order remain. scripts/verify fast exit0 (socket-adapter-fast.log): six Rust rows PASS; server135 passed/15 ignored, both CDR-02 writer/control regressions PASS; TypeScript/transfer/differential PASS (162 streams/17235 schedules/zero divergences). Static x86/ARM16403568/13789264 B, no PT_INTERP, unchanged caps. Fresh release harness built; running final CDR-04, CDR-02 and50-account scale separately with no own compilation during timing.Final production source567e0928: CDR-04 100 real-PTY samples p50/p99=316836/345139 us PASS at350000 us, 300 +/-30 ms, imports524275 B x7, recipient50 views/200 windows; load16.26/17.75/18.85 ->11.53/16.27/18.28. CDR-02 16 edits x100:301660/328738 us PASS; load9.04/15.39/17.95 ->6.55/14.07/17.41. Scale50 accounts x50 views x200 windows/250 sessions: retainedRSS6033408 B (120668 B/account), peak6336512 B; concurrent50 writes28201447/83753053 ns p50/p99; load5.49/13.09/16.98 ->6.02/12.71/16.77. All timed separately under CPUWeight10000, no own compilation. Static x86/ARM16403568/13789264 B. Adding raw queue/all-ID-character regression and retained evidence, then final fast gate.
Completed raw-queue/all-ID-character regression
e1a3abae3e. Real SQLite test passes (0.57s); final scripts/verify fast exit0: all six Rust rows PASS, server136 passed/15 ignored, transfer/protocol differential PASS. No production code changed after source567e0928; final CDR-04/CDR-02 and scale results remain as recorded. Evidence/contract clarification is the final separate documentation step.Finished CDR-04 repair on canvas-doc, head
af7b63e36e. Atomic merge/test/store/socket/regression/docs commits are recorded above. Imports parse/validate/remap/write in the bounded owned FIFO, with per-view yielding and atomic publication; terminal/control receive loop admits bytes only.Final real-PTY CDR-04 p50/p99 316836/345139 us; load16.26/17.75/18.85 ->11.53/16.27/18.28. CDR-02 301660/328738 us; load9.04/15.39/17.95 ->6.55/14.07/17.41. Both PASS unchanged350000 us at300 +/-30 ms,100 samples,50 views/200 windows,CPUWeight10000,no own compilation during timing. Scale50 accounts/250 sessions retainedRSS6033408 B (120668 B/account); concurrent50 writes28201447/83753053 ns p50/p99, load5.49/13.09/16.98 ->6.02/12.71/16.77.
Final scripts/verify fast exit0: server136 passed/15 ignored; x86/ARM16403568/13789264 B below unchanged caps, no PT_INTERP; TypeScript/transfer checks PASS. No baseline exemption, engine/dependency/profile/budget change, push, deployment or issue closure. Author reviewer checklist completed. Full unedited gate/metric logs: docs/verification/canvas-import-repair-evidence.txt; report: docs/verification/canvas-import-repair.md; production screenshot for independent visual review: docs/verification/canvas-import-share.png. Job-local scratch is being removed after retaining evidence. Final gate output follows verbatim:
Independent repair verification resumes on review-canvas-doc at target
af7b63e36e; merge base dev7d6df4470cfce59661225c0f3dbcbf2a36827ab1. Read prior issue/parent history and preserved earlier review branch as review-canvas-doc-before-af7b63e3. Reverify CDR-04 and other retained regressions, ordering/access/import bounds and scale. Tests/evidence only; no implementation fix, push or deploy.Starting final-head CDR-04 verification on canvas-doc, base
af7b63e36e. Read repository rules, review4f73975c, #98 and parent #93 history. Review testa8eebb6fis already preserved as80403af8; attempted cherry-pick conflicts only with later raw-queue regression, resolves to an empty patch, then skipped. Existing test and production code unchanged. Build fresh release harness/CLI, run review burst three times and CDR-02 under local CPUWeight=10000 with load/unique port, then canvas and fast gates. No push/deploy.Independent verification at
af7b63e3: production-source canvas_op_decode ASAN fuzz exits0, 20,000 executions in77s, cov4634/ft11689, corpus677/79MiB, peak RSS537MiB; no crash or derived-decoder mismatch. Toolchain nightly-2026-10-01, CPUWeight10000, bounded120s/20000 runs. Fast initial native fixture refused112B socket path; unchanged retry uses short job-scratch alias. First focused production sharing/team-layout browser run1pass/1dialog-visibility timeout; retry after own compilation remains pending. No new confirmed finding. Raw evidence will be committed before scratch cleanup.Fresh final-head CDR-04 run 1 FAIL on
af7b63e3: p50/p99 330238/363456 us versus unchanged 350000 us; 100 samples, seven 524275-byte imports, 50 views/200 windows, RTT300 +/-30ms, real PTY, WAL/NORMAL pool8, eight runtime workers, CPUWeight10000, port4998. Load15.40/20.35/19.39 ->21.35/21.10/19.71; no own compilation during timing. Log cdr04-1.log will be retained. Existing raw admission fixed older inline socket decoding, but store.rs:368 decode and edit_inner:394 validation still execute synchronously on shared Tokio workers. Completing all three runs and payload/control comparison before repair; deadline unchanged.Initial final-head verification complete at
af7b63e3: CDR-04 p50/p99 330238/363456, 325263/375425, 326859/365914 us, all FAIL350000 us; loads15.40/20.35/19.39→21.35/21.10/19.71,21.35/21.10/19.71→26.29/22.68/20.36,26.29/22.68/20.36→20.35/21.62/20.15. CDR-02 PASS308438/339845 us, load20.48/21.63/20.16→18.94/21.09/20.03. Release canvas suite36passed/6ignored (3.16s). All local CPUWeight10000, no own concurrent builds. Older review head is not the sole explanation. Equal-payload control in progress.Proposed execution-only repair (D11,D41,D183): raw FIFO submissions decode AND strictly validate on Tokio's existing blocking pool before the account state lock; the existing FIFO bounds this to one CPU job/account (50 at D170 scale), with the same16 total submissions/account. Reuse Operation::decode and keep typed fixtures' validation; no second parser, wire change, new dependency, deadline or authority relaxation. Per-view remapping still yields. Measure fresh CDR-04/CDR-02 and size before acceptance; report justified size increase under owner's D205 rule if any.
Fresh target
af7b63e3scripts/verify fast exits0: server136passed/15ignored, migration1/1, preserved CDR-01/02/03 and raw-queue/reference regressions pass; static x86/ARM16403568/13789264B, PT_INTERP absent;162streams/17235schedules/zero codec divergences. Initial gate stopped only on112B fixture socket setup, corrected with a shorter scratch alias; no baseline exemption. Independent CDR-04 release real-PTY100samples at300±30ms,50views/200windows,WAL/NORMAL pool8,8workers,CPUWeight10000: p50/p99=322614/346506us<=350000us PASS; load12.46/18.50/19.22→9.48/16.55/18.50. No own compilation during timing. CDR-02/scale and browser retry next; no confirmed new finding. Full raw gate/metrics will be committed with final evidence.Equal-payload pre-fix control PASS: p50/p99311532/335972 us, load16.62/20.25/19.79→14.11/19.20/19.45. Sequential shared-host samples are not causal attribution, but control passes while all three import runs fail. Candidate offloads raw strict decode+validation to existing Tokio blocking pool; permits/FIFO remain intact. Fresh x86 musl CLI16412016 B (+8448 B vs identical pre-fix16403568), 7200 B above branch's older16404816 cap. Increase is blocking-task join/runtime code; no dependency/feature/profile changes. Per explicit owner D205 brief, retain/report this justified size check failure rather than widening caps or removing responsiveness work. Await fresh latency/correctness evidence before acceptance; harness rebuild in progress.
Candidate store-only repair passes all three unchanged CDR-04 runs: p50/p99315367/338648,312588/337245,314802/337762 us (100samples/run,7x524275B imports); loads7.57/12.01/16.29→5.11/10.66/15.60,4.78/10.50/15.52→4.10/9.44/14.90,3.85/9.30/14.82→3.21/8.30/14.19. CDR-02 PASS305498/331781 us, load3.04/8.18/14.12→2.64/7.59/13.74. Real-engine release canvas suite36passed/0failed/6ignored (2.67s), including CDR-01/02/03 and raw admission/FIFO recovery. All CPUWeight10000,RTT300+/-30ms,realPTY,WAL/NORMALpool8,8workers,port4998,no own compilation. Lower loads prevent causal before/after speed claims; all original failing outputs remain recorded. Scale and full fast gate follow before commit.
Evidence committed29bf7e74 on review-canvas-doc: docs/verification/canvas-doc-review.md, full raw evidence, settled1440×900/393×852 screenshots. Production unchanged. Fast0/server136pass/migration1pass, ASAN20000/77s/no mismatch, CDR-04 p99=346506us, CDR-02 completed retry p99=337789us, both<=350000us. At50accounts retainedRSS6369280B (127385/account), normal-write p99=5150903ns,50concurrent p99=84426739ns. Initial CDR-02 socket close at24.09s remains unattributed and is retained; browser initial1pass/1visibility timeout, unchanged focused retry2/2pass. Temporary capture tests removed. Native latency gate running; final verdict pending.
Candidate typed scale passes:50accounts x50views x200windows/250sessions, WAL/NORMALpool8, load2.80/7.08/13.34→4.82/7.24/13.26. Retained6389760B(127795/account),peak6873088B; concurrent50write p50/p9935161815/122279631ns. This existing fixture path bypasses raw decoding, so it does not measure added blocking-worker RSS. Extended the existing ignored canvas_scale benchmark to submit raw JSON in measured sequential/concurrent workloads and report post-workload RSS, retaining typed seeding and all existing transaction/replay/fan-out measurements. Separate test/measurement commit planned; no production changes beyond store.rs. Fast gate compiling now, then fresh raw scale under CPUWeight10000 without concurrent builds.
First candidate scripts/verify fast exit1: fmt/native fmt/Clippy/cargo-deny PASS; test FAIL101 only attached_backpressure_and_detached_progress at crates/infraternal/tests/shim.rs:193, stalled head944 below minimum1835 (6shim pass/1fail,14.12s); static FAIL1 x86size16412016 >16404816 by7200B. No exemption applies to this shim row, no deadline changed. Running full unchanged retry; retain both outputs. Latest independent review on
af7b63e3reports one passing CDR-04 run346506us at lower12.46→9.48 load; our three failing runs and later three candidate passes remain evidence, without claiming a controlled causal speed delta. Raw-scale/TS/ARM completion follows the retry.Native real-PTY latency gate on targetaf7b63e3 exits1: baseline echo p99=326.45ms PASS; other-session flood310.95ms PASS; same-session flood510.77ms FAIL, growth184.31ms>16.67ms (absolute334ms). Confirmed same-session echo439.69ms also fails334ms. End load11.53/8.50/13.27,8cores,CPUWeight10000,300±30ms,port4998; no own compilation during probes. This native fixture sends no canvas operations. Previous review reproduced the same failure on dev459070fe; fresh pinned dev7d6df447 comparator is compiling in an isolated baseline target. No new canvas finding is attributed yet. Raw output will join committed review evidence after comparison.
Completed store repair
dc24863c82(D11,D41,D183,D205). Three unchanged CDR-04 p99 results338648/337245/337762us; CDR-02 331781us; release canvas36pass. Full fast retry exits1 solely older x86size cap:16412016B (+8448;7200over cap), reported per D205; every other Rust row PASS, server136pass/15ignored, migration1pass. Separate TypeScript/transfer/differential exits0 (162streams/17235schedules/zero divergences). First shim failure retained; unchanged retry passes, no exemption. ARM build and raw-path scale follow. Gate summary verbatim:Verdict: merge. New confirmed findings P0=0/P1=0/P2=0/P3=0.
Target
af7b63e36e; merge base dev7d6df4470cfce59661225c0f3dbcbf2a36827ab1. Review head35e4791301on local review-canvas-doc; evidence commits29bf7e74 and35e47913. Prior review retained as review-canvas-doc-before-af7b63e3. No implementation change, push, deployment or issue closure.CDR-01/02/03 functional regressions and CDR-04 real-PTY regression pass. CDR-04 p99=346506us; CDR-02 completed retry337789us, both<=350000us at300±30ms,100samples,50views/200layout references,CPUWeight10000. At50accounts/250authority sessions, retainedRSS6369280B (127385/account); normal-write p99=5150903ns,50concurrent p99=84426739ns. ASAN20000runs/77s/no crash or differential mismatch. Production sharing/team-layout unchanged retry2/2pass; settled1440×900/393×852 captures retained. Temporary capture tests removed.
Limits preserved: initial CDR-02 WebSocket close24.09s remains unattributed; first focused browser run1pass/1visibility timeout. Native target/dev7d6df447 both exit1 on same-session echo/growth: target510.77/184.31ms; dev414.39/84.58ms, budgets334/16.67ms. Target-only confirmed same-session439.69ms failure does not reproduce on dev326.92ms and remains unattributed. Different shared-host load windows do not quantify a causal regression. Broad tracer suite/physical iPhone not rerun in this repair delta. No deadline/budget changes or fast-gate baseline exemption.
Evidence: docs/verification/canvas-doc-review.md, canvas-doc-review-evidence.txt, canvas-doc-review-desktop.png and canvas-doc-review-phone.png. Fresh source-head scripts/verify fast exits0: server136passed/15ignored, migration1/1, all Rust rowsPASS, staticx86/ARM16403568/13789264B/no PT_INTERP, compiler/transfer/protocol differentialPASS (162streams/17235schedules/zero divergences). Devx86=15965392B; canvas code/features add438176B; evidence adds0 production bytes. Complete gate output is posted verbatim in the following numbered comments. Job-local baseline/targets are removed after retaining evidence.
Target
af7b63e3, review head35e4791301. scripts/verify fast exit0: complete captured output part1/5, verbatim.Full gate output
Target
af7b63e3, review head35e4791301. scripts/verify fast exit0: complete captured output part2/5, verbatim.Full gate output
Target
af7b63e3, review head35e4791301. scripts/verify fast exit0: complete captured output part3/5, verbatim.Full gate output
Target
af7b63e3, review head35e4791301. scripts/verify fast exit0: complete captured output part4/5, verbatim.Full gate output
Target
af7b63e3, review head35e4791301. scripts/verify fast exit0: complete captured output part5/5, verbatim.Full gate output
Completed raw-scale measurement step957c30315d7f93d9474da942fc913901af22c33d. RealSQLiteWAL/NORMALpool8,8workers,50accounts x50views/200windows,250device sessions,CPUWeight10000: raw normal p50/p991062291/7191488ns; concurrent50 47718811/188556829ns; seededRSSdelta5656576B, rawpost-workload6508544B(130170/account),peak6508544B. Load15.71/23.27/24.08→17.58/23.17/24.03; exit0/23.70s, no own concurrent builds. Production bytes unchanged by this test-only commit. Separate TS/transfer/differential exit0; ARMstatic13797056B (+7792), within13817816cap/noPT_INTERP/stripped; CLI smoke checks and cargo tree-d pass. Final burst confirmation is running against committed957c3031 with productiondc24863c; then evidence/docs and finish. No push/deploy.
Committed-source confirmation at957c3031 fails under higher load: first two CDR-04 p50/p99338093/383612 and334867/386555us vs350000; load21.53/23.46/24.09→39.34/28.26/25.69 and39.34/28.26/25.69→34.01/28.93/26.12. Retain final/cdr04-{1,2}.log; remaining repeat/CDR-02 in progress. No own compilation. Earlier lower-load three passes are not final acceptance.
Remaining synchronous CPU is visible in store.rs remap/canonical serialization and ops.rs:295/312 normalized-operation/final-document validation, still polled by shared Tokio workers. Investigate equal-payload control after repeats. Proposed refinement: the same admitted per-account FIFO drives decode/remap/apply/publication from one existing blocking worker using the current Tokio runtime handle for async SQLite waits; one active worker/account,16outstanding,50workers at D170scale. Retain atomic transaction/authority/FIFO/permit release, existing parser/database/runtime and deadlines; measure memory/size/latency. Reject more pre-CPU yields because canonical serialization and validation remain synchronous units. Owner D205 permits reporting blocking-task size growth; no cap change.
CDR-05 P2: interrupted deferred sharing module cannot retry. Supersedes provisional P2=0 completion: counts now P0=0 P1=0 P2=1 P3=0. Test commit
9f9169fbon review-canvas-doc; source targetaf7b63e3unchanged. apps/tracer/src/canvas/sharing/index.ts:63 uses the same dynamic import URL after failure. Production browser test aborts only first dialog chunk, permits later requests: first action shows retry toast; second action produces no dialog. Two runs fail13.4/13.8s; confirmation request count expected2 received1 after5s. Failing test apps/tracer/test/clusters.spec.ts:1180, review sharing retries an interrupted dialog module on the next action. Evidence retained in docs/verification/canvas-doc-review-evidence.txt. No implementation fix. D206 permits P2 fix forward; verdict remains merge with this gap tracked. Final review-head fast gate is running.Final partial-worker confirmation is not accepted: all three CDR-04 p99 results383612/386555/399442us FAIL350000; third load33.93/29.00/26.16→33.04/29.72/26.62. CDR-02 then closes socket without latency at21.99s (auth/tests.rs:1714); correctness suite36pass/6ignored. Loaded opaque control exits101 before a metric (7.17s, canvas_burst_tests.rs unexpected response), so these loaded failures cannot all be attributed to canvas CPU. Evidence retained in final/ and opaque-loaded.log.
Refinement in store.rs now uses one admitted blocking worker for decode AND the existing async transaction via the current Tokio Handle, keeping remap/serialization/final validation/publication CPU off terminal runtime workers. FIFO16 and oneactivejob/account remain. No engine/runtime constructed, wire/deadline/authority change. Added value-free Close-code/frame-discriminant diagnostics to the existing burst harness; no payloads logged. Formatting passes; native Clippy/canvas tests and release rebuild underway. This is a second store-module step, with diagnostics in a separate test commit after gates.
Full-worker native Clippy passes; complete-environment canvas suite36passed/0failed/6ignored (16.26s). Initial suite had one websocket closure at auth/tests.rs:1714; exact independent-edit ordering retry passes1/1 (1.03s). Two direct-harness retries lacked CARGO_TARGET_DIR and failed fixture setup; retained as harness errors, corrected complete-environment suite above passes. No exemption used. Refinement release rebuild ongoing; no latency acceptance yet. Contract clarification will describe one worker/account polling the existing transaction, not a new runtime/engine; bounds unchanged.
Full-worker-only CDR-04 run1 still FAIL: p50/p99=325714/408280us, load7.00/19.41/24.95→11.25/18.19/24.17,66.38s. Existing failing review workload retained; all3attempts continue unchanged. Additional lock finding: store.rs edit_inner takes global writer and starts CAS transaction before apply detects combined document view limit; seven impossible imports repeatedly occupy the same SQLite writer as terminal acknowledgements. Proposed additive invariant: after strict incoming validation and account-state acquisition, reject Import when incoming+recipient views exceed existing MAX_VIEWS, before remap/serialization/writer; unchanged error "view limit", no mutation/revision/publication. Other operations and accepted imports retain transactional authority/CAS/tombstone checks. This avoids useless shared-writer ownership; full-worker-only results remain evidence, not acceptance.
Final corrected disposition: merge under D206, with CDR-05 P2 fix forward. New confirmed counts P0=0 P1=0 P2=1 P3=0. This supersedes the earlier provisional zero-finding finish. Target
af7b63e3unchanged; review branch review-canvas-doc headc6e918d464; failing browser regression commit9f9169fb. No implementation fixes/push/deploy; issue remains open.CDR-05: first deferred dialog chunk request interrupted, later requests permitted. First Share action displays retry toast; second action makes no new request and never opens dialog. Two production-browser failures13.4/13.8s; expected2 requests, received1. Test apps/tracer/test/clusters.spec.ts:1180. Evidence docs/verification/canvas-doc-review.md and canvas-doc-review-evidence.txt, plus desktop/phone screenshots.
Final scripts/verify fast exits0 with107-byte scratch socket path and serial Rust tests, no deadline changes or baseline exemption. Server136pass/15ignored, migration1/1; all Rust rowsPASS; tracer/compiler/transferPASS; differential162streams/17235schedules/zero divergences; protocol7pass/0fail/51790expects. Prior final attempts retain two calibration failures; two134pass/2fail Rust runs (112-byte fixture refusal plus writer deadline or canvas socket close). All three failed tests pass unchanged in final run. Unattributed earlier socket closes/browser timeout/native target-only confirmed-echo failure remain recorded. Native same-session echo/growth fails on both target and detached dev; loads differ and no causal regression is claimed. Canvas CDR-04/02 p99=346506/337789us<=350000us; ASAN20000runs/no crash; 50accounts retainedRSS6369280B. Staticx86/ARM16403568/13789264B; devx86delta438176B, reviewadds0. No physical iPhone/broad tracer rerun.
Complete final gate follows verbatim in numbered comments; original source-head fast output already posted verbatim. Private baseline/build targets are removed after retaining evidence.
Target
af7b63e3; review headc6e918d464; scripts/verify fast exit0. Complete final captured output part1/6, verbatim.Running as unit: run-p3757572-i28912120.scope; invocation ID: 3351e71713684b7bb99a488ce3f3c59b
METRIC name=network_rtt_selftest configured_rtt_ms=300 jitter_ms=30 loss=unsupported transport=tcp-stream n=3 p50_ms=303.48 p99_ms=318.30 result=PASS
==> fmt
==> VT native fmt
==> clippy
Finished
devprofile [unoptimized + debuginfo] target(s) in 0.90s==> test
Finished
testprofile [unoptimized + debuginfo] target(s) in 0.53sRunning unittests src/main.rs (/home/kayg/.cache/codex-scratch/canvas-doc-review/target/debug/deps/infraternal-66820ec07a4ee827)
running 2 tests
test install::tests::dry_run_prints_a_process_surviving_user_unit ... ok
test setup_token_tests::setup_token_command_reads_only_the_expected_socket_response ... ok
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
running 1 test
test real_binary_preserves_input_and_output_across_24_abrupt_stops ... ok
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 40.74s
running 1 test
test saturated_terminal_queues_preserve_every_byte_and_daemon_liveness ... ok
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 35.79s
running 6 tests
test initial_attach_requires_explicit_credit_before_replay ... ok
test last_typist_selects_its_own_real_pty_dimensions ... ok
test repeated_tiny_credit_pauses_preserve_shell_progress ... ok
test retained_unwritten_input_survives_interleaved_ack_restart ... ok
test stalled_terminal_never_delays_control_or_sibling_dispatch ... ok
test two_writers_keep_independent_ack_and_exact_input_after_restart ... ok
test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 27.54s
running 1 test
test detached_shim_is_discovered_and_replays_from_the_last_observed_offset ... ok
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.04s
running 1 test
test one_hertz_wakeup_is_detected_past_the_legacy_half_second_window ... ok
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.11s
running 7 tests
test attached_backpressure_and_detached_progress ... ok
test disallowed_signal_only_disconnects_peer ... ok
test double_fork_survives_parent_death ... ok
test real_shell_reconnect_resize_and_retained_exit ... ok
test replacement_connection_and_malformed_limit ... ok
test ring_wrap_snapshot_repaints_real_vim ... ok
test user_scope_survives_parent_unit_stop ... active
ok
test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.00s
running 1 test
test unaffordable_repaints_park_until_sufficient_credit ... ok
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 19.95s
running 1 test
test snapshot_limits_never_close_live_reconnect ... ok
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 15.71s
running 16 tests
test relay::tests::attachment_has_no_implicit_output_or_snapshot_credit ... ok
test relay::tests::expired_credit_resumes_retained_bytes_at_the_same_cursor ... ok
test relay::tests::input_overlap_gap_and_restart_from_confirmed_offset ... ok
test relay::tests::output_partial_credit_and_dedup ... ok
test relay::tests::output_payload_move_measurement ... ignored, release ownership versus payload-copy measurement
test relay::tests::overflowing_ranges_never_mutate_cursors ... ok
test relay::tests::positive_insufficient_credit_arms_a_one_shot_deadline ... ok
test relay::tests::returned_credit_cancels_starvation_and_state_has_no_payload_buffer ... ok
test relay::tests::starvation_is_one_shot_and_snapshot_length_does_not_advance_sequence ... ok
test sessions::tests::borrowed_reader_payload_uses_reusable_cancel_safe_storage ... ok
test sessions::tests::cancelled_fragmented_shim_read_retains_header_and_body_progress ... ok
test sessions::tests::post_listen_chmod_wakes_a_connection_refused_at_bind ... ok
test sessions::tests::reader_borrow_measurement ... ignored, release borrowed versus owned asynchronous receive measurement
test sessions::tests::refused_socket_is_removed_but_insecure_directory_is_rejected ... ok
test sessions::tests::sequenced_attach_intersects_caps_and_legacy_attach_stays_zero ... ok
test sessions::tests::symlink_state_cannot_redirect_private_runtime_storage ... ok
test result: ok. 14 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 0.06s
running 2 tests
test fragmented_headers_coalesced_frames_and_reusable_transmit ... ok
test oversized_header_and_truncated_frame_are_rejected ... ok
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
running 0 tests
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
running 1 test
test omitted_arrow_ports_default_to_all_services ... ok
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
running 14 tests
test addresses_are_unique_stable_and_not_recycled ... ok
test arrow_replacement_is_atomic_and_unrelated_nodes_keep_their_versions ... ok
test checkpoint_after_suffix_change_restores_without_reallocating_addresses ... ok
test directional_grants_union_and_minimal_updates ... ok
test exhausted_versions_reject_mutations_without_changing_state ... ok
test join_to_same_tag_grants_both_initiation_directions ... ok
test names_versions_and_backend_status ... ok
test overlaps_are_reported_without_silent_range_changes ... ok
test private_material_never_enters_debug_or_coordination_serialization ... ok
test protocol_port_unions_never_grant_an_unlisted_service ... ok
test public_checkpoint_preserves_addresses_rules_versions_and_overlap ... ok
test rotation_waits_for_overlap_and_delivery_and_removal_drops_every_key ... ok
test seeded_random_sequences_equal_full_compile_and_deny_without_grants ... ok
test server_rotation_has_continuous_keys_for_every_node_during_delivery ... ok
test result: ok. 14 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.78s
running 1 test
test unrepresentable_rotation_overlap_rejects_before_mutation ... ok
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
running 0 tests
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
running 0 tests
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
running 7 tests
test stream_tests::all_short_frame_splits_match_direct_decoding ... ok
test stream_tests::maximum_sized_fragmented_frame_is_not_rejected ... ok
test stream_tests::split_mux_header_preserves_trailing_close ... ok
test tests::golden_vectors_encode_and_decode_every_contract_frame ... ok
test tests::mux_round_trip_and_incremental_decoders_preserve_frame_order ... ok
test tests::oversized_encode_keeps_the_reusable_output_unchanged ... ok
test tests::rejects_oversized_noncanonical_and_malformed_frames_before_buffering_body ... ok
test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
running 151 tests
test auth::crypto::verifier_tests::browser_secret_hashing_is_canonical_and_bounded ... ok
test auth::crypto::verifier_tests::recovery_capacity_denial_is_not_a_legacy_credential_signal ... ok
test auth::http::hostname_tests::authenticated_session_response_includes_system_hostname ... ok
test auth::http::tests::admission_partitions_reset_without_trusting_forwarded_headers ... ok
test auth::tests::aaguid_migration_preserves_legacy_credentials_and_sessions ... ok
test auth::tests::aaguid_projection_rejects_malformed_cbor_corpus ... ok
test auth::tests::account_identity_migration_backfills_legacy_users ... ok
test auth::tests::account_identity_schema_has_unique_usernames_and_display_names ... ok
test auth::tests::audit_ceremony_browser_binding ... ok
test auth::tests::audit_logout_survives_admission_exhaustion ... ok
test auth::tests::audit_no_public_credential_listing ... ok
test auth::tests::audit_recovery_after_page_discard_can_resume_at_original_deadline ... ok
test auth::tests::audit_recovery_pending_is_visible_to_signed_in_device ... ok
test auth::tests::audit_recovery_session_expiring_during_verification_keeps_delay ... ok
test auth::tests::authenticated_prf_metadata_preserves_legacy_envelopes ... ok
test auth::tests::ceremony_prf_wraps_and_optional_second_passkey ... ok
test auth::tests::concurrent_owner_and_optional_passkey_enrollment_fail_closed ... ok
test auth::tests::discoverable_latency_at_pending_capacity ... ignored, run --release --ignored --nocapture without concurrent builds
test auth::tests::discoverable_login_handle_credential_counter_and_replay ... ok
test auth::tests::enrollment_prf_input_matches_discoverable_login ... ok
test auth::tests::http_csrf_cookie_flags_body_limit_and_latency_evidence ... ok
test auth::tests::pending_unlock_expires_without_terminal_authority ... ok
test auth::tests::provider_labels_cover_the_cited_registry_without_guessing ... ok
test auth::tests::provider_session_latency_at_50_devices ... ignored, local auth session scale measurement; run without concurrent builds
test auth::tests::public_status_and_discoverable_http_login ... ok
test auth::tests::recovery_audit_commits_once_with_start_cancel_and_complete ... ok
test auth::tests::recovery_delay_cancel_and_replacement_revokes_every_capability ... ok
test auth::tests::recovery_expiry_revocation_and_cross_user_isolation ... ok
test auth::tests::recovery_http_live_same_account_is_immediate ... ok
test auth::tests::recovery_http_other_expired_pending_and_missing_sessions_wait ... ok
test auth::tests::recovery_live_session_cannot_accelerate_an_active_delayed_request ... ok
test auth::tests::recovery_live_session_revoked_during_verification_cannot_waive_delay ... ok
test auth::tests::recovery_session_delay_latency_at_capacity ... ignored, release-only recovery measurement at 50 live sessions; run without concurrent compilation
test auth::tests::recovery_unknown_identity_pays_the_same_database_and_verifier_work ... ok
test auth::tests::recovery_username_identity_is_additive_and_ambiguous_forms_fail ... ok
test auth::tests::recovery_verifier_latency_at_capacity ... ignored, release-only v2 diagnostic at 50 live session rows; record host load separately
test auth::tests::redacted_unknown_and_failed_registrations_do_not_claim_a_provider ... ok
test auth::tests::registration_aaguid_survives_none_attestation_and_binds_session_provider ... ok
test auth::tests::rejected_origin_uv_challenge_signature_prf_and_expired_ceremonies ... ok
test auth::tests::review3_tests::review3_backend_reply_has_a_deadline ... ok
test auth::tests::review3_tests::review3_busy_expiry ... ok
test auth::tests::review3_tests::review3_busy_logout ... ok
test auth::tests::review3_tests::review3_busy_recovery ... ok
test auth::tests::review3_tests::review3_completion_and_cleanup_are_transaction_bound ... ok
test auth::tests::review3_tests::review3_expired_handshake_must_not_welcome ... ok
test auth::tests::review3_tests::review3_identified_privacy_timing_and_binding_replays ... ok
test auth::tests::review3_tests::review3_pending_routes_and_idle_expiry_recovery ... ok
test auth::tests::review3_tests::review3_revoked_handshake_must_not_welcome ... ok
test auth::tests::review3_tests::review3_revoked_resume_must_not_welcome ... ok
test auth::tests::review3_tests::review3_unwrap_cannot_be_skipped ... ok
Target
af7b63e3; review headc6e918d464; scripts/verify fast exit0. Complete final captured output part2/6, verbatim.test auth::tests::review3_tests::review3_waiting_handshake_loses_authority ... ok
test auth::tests::review3_tests::review4_open_reply_and_revocation_preserve_authority ... ok
test auth::tests::review3_tests::review4_slow_open_at_user_capacity ... ignored, release-only connect scale measurement; run without concurrent builds
test auth::tests::review_invalid_device_polling_exhausts_browser_budget ... ok
test auth::tests::review_old_words_race_rotation ... ok
test auth::tests::reviewer_tests::reviewer_disk_cancel_complete_races ... ok
test auth::tests::reviewer_tests::reviewer_disk_restart_and_concurrent_resume ... ok
test auth::tests::reviewer_tests::reviewer_http_denials_and_recovery_admission ... ok
test auth::tests::reviewer_tests::reviewer_http_expired_capability_cannot_complete_after_writer_wait ... ok
test auth::tests::reviewer_tests::reviewer_http_expired_ceremony_cannot_complete_after_writer_wait ... ok
test auth::tests::reviewer_tests::reviewer_server_clock_rollback_retains_deadline_and_reports_more_than_day ... ok
test auth::tests::rotation_tests::recovery_phrase_routes_are_removed_and_words_fail_closed ... ok
test auth::tests::rotation_tests::recovery_rotation_cannot_follow_a_cookie_account_switch ... ok
test auth::tests::rotation_tests::recovery_rotation_denies_pending_expired_and_stale_sessions ... ok
test auth::tests::rotation_tests::recovery_rotation_requires_session_and_replaces_legacy_envelope ... ok
test auth::tests::rotation_tests::reviewer_concurrent_signed_in_rotations_commit_once ... ok
test auth::tests::server_setup_terminal_echo_and_resume_preserve_offsets_once ... ok
test auth::tests::sessions_slide_but_fresh_tap_does_not_and_device_keys_are_scoped ... ok
test auth::tests::setup_check_is_non_consuming_and_closes_after_owner_creation ... ok
test auth::tests::setup_identity_validation_and_uniqueness ... ok
test auth::tests::setup_restart_rotation_expiry_and_parallel_redemption ... ok
test auth::tests::setup_start_accepts_username_and_display_name ... ok
test auth::tests::socket_tests::authenticated_idle_socket_survives_the_former_read_timeout ... ok
test auth::tests::socket_tests::canvas::burst::account_queue_is_bounded_ordered_and_releases_idle_account ... ok
test auth::tests::socket_tests::canvas::burst::canvas_burst_keystroke_echo_at_300ms ... ignored, real binary and unique TRACER_TEST_PORT required; run under CPUWeight=10000
test auth::tests::socket_tests::canvas::burst::raw_queue_bounds_decode_and_keeps_import_atomic_after_invalid_json ... ok
test auth::tests::socket_tests::canvas::burst::review_near_limit_imports_keep_keystroke_echo_within_budget ... ignored, real binary and unique TRACER_TEST_PORT required; run under CPUWeight=10000
test auth::tests::socket_tests::canvas::burst::writer_wait_does_not_delay_echo_or_publish_an_undurable_ack ... ok
test auth::tests::socket_tests::canvas::canvas_ack_cannot_hide_another_devices_independent_edit ... ok
test auth::tests::socket_tests::canvas::canvas_concurrent_close_and_move_cannot_resurrect ... ok
test auth::tests::socket_tests::canvas::canvas_five_devices_at_300ms ... ignored, release-only 300ms RTT measurement under a CPUWeight=10000 scope
test auth::tests::socket_tests::canvas::canvas_import_copies_layout_and_fanout_is_account_scoped ... ok
test auth::tests::socket_tests::canvas::canvas_requires_capability_and_control_stream ... ok
test auth::tests::socket_tests::canvas::canvas_two_devices_conflict_reconnect_and_revocation ... ok
test auth::tests::socket_tests::canvas::review_canvas_waiting_for_writer_does_not_block_control_frames ... ok
test auth::tests::socket_tests::clean_control_close_is_not_an_internal_error ... ok
test auth::tests::socket_tests::expired_handshake_releases_user_permits ... ok
test auth::tests::socket_tests::fragmented_wire_frame_has_a_completion_deadline ... ok
test auth::tests::socket_tests::half_open_sockets_obey_user_limit ... ok
test auth::tests::socket_tests::incomplete_rfc_message_still_loses_authority_on_revocation ... ok
test auth::tests::socket_tests::recovery_subscription_updates_every_signed_in_socket ... ok
test auth::tests::socket_tests::revoked_idle_socket_loses_all_authority ... ok
test auth::tests::socket_tests::socket_authority_latency_at_user_capacity ... ignored, release-only measurement without concurrent compilation
test auth::tests::stale_counters_recovery_cancellation_and_wrap_tampering ... ok
test canvas::bench::canvas_export_privacy_scale ... ignored, release-only export measurement under a CPUWeight=10000 scope
test canvas::bench::canvas_scale ... ignored, release-only measurement under a CPUWeight=10000 scope
test canvas::bench::canvas_weight_decode ... ignored, release-only decoder measurement under a CPUWeight=10000 scope
test canvas::decoder_tests::all_operation_golden_vectors_match_derived_decoder ... ok
test canvas::decoder_tests::escaped_discriminator_and_reordered_fields_remain_valid ... ok
test canvas::decoder_tests::malformed_operations_fail_both_decoders ... ok
test canvas::import_bounds_tests::copied_short_ids_avoid_live_and_retired_namespaces ... ok
test canvas::import_bounds_tests::near_cap_document_has_room_for_its_import_envelope ... ok
test canvas::pin_tests::document_requires_pinned_even_when_unpinned ... ok
test canvas::pin_tests::pin_operation_requires_position_even_when_unpinning ... ok
test canvas::precision_tests::journal_json_preserves_every_valid_relative_weight ... ok
test canvas::tests::account_limits_reject_views_windows_and_oversized_json ... ok
test canvas::tests::cancelled_waiter_does_not_split_commit_from_cached_revision ... ok
test canvas::tests::close_after_move_or_resize_and_graph_pin_cannot_resurrect ... ok
test canvas::tests::export_redacts_punctuated_ip_labels ... ok
test canvas::tests::export_redacts_question_marks_and_ipv6_zone_labels ... ok
test canvas::tests::exported_large_valid_document_can_be_imported ... ok
test canvas::tests::exports_redact_address_forms_on_every_readable_label ... ok
test canvas::tests::exports_redact_addresses_and_roundtrip_layout ... ok
test canvas::tests::file_restart_keeps_tombstones_after_checkpoint_replacement ... ok
test canvas::tests::golden_roundtrip_and_validation ... ok
test canvas::tests::invalid_authority_rolls_back_revision_and_document ... ok
test canvas::tests::journal_concurrent_devices_restart_and_account_isolation ... ok
test canvas::tests::later_edit_wins_and_close_dominates_in_both_orders ... ok
test canvas::tests::prefixed_generated_ipv6_forms_never_survive_either_export ... ok
test canvas::tests::recent_cursor_receives_only_subsequent_operations ... ok
test canvas::tests::review_export_redacts_ipv6_after_colon_delimited_label ... ok
test canvas::tests::review_exported_layout_imports_into_empty_account_at_column_bound ... ok
test canvas::tests::snapshot_replay_is_bounded_and_import_is_a_copy ... ok
test canvas::tests::stale_reorder_preserves_concurrently_added_columns ... ok
test embedded::regressions::credited_bulk_output_survives_forwarder_io_pause ... ok
test embedded::regressions::credited_output_queue_at_stream_capacity ... ignored, debug actor memory/scheduling measurement; run without concurrent builds
test embedded::regressions::full_output_queue_must_not_block_shared_actor ... ok
test embedded::regressions::healthy_receiver_survives_ready_native_output_burst ... ok
test embedded::regressions::healthy_streams_progress_at_user_attachment_capacity ... ok
test embedded::regressions::output_and_snapshot_spend_remaining_restart_credit ... ok
test embedded::regressions::real_agent_canonical_uuid_result_is_accepted ... ok
test embedded::regressions::real_agent_open_uses_uid_and_character_dimensions ... ok
test embedded::regressions::reattach_must_restore_output_credit ... ok
test embedded::regressions::recovery_event_then_snapshot_keeps_embedded_connection_live ... ok
test embedded::regressions::recovery_notices_preserve_order_credit_and_session_isolation ... ok
test embedded::regressions::stream_close_must_not_restart_all_sessions ... ok
test embedded::regressions::uncredited_output_or_repaint_is_rejected_before_queueing ... ok
test runtime::reviewer_admission::reviewer_recovery_source_limit_covers_all_routes_without_forwarding_bypass ... ok
test runtime::tests::proxy_mode_requires_an_explicit_peer_allowlist ... ok
test runtime::tests::proxy_networks_match_only_their_address_family_and_prefix ... ok
test runtime::tests::restart_serves_fresh_setup_token_and_completes_owner_enrollment ... ok
test runtime::tests::router_migrates_private_storage_and_serves_health ... ok
test runtime::tests::setup_socket_cleanup_preserves_symlinks_and_regular_files ... ok
test runtime::tests::setup_token_socket_is_private_and_requires_explicit_request ... ok
test runtime::tests::startup_with_owner_unlinks_stale_setup_token_socket ... ok
test web_assets::tests::encodings_and_identity_have_correct_headers_and_sizes ... ok
test web_assets::tests::spa_and_mutable_assets_revalidate_and_missing_brotli_uses_gzip ... ok
test websocket::recovery_notification_bench::recovery_notification_state_at_socket_capacity ... ignored, notification state sizing diagnostic, not allocator-inclusive RSS certification
test websocket::writer_tests::second_device_does_not_inherit_first_device_input_ack ... ok
test websocket::writer_tests::writer_admission_at_user_capacity ... ignored, release-only scale measurement; run without concurrent builds
test websocket::writer_tests::writer_ownership_capacity_unsigned_offsets_and_identity_reuse ... ok
test result: ok. 136 passed; 0 failed; 15 ignored; 0 measured; 0 filtered out; finished in 144.82s
running 1 test
test canvas_migration_preserves_existing_identity ... ok
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.04s
running 73 tests
test frame::checks::approximate_snapshot_codec_is_bounded_and_canonical ... ok
test frame::checks::borrowed_and_owned_decoders_agree_at_every_fragment_boundary ... ok
test frame::checks::codec_reuse_measurement ... ignored, release codec and allocation-path measurement
test frame::checks::golden::every_frozen_message ... ok
test frame::checks::golden::exact_maximum_and_coalesced_frames ... ok
test frame::checks::tests::golden_and_fragmented ... ok
test frame::checks::tests::invalid_lengths_types_and_utf8 ... ok
test ring::checks::tests::wrap_and_exact_offsets ... ok
test session::inputs::tests::identity_cap_preserves_all_existing_cursors ... ok
test session::inputs::tests::partial_writes_credit_only_the_owner_and_replay_trims_per_writer ... ok
test session::measurements::budgets::input_to_pty_write ... ignored, real-PTY performance measurement; set ZDOTDIR to tests/profile
test session::measurements::poll_storage_measurement ... ignored, release poll-storage allocation measurement
test session::resize_checks::native_resize_refusal_preserves_peer_and_pty ... ok
test session::resize_checks::resize_refusal_session_probe ... ignored, isolated session probe invoked by its parent with a controlled shell profile
test session::sequenced_checks::coalesced_ack_never_overwrites_a_partial_output_and_cursors_survive_peer_loss ... ok
test session::sequenced_checks::new_frames_roundtrip_and_refuse_noncanonical_payloads ... ok
test session::sequenced_checks::reusable_encoder_retains_capacity_and_refuses_growth_before_mutation ... ok
test session::sequenced_checks::trim_duplicates_gaps_overflow_and_capacity_are_transactional ... ok
test session::sequenced_checks::writer_selection_has_a_frozen_little_endian_layout ... ok
test terminal::checks::approximate_repaint_is_bounded_clips_at_complete_cells_and_preserves_source ... ok
test terminal::checks::approximate_repaint_keeps_complete_pending_syntax_or_omits_it_whole ... ok
test terminal::checks::tests::alternate_variants_and_nested_switches_repaint ... ok
test terminal::checks::tests::byte_budget_prunes_history_and_resize_remains_repaintable ... ok
test terminal::checks::tests::fixtures_and_continuations_repaint ... ok
test terminal::checks::tests::implicit_hyperlinks_retain_groups_across_rows_and_continuation ... ok
test terminal::checks::tests::long_unfinished_hyperlink_and_control_strings_continue ... ok
test terminal::checks::tests::margins_tabs_charsets_and_modes_continue ... ok
test terminal::checks::tests::partial_csi_and_utf8_continue ... ok
test terminal::checks::tests::pending_wrap_and_saved_wrap_continue_with_wide_cells ... ok
test terminal::checks::tests::retained_alternate_saved_cursor_and_keyboard_stack_continue ... ok
test terminal::checks::tests::saved_origin_survives_changed_margins ... ok
test terminal::checks::tests::unfinished_sequence_over_frame_limit_fails_without_losing_runtime_state ... ok
test terminal::fidelity::fidelity_charset_mapped_wide_space_is_explicitly_rejected ... ok
test terminal::fidelity::fidelity_cursor ... ok
test terminal::fidelity::fidelity_diagnostic_fixture ... ignored, diagnostic replay of an explicitly selected fixture file
test terminal::fidelity::fidelity_edge ... ok
test terminal::fidelity::fidelity_extended_nightly ... ignored, nightly expanded differential corpus: 20,000 deterministic cases
test terminal::fidelity::fidelity_extended_smoke ... ok
test terminal::fidelity::fidelity_f1_rep ... ok
test terminal::fidelity::fidelity_fresh_c_redraw_default_is_explicitly_rejected ... ok
test terminal::fidelity::fidelity_handwritten ... ok
test terminal::fidelity::fidelity_inherited_protection_off_mode_is_explicitly_rejected ... ok
test terminal::fidelity::fidelity_iso_protection_does_not_keep_rep_scratch ... ok
test terminal::fidelity::fidelity_iso_protection_erase ... ok
test terminal::fidelity::fidelity_mouse_effective_fields_follow_order_independently_of_booleans ... ok
Target
af7b63e3; review headc6e918d464; scripts/verify fast exit0. Complete final captured output part3/6, verbatim.test terminal::fidelity::fidelity_oracle_detects_hidden_state ... ok
test terminal::fidelity::fidelity_oracle_observes_archived_cells_with_equal_active_screens ... ok
test terminal::fidelity::fidelity_orphaned_spacer_head ... ok
test terminal::fidelity::fidelity_prompt_resize_requires_explicit_rejection ... ok
test terminal::fidelity::fidelity_recorded_corpus ... ok
test terminal::fidelity::fidelity_rejects_unrepresentable_rep_without_mutating_source ... ok
test terminal::fidelity::fidelity_saved_cursor_over_changed_edge ... ok
test terminal::fidelity::fidelity_saved_modes_future_restore ... ok
test terminal::fidelity::fidelity_screen_entry_consumes_inherited_shift_before_saving ... ok
test terminal::fidelity::fidelity_seeded_nightly ... ignored, nightly differential corpus: 20,000 deterministic cases
test terminal::fidelity::fidelity_seeded_smoke ... ok
test terminal::fidelity::fidelity_semantic_validation_matches_exported_history_extent ... ok
test terminal::fidelity::fidelity_single_shift_survives_rep_seed ... ok
test terminal::fidelity::fidelity_snapshot_history_tail_contains_no_padding_rows ... ok
test terminal::fidelity::fidelity_snapshot_resets_stale_viewer_color_overrides ... ok
test terminal::fidelity::fidelity_spacer_head_attributes ... ok
test terminal::fidelity::fidelity_variation_tail_attributes ... ok
test terminal::fidelity::fidelity_variation_wrap_attributes ... ok
test terminal::fidelity::fresh_captures::fidelity_fresh_real_program_captures ... ignored, manual fresh capture oracle; set VT_CAPTURE_DIR after real program capture
test terminal::measurements::budgets::snapshot_200x60 ... ignored, performance measurement; run release on the perf host
test terminal::measurements::memory::measured_terminal_rss ... ignored, RSS measurement; run this filter alone in a fresh release process
test terminal::measurements::throughput::measured_parser ... ignored, VT observer and history throughput measurement
test terminal::recovery_measurements::measured_full_ring_reconstruction ... ignored, release reconstruction measurement; old healthy handles permit repeated cleanup
test terminal::resize_recovery::absent_ring_keeps_last_good_size_and_later_output_usable ... ok
test terminal::resize_recovery::complete_ring_restores_screens_mouse_and_unfinished_syntax ... ok
test terminal::resize_recovery::earlier_geometry_changes_require_approximation_even_with_origin_coverage ... ok
test terminal::resize_recovery::ring_gap_requires_clean_approximate_recovery ... ok
test terminal_native::allocation::resize_allocation_refusal_retires_native_handle ... ok
test result: ok. 61 passed; 0 failed; 12 ignored; 0 measured; 0 filtered out; finished in 53.73s
running 1 test
test closed_standard_descriptors_become_dev_null ... ok
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.72s
running 1 test
test faithful_snapshot_preserves_public_mouse_encoder_reports ... ok
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.27s
Doc-tests infraternal_agent
running 0 tests
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
Doc-tests infraternal_mesh
running 1 test
test crates/infraternal-mesh/src/model.rs - model::LocalPrivateKey (line 20) - compile fail ... ok
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.08s
Doc-tests infraternal_plugin_api
running 0 tests
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
Doc-tests infraternal_plugin_ssh
running 0 tests
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
Doc-tests infraternal_protocol
running 0 tests
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
Doc-tests infraternal_server
running 0 tests
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
Doc-tests infraternal_shim
running 0 tests
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
==> cargo-deny
warning[duplicate]: found 2 duplicate entries for crate 'base64'
┌─ /home/kayg/Developer/infraternal/.worktrees/review-canvas-doc/Cargo.lock:24:1
│
24 │ ╭ base64 0.21.7 registry+https://github.com/rust-lang/crates.io-index
25 │ │ base64 0.22.1 registry+https://github.com/rust-lang/crates.io-index
│ ╰───────────────────────────────────────────────────────────────────┘ lock entries
│
├ base64 v0.21.7
├── base64urlsafedata v0.5.5
│ ├── webauthn-attestation-ca v0.5.5
│ │ └── webauthn-rs-core v0.5.5
│ │ └── webauthn-rs v0.5.5
│ │ └── infraternal-server v0.1.0
│ │ └── infraternal v0.1.0
│ ├── webauthn-rs v0.5.5 ()
│ ├── webauthn-rs-core v0.5.5 ()
│ └── webauthn-rs-proto v0.5.5
│ └── webauthn-rs-core v0.5.5 ()
├── webauthn-rs-core v0.5.5 ()
└── webauthn-rs-proto v0.5.5 ()
├ base64 v0.22.1
├── axum v0.8.9
│ └── infraternal-server v0.1.0
│ └── infraternal v0.1.0
├── infraternal-server v0.1.0 ()
└── sqlx-core v0.8.6
├── sqlx v0.8.6
│ ├── infraternal v0.1.0 ()
│ └── infraternal-server v0.1.0 ()
├── sqlx-macros v0.8.6
│ └── sqlx v0.8.6 ()
├── sqlx-macros-core v0.8.6
│ └── sqlx-macros v0.8.6 ()
└── sqlx-sqlite v0.8.6
├── sqlx v0.8.6 ()
└── sqlx-macros-core v0.8.6 ()
warning[duplicate]: found 3 duplicate entries for crate 'getrandom'
┌─ /home/kayg/Developer/infraternal/.worktrees/review-canvas-doc/Cargo.lock:88:1
│
88 │ ╭ getrandom 0.2.17 registry+https://github.com/rust-lang/crates.io-index
89 │ │ getrandom 0.3.4 registry+https://github.com/rust-lang/crates.io-index
90 │ │ getrandom 0.4.3 registry+https://github.com/rust-lang/crates.io-index
│ ╰─────────────────────────────────────────────────────────────────────┘ lock entries
│
├ getrandom v0.2.17
└── rand_core v0.6.4
├── bip39 v2.2.2
│ └── infraternal-server v0.1.0
│ └── infraternal v0.1.0
├── crypto-common v0.1.7
│ ├── aead v0.5.2
│ │ └── aes-gcm v0.10.3
│ │ └── (dev) infraternal-server v0.1.0 ()
│ ├── cipher v0.4.4
│ │ ├── aes v0.8.4
│ │ │ └── aes-gcm v0.10.3 ()
│ │ ├── aes-gcm v0.10.3 ()
│ │ └── ctr v0.9.2
│ │ └── aes-gcm v0.10.3 ()
│ ├── digest v0.10.7
│ │ ├── blake2 v0.10.6
│ │ │ └── argon2 v0.5.3
│ │ │ └── infraternal-server v0.1.0 ()
│ │ ├── hmac v0.12.1
│ │ │ └── hkdf v0.12.4
│ │ │ └── (dev) infraternal-server v0.1.0 ()
│ │ ├── sha1 v0.10.7
│ │ │ ├── axum v0.8.9
│ │ │ │ └── infraternal-server v0.1.0 ()
│ │ │ └── tungstenite v0.29.0
│ │ │ └── tokio-tungstenite v0.29.0
│ │ │ ├── axum v0.8.9 ()
│ │ │ └── (dev) infraternal-server v0.1.0 ()
│ │ └── sha2 v0.10.9
│ │ ├── infraternal-server v0.1.0 ()
│ │ ├── sqlx-core v0.8.6
│ │ │ ├── sqlx v0.8.6
│ │ │ │ ├── infraternal v0.1.0 ()
│ │ │ │ └── infraternal-server v0.1.0 ()
│ │ │ ├── sqlx-macros v0.8.6
│ │ │ │ └── sqlx v0.8.6 ()
│ │ │ ├── sqlx-macros-core v0.8.6
│ │ │ │ └── sqlx-macros v0.8.6 ()
│ │ │ └── sqlx-sqlite v0.8.6
│ │ │ ├── sqlx v0.8.6 ()
│ │ │ └── sqlx-macros-core v0.8.6 ()
│ │ └── sqlx-macros-core v0.8.6 ()
│ └── universal-hash v0.5.1
│ └── polyval v0.6.2
│ └── ghash v0.5.1
│ └── aes-gcm v0.10.3 ()
├── password-hash v0.5.0
│ └── argon2 v0.5.3 ()
├── rand v0.8.8
│ └── bip39 v2.2.2 ()
└── rand_chacha v0.3.1
└── rand v0.8.8 ()
├ getrandom v0.3.4
└── rand_core v0.9.5
├── rand v0.9.5
│ ├── infraternal-server v0.1.0
│ │ └── infraternal v0.1.0
│ ├── tungstenite v0.29.0
│ │ └── tokio-tungstenite v0.29.0
│ │ ├── axum v0.8.9
│ │ │ └── infraternal-server v0.1.0 ()
│ │ └── (dev) infraternal-server v0.1.0 ()
│ └── webauthn-rs-core v0.5.5
│ └── webauthn-rs v0.5.5
│ └── infraternal-server v0.1.0 ()
└── rand_chacha v0.9.0
├── rand v0.9.5 ()
└── webauthn-rs-core v0.5.5 ()
├ getrandom v0.4.3
├── jobserver v0.1.35
│ └── cc v1.6.0
│ ├── (build) libfuzzer-sys v0.4.13
│ │ └── infraternal-fuzz v0.1.0
│ ├── (build) libsqlite3-sys v0.30.1
│ │ └── sqlx-sqlite v0.8.6
│ │ ├── sqlx v0.8.6
│ │ │ ├── infraternal v0.1.0
│ │ │ └── infraternal-server v0.1.0
│ │ │ └── infraternal v0.1.0 ()
│ │ └── sqlx-macros-core v0.8.6
│ │ └── sqlx-macros v0.8.6
│ │ └── sqlx v0.8.6 ()
│ ├── openssl-src v300.6.1+3.6.3
│ │ └── (build) openssl-sys v0.9.117
│ │ ├── axum-server v0.8.0
│ │ │ └── infraternal-server v0.1.0 ()
│ │ ├── openssl v0.10.81
│ │ │ ├── axum-server v0.8.0 ()
│ │ │ ├── infraternal-server v0.1.0 ()
│ │ │ ├── tokio-openssl v0.6.5
│ │ │ │ └── axum-server v0.8.0 ()
│ │ │ ├── webauthn-attestation-ca v0.5.5
│ │ │ │ └── webauthn-rs-core v0.5.5
│ │ │ │ └── webauthn-rs v0.5.5
│ │ │ │ └── infraternal-server v0.1.0 ()
│ │ │ └── webauthn-rs-core v0.5.5 ()
│ │ ├── tokio-openssl v0.6.5 ()
│ │ ├── webauthn-attestation-ca v0.5.5 ()
│ │ └── webauthn-rs-core v0.5.5 ()
│ └── (build) openssl-sys v0.9.117 ()
└── uuid v1.27.0
├── infraternal-agent v0.1.0
│ └── infraternal v0.1.0 ()
├── infraternal-server v0.1.0 ()
├── webauthn-attestation-ca v0.5.5 ()
├── webauthn-rs v0.5.5 ()
└── webauthn-rs-core v0.5.5 (*)
warning[duplicate]: found 2 duplicate entries for crate 'hashbrown'
┌─ /home/kayg/Developer/infraternal/.worktrees/review-canvas-doc/Cargo.lock:94:1
│
94 │ ╭ hashbrown 0.15.5 registry+https://github.com/rust-lang/crates.io-index
95 │ │ hashbrown 0.17.1 registry+https://github.com/rust-lang/crates.io-index
│ ╰──────────────────────────────────────────────────────────────────────┘ lock entries
│
├ hashbrown v0.15.5
├── hashlink v0.10.0
│ └── sqlx-core v0.8.6
│ ├── sqlx v0.8.6
│ │ ├── infraternal v0.1.0
│ │ └── infraternal-server v0.1.0
│ │ └── infraternal v0.1.0 ()
│ ├── sqlx-macros v0.8.6
│ │ └── sqlx v0.8.6 ()
│ ├── sqlx-macros-core v0.8.6
│ │ └── sqlx-macros v0.8.6 ()
│ └── sqlx-sqlite v0.8.6
│ ├── sqlx v0.8.6 ()
│ └── sqlx-macros-core v0.8.6 ()
└── sqlx-core v0.8.6 ()
├ hashbrown v0.17.1
└── indexmap v2.14.2
├── h2 v0.4.19
│ └── hyper v1.11.1
│ ├── axum v0.8.9
│ │ └── infraternal-server v0.1.0
│ │ └── infraternal v0.1.0
│ ├── axum-server v0.8.0
│ │ └── infraternal-server v0.1.0 ()
│ └── hyper-util v0.1.21
│ ├── axum v0.8.9 ()
│ └── axum-server v0.8.0 ()
└── sqlx-core v0.8.6
├── sqlx v0.8.6
│ ├── infraternal v0.1.0 ()
│ └── infraternal-server v0.1.0 ()
├── sqlx-macros v0.8.6
│ └── sqlx v0.8.6 ()
├── sqlx-macros-core v0.8.6
│ └── sqlx-macros v0.8.6 ()
└── sqlx-sqlite v0.8.6
├── sqlx v0.8.6 ()
└── sqlx-macros-core v0.8.6 (*)
warning[duplicate]: found 2 duplicate entries for crate 'r-efi'
┌─ /home/kayg/Developer/infraternal/.worktrees/review-canvas-doc/Cargo.lock:183:1
│
183 │ ╭ r-efi 5.3.0 registry+https://github.com/rust-lang/crates.io-index
184 │ │ r-efi 6.0.0 registry+https://github.com/rust-lang/crates.io-index
│ ╰─────────────────────────────────────────────────────────────────┘ lock entries
│
├ r-efi v5.3.0
└── getrandom v0.3.4
└── rand_core v0.9.5
├── rand v0.9.5
│ ├── infraternal-server v0.1.0
│ │ └── infraternal v0.1.0
│ ├── tungstenite v0.29.0
│ │ └── tokio-tungstenite v0.29.0
│ │ ├── axum v0.8.9
│ │ │ └── infraternal-server v0.1.0 ()
│ │ └── (dev) infraternal-server v0.1.0 ()
│ └── webauthn-rs-core v0.5.5
│ └── webauthn-rs v0.5.5
│ └── infraternal-server v0.1.0 (*)
Target
af7b63e3; review headc6e918d464; scripts/verify fast exit0. Complete final captured output part4/6, verbatim.warning[duplicate]: found 2 duplicate entries for crate 'rand'
┌─ /home/kayg/Developer/infraternal/.worktrees/review-canvas-doc/Cargo.lock:185:1
│
185 │ ╭ rand 0.8.8 registry+https://github.com/rust-lang/crates.io-index
186 │ │ rand 0.9.5 registry+https://github.com/rust-lang/crates.io-index
│ ╰────────────────────────────────────────────────────────────────┘ lock entries
│
├ rand v0.8.8
└── bip39 v2.2.2
└── infraternal-server v0.1.0
└── infraternal v0.1.0
├ rand v0.9.5
├── infraternal-server v0.1.0
│ └── infraternal v0.1.0
├── tungstenite v0.29.0
│ └── tokio-tungstenite v0.29.0
│ ├── axum v0.8.9
│ │ └── infraternal-server v0.1.0 ()
│ └── (dev) infraternal-server v0.1.0 ()
└── webauthn-rs-core v0.5.5
└── webauthn-rs v0.5.5
└── infraternal-server v0.1.0 (*)
warning[duplicate]: found 2 duplicate entries for crate 'rand_chacha'
┌─ /home/kayg/Developer/infraternal/.worktrees/review-canvas-doc/Cargo.lock:187:1
│
187 │ ╭ rand_chacha 0.3.1 registry+https://github.com/rust-lang/crates.io-index
188 │ │ rand_chacha 0.9.0 registry+https://github.com/rust-lang/crates.io-index
│ ╰───────────────────────────────────────────────────────────────────────┘ lock entries
│
├ rand_chacha v0.3.1
└── rand v0.8.8
└── bip39 v2.2.2
└── infraternal-server v0.1.0
└── infraternal v0.1.0
├ rand_chacha v0.9.0
├── rand v0.9.5
│ ├── infraternal-server v0.1.0
│ │ └── infraternal v0.1.0
│ ├── tungstenite v0.29.0
│ │ └── tokio-tungstenite v0.29.0
│ │ ├── axum v0.8.9
│ │ │ └── infraternal-server v0.1.0 ()
│ │ └── (dev) infraternal-server v0.1.0 ()
│ └── webauthn-rs-core v0.5.5
│ └── webauthn-rs v0.5.5
│ └── infraternal-server v0.1.0 ()
└── webauthn-rs-core v0.5.5 ()
warning[duplicate]: found 2 duplicate entries for crate 'rand_core'
┌─ /home/kayg/Developer/infraternal/.worktrees/review-canvas-doc/Cargo.lock:189:1
│
189 │ ╭ rand_core 0.6.4 registry+https://github.com/rust-lang/crates.io-index
190 │ │ rand_core 0.9.5 registry+https://github.com/rust-lang/crates.io-index
│ ╰─────────────────────────────────────────────────────────────────────┘ lock entries
│
├ rand_core v0.6.4
├── bip39 v2.2.2
│ └── infraternal-server v0.1.0
│ └── infraternal v0.1.0
├── crypto-common v0.1.7
│ ├── aead v0.5.2
│ │ └── aes-gcm v0.10.3
│ │ └── (dev) infraternal-server v0.1.0 ()
│ ├── cipher v0.4.4
│ │ ├── aes v0.8.4
│ │ │ └── aes-gcm v0.10.3 ()
│ │ ├── aes-gcm v0.10.3 ()
│ │ └── ctr v0.9.2
│ │ └── aes-gcm v0.10.3 ()
│ ├── digest v0.10.7
│ │ ├── blake2 v0.10.6
│ │ │ └── argon2 v0.5.3
│ │ │ └── infraternal-server v0.1.0 ()
│ │ ├── hmac v0.12.1
│ │ │ └── hkdf v0.12.4
│ │ │ └── (dev) infraternal-server v0.1.0 ()
│ │ ├── sha1 v0.10.7
│ │ │ ├── axum v0.8.9
│ │ │ │ └── infraternal-server v0.1.0 ()
│ │ │ └── tungstenite v0.29.0
│ │ │ └── tokio-tungstenite v0.29.0
│ │ │ ├── axum v0.8.9 ()
│ │ │ └── (dev) infraternal-server v0.1.0 ()
│ │ └── sha2 v0.10.9
│ │ ├── infraternal-server v0.1.0 ()
│ │ ├── sqlx-core v0.8.6
│ │ │ ├── sqlx v0.8.6
│ │ │ │ ├── infraternal v0.1.0 ()
│ │ │ │ └── infraternal-server v0.1.0 ()
│ │ │ ├── sqlx-macros v0.8.6
│ │ │ │ └── sqlx v0.8.6 ()
│ │ │ ├── sqlx-macros-core v0.8.6
│ │ │ │ └── sqlx-macros v0.8.6 ()
│ │ │ └── sqlx-sqlite v0.8.6
│ │ │ ├── sqlx v0.8.6 ()
│ │ │ └── sqlx-macros-core v0.8.6 ()
│ │ └── sqlx-macros-core v0.8.6 ()
│ └── universal-hash v0.5.1
│ └── polyval v0.6.2
│ └── ghash v0.5.1
│ └── aes-gcm v0.10.3 ()
├── password-hash v0.5.0
│ └── argon2 v0.5.3 ()
├── rand v0.8.8
│ └── bip39 v2.2.2 ()
└── rand_chacha v0.3.1
└── rand v0.8.8 ()
├ rand_core v0.9.5
├── rand v0.9.5
│ ├── infraternal-server v0.1.0
│ │ └── infraternal v0.1.0
│ ├── tungstenite v0.29.0
│ │ └── tokio-tungstenite v0.29.0
│ │ ├── axum v0.8.9
│ │ │ └── infraternal-server v0.1.0 ()
│ │ └── (dev) infraternal-server v0.1.0 ()
│ └── webauthn-rs-core v0.5.5
│ └── webauthn-rs v0.5.5
│ └── infraternal-server v0.1.0 ()
└── rand_chacha v0.9.0
├── rand v0.9.5 ()
└── webauthn-rs-core v0.5.5 ()
warning[duplicate]: found 2 duplicate entries for crate 'syn'
┌─ /home/kayg/Developer/infraternal/.worktrees/review-canvas-doc/Cargo.lock:226:1
│
226 │ ╭ syn 2.0.119 registry+https://github.com/rust-lang/crates.io-index
227 │ │ syn 3.0.6 registry+https://github.com/rust-lang/crates.io-index
│ ╰───────────────────────────────────────────────────────────────┘ lock entries
│
├ syn v2.0.119
├── asn1-rs-derive v0.5.1
│ └── asn1-rs v0.6.2
│ ├── der-parser v9.0.0
│ │ ├── webauthn-rs-core v0.5.5
│ │ │ └── webauthn-rs v0.5.5
│ │ │ └── infraternal-server v0.1.0
│ │ │ └── infraternal v0.1.0
│ │ └── x509-parser v0.16.0
│ │ └── webauthn-rs-core v0.5.5 ()
│ ├── oid-registry v0.7.1
│ │ └── x509-parser v0.16.0 ()
│ └── x509-parser v0.16.0 ()
├── asn1-rs-impl v0.2.0
│ └── asn1-rs v0.6.2 ()
├── openssl-macros v0.1.1
│ └── openssl v0.10.81
│ ├── axum-server v0.8.0
│ │ └── infraternal-server v0.1.0 ()
│ ├── infraternal-server v0.1.0 ()
│ ├── tokio-openssl v0.6.5
│ │ └── axum-server v0.8.0 ()
│ ├── webauthn-attestation-ca v0.5.5
│ │ └── webauthn-rs-core v0.5.5 ()
│ └── webauthn-rs-core v0.5.5 ()
├── sqlx-macros v0.8.6
│ └── sqlx v0.8.6
│ ├── infraternal v0.1.0 ()
│ └── infraternal-server v0.1.0 ()
├── sqlx-macros-core v0.8.6
│ └── sqlx-macros v0.8.6 ()
├── synstructure v0.13.2
│ └── asn1-rs-derive v0.5.1 ()
├── thiserror-impl v1.0.69
│ └── thiserror v1.0.69
│ ├── asn1-rs v0.6.2 ()
│ ├── webauthn-rs-core v0.5.5 ()
│ └── x509-parser v0.16.0 ()
├── tracing-attributes v0.1.31
│ └── tracing v0.1.44
│ ├── axum v0.8.9
│ │ └── infraternal-server v0.1.0 ()
│ ├── axum-core v0.5.6
│ │ └── axum v0.8.9 ()
│ ├── h2 v0.4.19
│ │ └── hyper v1.11.1
│ │ ├── axum v0.8.9 ()
│ │ ├── axum-server v0.8.0 ()
│ │ └── hyper-util v0.1.21
│ │ ├── axum v0.8.9 ()
│ │ └── axum-server v0.8.0 ()
│ ├── infraternal-server v0.1.0 ()
│ ├── sqlx-core v0.8.6
│ │ ├── sqlx v0.8.6 ()
│ │ ├── sqlx-macros v0.8.6 ()
│ │ ├── sqlx-macros-core v0.8.6 ()
│ │ └── sqlx-sqlite v0.8.6
│ │ ├── sqlx v0.8.6 ()
│ │ └── sqlx-macros-core v0.8.6 ()
│ ├── sqlx-sqlite v0.8.6 ()
│ ├── tower v0.5.3
│ │ ├── axum v0.8.9 ()
│ │ └── (dev) infraternal-server v0.1.0 ()
│ ├── tracing-subscriber v0.3.23
│ │ └── infraternal-server v0.1.0 ()
│ ├── webauthn-attestation-ca v0.5.5 ()
│ ├── webauthn-rs v0.5.5 ()
│ └── webauthn-rs-core v0.5.5 ()
└── zerocopy-derive v0.8.60
└── zerocopy v0.8.60
├── half v2.7.1
│ ├── ciborium-ll v0.2.2
│ │ └── ciborium v0.2.2
│ │ └── criterion v0.7.0
│ │ └── (dev) infraternal-protocol v0.1.0
│ │ ├── infraternal-agent v0.1.0
│ │ │ └── infraternal v0.1.0 ()
│ │ ├── infraternal-fuzz v0.1.0
│ │ └── infraternal-server v0.1.0 ()
│ └── serde_cbor_2 v0.13.0
│ ├── infraternal-server v0.1.0 ()
│ └── webauthn-rs-core v0.5.5 ()
└── ppv-lite86 v0.2.21
├── rand_chacha v0.3.1
│ └── rand v0.8.8
│ └── bip39 v2.2.2
│ └── infraternal-server v0.1.0 ()
└── rand_chacha v0.9.0
├── rand v0.9.5
│ ├── infraternal-server v0.1.0 ()
│ ├── tungstenite v0.29.0
│ │ └── tokio-tungstenite v0.29.0
│ │ ├── axum v0.8.9 ()
│ │ └── (dev) infraternal-server v0.1.0 ()
│ └── webauthn-rs-core v0.5.5 ()
└── webauthn-rs-core v0.5.5 ()
├ syn v3.0.6
├── clap_derive v4.6.7
│ └── clap v4.6.7
│ ├── criterion v0.7.0
│ │ └── (dev) infraternal-protocol v0.1.0
│ │ ├── infraternal-agent v0.1.0
│ │ │ └── infraternal v0.1.0
│ │ ├── infraternal-fuzz v0.1.0
│ │ └── infraternal-server v0.1.0
│ │ └── infraternal v0.1.0 ()
│ └── infraternal v0.1.0 ()
├── displaydoc v0.2.7
│ ├── asn1-rs v0.6.2
│ │ ├── der-parser v9.0.0
│ │ │ ├── webauthn-rs-core v0.5.5
│ │ │ │ └── webauthn-rs v0.5.5
│ │ │ │ └── infraternal-server v0.1.0 ()
│ │ │ └── x509-parser v0.16.0
│ │ │ └── webauthn-rs-core v0.5.5 ()
│ │ ├── oid-registry v0.7.1
│ │ │ └── x509-parser v0.16.0 ()
│ │ └── x509-parser v0.16.0 ()
│ ├── der-parser v9.0.0 ()
│ ├── icu_collections v2.3.0
│ │ ├── icu_normalizer v2.3.0
│ │ │ └── idna_adapter v1.2.2
│ │ │ └── idna v1.1.0
│ │ │ └── url v2.5.8
│ │ │ ├── infraternal-server v0.1.0 ()
│ │ │ ├── sqlx-core v0.8.6
│ │ │ │ ├── sqlx v0.8.6
│ │ │ │ │ ├── infraternal v0.1.0 ()
│ │ │ │ │ └── infraternal-server v0.1.0 ()
│ │ │ │ ├── sqlx-macros v0.8.6
│ │ │ │ │ └── sqlx v0.8.6 ()
│ │ │ │ ├── sqlx-macros-core v0.8.6
│ │ │ │ │ └── sqlx-macros v0.8.6 ()
│ │ │ │ └── sqlx-sqlite v0.8.6
│ │ │ │ ├── sqlx v0.8.6 ()
│ │ │ │ └── sqlx-macros-core v0.8.6 ()
│ │ │ ├── sqlx-macros-core v0.8.6 ()
│ │ │ ├── sqlx-sqlite v0.8.6 ()
│ │ │ ├── webauthn-rs v0.5.5 ()
│ │ │ ├── webauthn-rs-core v0.5.5 (*)
Target
af7b63e3; review headc6e918d464; scripts/verify fast exit0. Complete final captured output part5/6, verbatim.warning[duplicate]: found 2 duplicate entries for crate 'synstructure'
┌─ /home/kayg/Developer/infraternal/.worktrees/review-canvas-doc/Cargo.lock:229:1
│
229 │ ╭ synstructure 0.13.2 registry+https://github.com/rust-lang/crates.io-index
230 │ │ synstructure 0.14.0 registry+https://github.com/rust-lang/crates.io-index
│ ╰─────────────────────────────────────────────────────────────────────────┘ lock entries
│
├ synstructure v0.13.2
└── asn1-rs-derive v0.5.1
└── asn1-rs v0.6.2
├── der-parser v9.0.0
│ ├── webauthn-rs-core v0.5.5
│ │ └── webauthn-rs v0.5.5
│ │ └── infraternal-server v0.1.0
│ │ └── infraternal v0.1.0
│ └── x509-parser v0.16.0
│ └── webauthn-rs-core v0.5.5 ()
├── oid-registry v0.7.1
│ └── x509-parser v0.16.0 ()
└── x509-parser v0.16.0 ()
├ synstructure v0.14.0
├── yoke-derive v0.8.4
│ └── yoke v0.8.3
│ ├── icu_collections v2.3.0
│ │ ├── icu_normalizer v2.3.0
│ │ │ └── idna_adapter v1.2.2
│ │ │ └── idna v1.1.0
│ │ │ └── url v2.5.8
│ │ │ ├── infraternal-server v0.1.0
│ │ │ │ └── infraternal v0.1.0
│ │ │ ├── sqlx-core v0.8.6
│ │ │ │ ├── sqlx v0.8.6
│ │ │ │ │ ├── infraternal v0.1.0 ()
│ │ │ │ │ └── infraternal-server v0.1.0 ()
│ │ │ │ ├── sqlx-macros v0.8.6
│ │ │ │ │ └── sqlx v0.8.6 ()
│ │ │ │ ├── sqlx-macros-core v0.8.6
│ │ │ │ │ └── sqlx-macros v0.8.6 ()
│ │ │ │ └── sqlx-sqlite v0.8.6
│ │ │ │ ├── sqlx v0.8.6 ()
│ │ │ │ └── sqlx-macros-core v0.8.6 ()
│ │ │ ├── sqlx-macros-core v0.8.6 ()
│ │ │ ├── sqlx-sqlite v0.8.6 ()
│ │ │ ├── webauthn-rs v0.5.5
│ │ │ │ └── infraternal-server v0.1.0 ()
│ │ │ ├── webauthn-rs-core v0.5.5
│ │ │ │ └── webauthn-rs v0.5.5 ()
│ │ │ └── webauthn-rs-proto v0.5.5
│ │ │ └── webauthn-rs-core v0.5.5 ()
│ │ └── icu_properties v2.3.0
│ │ └── idna_adapter v1.2.2 ()
│ ├── icu_provider v2.3.1
│ │ ├── icu_normalizer v2.3.0 ()
│ │ └── icu_properties v2.3.0 ()
│ ├── zerotrie v0.2.5
│ │ ├── icu_properties v2.3.0 ()
│ │ └── icu_provider v2.3.1 ()
│ └── zerovec v0.11.8
│ ├── icu_collections v2.3.0 ()
│ ├── icu_locale_core v2.3.0
│ │ ├── icu_properties v2.3.0 ()
│ │ └── icu_provider v2.3.1 ()
│ ├── icu_normalizer v2.3.0 ()
│ ├── icu_properties v2.3.0 ()
│ ├── icu_provider v2.3.1 ()
│ ├── potential_utf v0.1.6
│ │ └── icu_collections v2.3.0 ()
│ └── tinystr v0.8.4
│ └── icu_locale_core v2.3.0 ()
└── zerofrom-derive v0.1.8
└── zerofrom v0.1.8
├── icu_collections v2.3.0 ()
├── icu_provider v2.3.1 ()
├── yoke v0.8.3 ()
├── zerotrie v0.2.5 ()
└── zerovec v0.11.8 ()
warning[duplicate]: found 2 duplicate entries for crate 'thiserror'
┌─ /home/kayg/Developer/infraternal/.worktrees/review-canvas-doc/Cargo.lock:231:1
│
231 │ ╭ thiserror 1.0.69 registry+https://github.com/rust-lang/crates.io-index
232 │ │ thiserror 2.0.21 registry+https://github.com/rust-lang/crates.io-index
│ ╰──────────────────────────────────────────────────────────────────────┘ lock entries
│
├ thiserror v1.0.69
├── asn1-rs v0.6.2
│ ├── der-parser v9.0.0
│ │ ├── webauthn-rs-core v0.5.5
│ │ │ └── webauthn-rs v0.5.5
│ │ │ └── infraternal-server v0.1.0
│ │ │ └── infraternal v0.1.0
│ │ └── x509-parser v0.16.0
│ │ └── webauthn-rs-core v0.5.5 ()
│ ├── oid-registry v0.7.1
│ │ └── x509-parser v0.16.0 ()
│ └── x509-parser v0.16.0 ()
├── webauthn-rs-core v0.5.5 ()
└── x509-parser v0.16.0 ()
├ thiserror v2.0.21
├── infraternal v0.1.0
├── infraternal-fuzz v0.1.0
├── infraternal-mesh v0.1.0
├── infraternal-server v0.1.0
│ └── infraternal v0.1.0 ()
├── sqlx-core v0.8.6
│ ├── sqlx v0.8.6
│ │ ├── infraternal v0.1.0 ()
│ │ └── infraternal-server v0.1.0 ()
│ ├── sqlx-macros v0.8.6
│ │ └── sqlx v0.8.6 ()
│ ├── sqlx-macros-core v0.8.6
│ │ └── sqlx-macros v0.8.6 ()
│ └── sqlx-sqlite v0.8.6
│ ├── sqlx v0.8.6 ()
│ └── sqlx-macros-core v0.8.6 ()
├── sqlx-sqlite v0.8.6 ()
└── tungstenite v0.29.0
└── tokio-tungstenite v0.29.0
├── axum v0.8.9
│ └── infraternal-server v0.1.0 ()
└── (dev) infraternal-server v0.1.0 (*)
warning[duplicate]: found 2 duplicate entries for crate 'thiserror-impl'
┌─ /home/kayg/Developer/infraternal/.worktrees/review-canvas-doc/Cargo.lock:233:1
│
233 │ ╭ thiserror-impl 1.0.69 registry+https://github.com/rust-lang/crates.io-index
234 │ │ thiserror-impl 2.0.21 registry+https://github.com/rust-lang/crates.io-index
│ ╰───────────────────────────────────────────────────────────────────────────┘ lock entries
│
├ thiserror-impl v1.0.69
└── thiserror v1.0.69
├── asn1-rs v0.6.2
│ ├── der-parser v9.0.0
│ │ ├── webauthn-rs-core v0.5.5
│ │ │ └── webauthn-rs v0.5.5
│ │ │ └── infraternal-server v0.1.0
│ │ │ └── infraternal v0.1.0
│ │ └── x509-parser v0.16.0
│ │ └── webauthn-rs-core v0.5.5 ()
│ ├── oid-registry v0.7.1
│ │ └── x509-parser v0.16.0 ()
│ └── x509-parser v0.16.0 ()
├── webauthn-rs-core v0.5.5 ()
└── x509-parser v0.16.0 ()
├ thiserror-impl v2.0.21
└── thiserror v2.0.21
├── infraternal v0.1.0
├── infraternal-fuzz v0.1.0
├── infraternal-mesh v0.1.0
├── infraternal-server v0.1.0
│ └── infraternal v0.1.0 ()
├── sqlx-core v0.8.6
│ ├── sqlx v0.8.6
│ │ ├── infraternal v0.1.0 ()
│ │ └── infraternal-server v0.1.0 ()
│ ├── sqlx-macros v0.8.6
│ │ └── sqlx v0.8.6 ()
│ ├── sqlx-macros-core v0.8.6
│ │ └── sqlx-macros v0.8.6 ()
│ └── sqlx-sqlite v0.8.6
Target
af7b63e3; review headc6e918d464; scripts/verify fast exit0. Complete final captured output part6/6, verbatim.advisories ok, bans ok, licenses ok, sources ok
==> static builds
Finished
releaseprofile [optimized] target(s) in 0.79s/home/kayg/.cache/codex-scratch/canvas-doc-review/target/x86_64-unknown-linux-musl/release/infraternal: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), static-pie linked, stripped
PT_INTERP: absent; size: 16403568 bytes (baseline 16142672 + allowance 262144 = max 16404816)
Finished
releaseprofile [optimized] target(s) in 0.42s/home/kayg/.cache/codex-scratch/canvas-doc-review/target/aarch64-unknown-linux-musl/release/infraternal: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, stripped
PT_INTERP: absent; size: 13789264 bytes (baseline 13555672 + allowance 262144 = max 13817816)
server subcommand: exit 2, not implemented
agent subcommand: exit 2, not implemented
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
==> Vendored Ghostty artifact checksums
dist/ghostty-web.js: OK
dist/ghostty-vt.wasm: OK
dist/index.d.ts: OK
==> TypeScript protocol compiler
Saved lockfile
==> Tracer compiler, precompression and bundle transfer budget
bun install v1.4.2 (744846f84)
Checked 38 installs across 69 packages (no changes) [30.00ms]
$ bun x tsc --project tsconfig.json
bun test v1.4.2 (744846f84)
browser-build.test.ts:
(pass) the browser renderer has no unresolved Vite Node-file shim request [25.53ms]
chunk-classes.test.ts:
(pass) the first screen is critical, the canvas product module and what only it uses are deferred [1.73ms]
(pass) a chunk that both sides use stays critical [0.42ms]
(pass) code only an action loads is on demand, even when the lazy canvas is what loads it [0.56ms]
precompress.test.ts:
(pass) text sidecars round-trip deterministically; compressed formats remain identity [26.94ms]
test/recovery-ui.test.ts:
(pass) compiled recovery UI mode off obeys its URL boundary [3.61ms]
(pass) compiled recovery UI mode preview obeys its URL boundary [2.97ms]
(pass) compiled recovery UI mode 1 obeys its URL boundary [2.75ms]
test/recovery-crypto.test.ts:
(pass) HKDF siblings match independent implementation and bind unwrap to domain, account, kind and version [15.54ms]
(pass) 100 repeated wrapping operations generate independent salts and nonces [31.40ms]
test/recovery-wait.test.ts:
(pass) server remaining wait 0s is accepted through the capability policy maximum [1.92ms]
(pass) server remaining wait 86400s is accepted through the capability policy maximum [0.71ms]
(pass) server remaining wait 90000s is accepted through the capability policy maximum [0.93ms]
(pass) server remaining wait 172800s is accepted through the capability policy maximum [2.46ms]
(pass) malformed or excessive remaining wait -1 is denied [4.72ms]
(pass) malformed or excessive remaining wait 0.5 is denied [1.91ms]
(pass) malformed or excessive remaining wait 172801 is denied [2.02ms]
(pass) malformed or excessive remaining wait 9007199254740992 is denied [1.49ms]
(pass) malformed or excessive remaining wait 90000 is denied [0.81ms]
test/recovery-rotation.test.ts:
(pass) signed-in rotation sends only a local envelope and verifier after acknowledgement [7.02ms]
(pass) abandoned word acknowledgement uploads nothing [2.03ms]
(pass) settled acknowledgement cannot upload later (dismissed) [3.64ms]
(pass) settled acknowledgement cannot upload later (no acknowledgement) [1.63ms]
src/canvas/mesh/protocol.test.ts:
(pass) the server's own list becomes nodes, tags and grants, by name [0.75ms]
(pass) without
access(today's server) the person may view and may not edit [0.30ms](pass) fields the server does not send are absent, never invented [0.18ms]
(pass) anything that is not a list is refused, whole [5.04ms]
(pass) a node's own tag list and the tag table agree even when a server sends only one [0.22ms]
(pass) the subscription's events: a pushed list, a revision that invalidates, and the end of the subscription [0.34ms]
(pass) answers carry the new revision, and a create the new arrow's id [0.06ms]
(pass) endpoints go out as the server writes them: a node by id, a tag by name [0.08ms]
src/canvas/mesh/layout.test.ts:
(pass) a small mesh keeps the approved arrangement: tags down the left, hosts two to a row [0.78ms]
(pass) the layout is deterministic and does not depend on input order [3.22ms]
(pass) no two cards overlap, and every card lies inside the graph [8.00ms]
(pass) the sheet is wider than tall, roughly 16:10 [1.55ms]
(pass) a pinned node stays where it was put and the others do not move [2.71ms]
(pass) a pin beyond the sheet grows the graph [0.35ms]
(pass) a host's other tags do not move it; a tag nobody carries still has its node [0.16ms]
(pass) 1,000 nodes lay out in a few milliseconds [8.52ms]
src/canvas/layout/stops.test.ts:
(pass) a view that fits the viewport has one stop, centred [0.33ms]
(pass) a wide view has one stop per column and the last stop ends at the right edge [0.21ms]
(pass) a view taller than the viewport is scaled down so it fits [0.05ms]
(pass) nearestStop picks the stop whose centre is closest [0.15ms]
(pass) a big graph opens fitted whole, in one stop, and its canvas is free [0.21ms]
(pass) a small graph keeps one stop per node column [0.07ms]
(pass) on a narrow screen a big graph does not shrink past where its names can be read: it starts at the top left [0.07ms]
src/canvas/layout/geometry.test.ts:
(pass) a dropped view pushes the one it lands on along the axis of least overlap, never itself [0.39ms]
(pass) a chain of neighbours is pushed in turn [0.10ms]
(pass) snapping rounds to whole cells [0.03ms]
(pass) reach follows grants through tags and keeps the relay [0.17ms]
src/canvas/model/document.test.ts:
(pass) a document holds references and layout, never content [0.26ms]
(pass) a document survives JSON and rebuilds the same columns [0.59ms]
(pass) a target that no longer exists is dropped, and an emptied column with it [0.09ms]
(pass) parseDocument rejects anything that is not a document of this format [0.21ms]
54 pass
0 fail
9930 expect() calls
Ran 54 tests across 12 files. [256.00ms]
$ bun run build.ts
built chunk-ph10r8fb.js, chunk-xv3qqanw.js, chunk-cy892tb7.js, main.js, chunk-pw0rta48.js, chunk-xrb0zjcp.js, chunk-zty6y6as.js, chunk-p1rptf1p.js, chunk-fjd56960.js, chunk-mjvz22rk.js, chunk-0563sbeb.js, chunk-axbkkqp1.js, chunk-kj62nfpb.js, chunk-v28ah0cn.js, chunk-1hfqw9kz.js, chunk-bkp512m6.js, chunk-wfj5xhc3.js, chunk-9hv3p7tm.js, chunk-p6ebptzt.js, chunk-wqc3n6hj.js, chunk-1f0dyz9j.js, chunk-mm8xgvda.js, backdrop.worker.js, faulty-terminal.worker.js, chunk-9kkhb651.js, chunk-sajgyt5b.js, chunk-gg5s27rt.js, chunk-y667rdh9.js, chunk-cmc3x3e5.js
critical chunk-cmc3x3e5.js: identity=39 gzip=39 brotli=39 bytes
onDemand chunk-9hv3p7tm.js: identity=6713 gzip=2837 brotli=2454 bytes
onDemand chunk-wqc3n6hj.js: identity=538 gzip=351 brotli=315 bytes
onDemand chunk-mjvz22rk.js: identity=14856 gzip=5464 brotli=4885 bytes
critical faulty-terminal.worker.js: identity=1086 gzip=558 brotli=481 bytes
critical backdrop.worker.js: identity=243 gzip=212 brotli=164 bytes
onDemand chunk-0563sbeb.js: identity=1026 gzip=622 brotli=496 bytes
deferred chunk-v28ah0cn.js: identity=100071 gzip=34892 brotli=30689 bytes
critical chunk-axbkkqp1.js: identity=90 gzip=90 brotli=78 bytes
critical chunk-fjd56960.js: identity=1916 gzip=843 brotli=720 bytes
critical chunk-zty6y6as.js: identity=8172 gzip=3517 brotli=3107 bytes
deferred chunk-xv3qqanw.js: identity=37378 gzip=14603 brotli=12771 bytes
critical chunk-xrb0zjcp.js: identity=6483 gzip=3110 brotli=2814 bytes
critical chunk-ph10r8fb.js: identity=20545 gzip=6471 brotli=5766 bytes
critical chunk-p1rptf1p.js: identity=386 gzip=238 brotli=196 bytes
critical chunk-9kkhb651.js: identity=9810 gzip=4018 brotli=3458 bytes
critical chunk-pw0rta48.js: identity=8377 gzip=3574 brotli=3186 bytes
onDemand chunk-1f0dyz9j.js: identity=5327 gzip=2571 brotli=2294 bytes
critical chunk-1hfqw9kz.js: identity=49 gzip=49 brotli=49 bytes
critical chunk-sajgyt5b.js: identity=199 gzip=160 brotli=134 bytes
onDemand chunk-wfj5xhc3.js: identity=20873 gzip=8494 brotli=7629 bytes
critical chunk-y667rdh9.js: identity=39 gzip=39 brotli=39 bytes
onDemand chunk-cy892tb7.js: identity=2108 gzip=1037 brotli=870 bytes
onDemand chunk-mm8xgvda.js: identity=4007 gzip=1682 brotli=1483 bytes
critical chunk-kj62nfpb.js: identity=702015 gzip=203594 brotli=164950 bytes
critical main.js: identity=105441 gzip=38340 brotli=33198 bytes
critical chunk-gg5s27rt.js: identity=57474 gzip=18832 brotli=16918 bytes
onDemand chunk-bkp512m6.js: identity=5749 gzip=2762 brotli=2497 bytes
onDemand chunk-p6ebptzt.js: identity=4351 gzip=1723 brotli=1494 bytes
JavaScript transfer, critical: identity=922364 gzip=283684/307200 brotli=235297/256000 bytes
JavaScript transfer, deferred: identity=137449 gzip=49495/51200 brotli=43460/45056 bytes
JavaScript transfer, onDemand: identity=65548 gzip=27543/20480 brotli=24417/18432 bytes
JavaScript transfer, onDemand largest chunk chunk-wfj5xhc3.js: gzip=8494/20480 brotli=7629/18432 bytes (class total gzip=27543 brotli=24417, not limited)
fonts/monaspace-neon/italic.latin.woff2: identity=44324 gzip=44324 brotli=44324 bytes
fonts/monaspace-neon/roman.latin.woff2: identity=40016 gzip=40016 brotli=40016 bytes
fonts/jetbrains-mono/italic.latin.woff2: identity=36316 gzip=36316 brotli=36316 bytes
fonts/jetbrains-mono/roman.latin.woff2: identity=34068 gzip=34068 brotli=34068 bytes
fonts/source-code-pro/italic.latin.woff2: identity=23612 gzip=23612 brotli=23612 bytes
fonts/source-code-pro/roman.latin.woff2: identity=22872 gzip=22872 brotli=22872 bytes
fonts/geist-mono/italic.latin.woff2: identity=21380 gzip=21380 brotli=21380 bytes
fonts/geist-mono/roman.latin.woff2: identity=19984 gzip=19984 brotli=19981 bytes
fonts/ibm-plex-mono/italic.latin.woff2: identity=22296 gzip=22296 brotli=22296 bytes
fonts/ibm-plex-mono/roman.latin.woff2: identity=19048 gzip=19048 brotli=19047 bytes
fonts/cascadia-code/italic.latin.woff2: identity=44404 gzip=44404 brotli=44404 bytes
fonts/cascadia-code/roman.latin.woff2: identity=40604 gzip=40604 brotli=40604 bytes
fonts/maple-mono-nf/italic.latin.woff2: identity=53444 gzip=53444 brotli=53444 bytes
fonts/maple-mono-nf/roman.latin.woff2: identity=46432 gzip=46432 brotli=46432 bytes
fonts/nerd-symbols.woff2: identity=223748 gzip=223748 brotli=223748 bytes
fonts/fira-code/roman.latin.woff2: identity=36756 gzip=36756 brotli=36756 bytes
fonts/commit-mono/italic-400.latin.woff2: identity=18716 gzip=18716 brotli=18716 bytes
fonts/commit-mono/italic-700.latin.woff2: identity=18352 gzip=18352 brotli=18352 bytes
fonts/commit-mono/roman-400.latin.woff2: identity=17484 gzip=17484 brotli=17484 bytes
fonts/commit-mono/roman-700.latin.woff2: identity=17260 gzip=17260 brotli=17260 bytes
Font transfer: monaspace-neon=84340/88064 jetbrains-mono=70384/75776 source-code-pro=46484/49152 geist-mono=41364/45056 ibm-plex-mono=41344/45056 cascadia-code=85008/88064 maple-mono-nf=99876/106496 (critical 46432/51200) symbols=223748/235520 fira-code=36756/40960 commit-mono=71812/75776 bytes
==> Rust stream oracle (for the differential test)
==> TypeScript protocol tests
bun test v1.4.2 (744846f84)
src/codec.test.ts:
(pass) wire protocol golden vectors > encodes and decodes each frame exactly as the shared manifest describes [10.64ms]
(pass) wire protocol golden vectors > returns borrowed payload views and writes into reusable buffers [0.28ms]
(pass) wire protocol golden vectors > decodes muxed messages split across WebSocket messages [1.09ms]
(pass) wire protocol golden vectors > rejects oversized, non-canonical, unknown, and malformed frame bytes [0.30ms]
(pass) split mux header preserves trailing Close [0.24ms]
src/stream.test.ts:
stream differential: 162 streams, 17235 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [6394.92ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [10.03ms]
7 pass
0 fail
51790 expect() calls
Ran 7 tests across 2 files. [6.43s]
Full-worker-only attempts: CDR-04 #1 p99=408280us FAIL, #2 closes socket at58.99s before metrics, #3 p50/p99=315330/349313us PASS load9.64/16.57/23.22→7.43/14.80/22.23. CDR-02 p99=332573us PASS; optimizedcanvas36passed/6ignored. These mixed results are not accepted as three passing confirmations. Focused real-SQLite regression full_recipient_refuses_import_without_waiting_for_writer FAILED before fix at canvas_burst_tests.rs:520 (1s timeout holding shared writer,1.74s total). New store check now refuses strictly validated imports exceeding recipient MAX_VIEWS before remap/writer; future revisions retain old path/error. Full-worker CPU isolation retained for accepted imports. Test/source rebuild and Clippy underway; source and all attempts will be retained.
Completed store step50f5271b and test stepd6cd6529 (HEAD
d6cd652946). Focused writer-held regression captured failing before fix; native canvas37passed/6ignored, migration1passed. Full scripts/verify fast exits1 solely at D205 reported x86 size:16413680B, cap16404816B, +10112B vsaf7b63e3; this store step+1664B, tests+0B. All workspace tests and other Rust rows pass. No baseline exemption, cap/profile/dependency change. Committed-source CDR-04×3/CDR-02 measurements now underway without own compilation. Gate summary verbatim:+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | FAIL (1) |
+---------------------------+--------------+
Committed HEADd6cd6529 confirmation: CDR-04 #1 p50/p99=342547/402843us FAIL load19.86/14.32/16.21→29.94/18.15/17.41; #2 closes socket37.78s before metrics; #3 p50/p99=332195/411334us FAIL load30.81/19.76/17.98→26.71/20.38/18.29. CDR-02 p50/p99=304893/332311us PASS load26.71/20.38/18.29→17.70/18.87/17.87; optimizedcanvas37passed/6ignored. No latency acceptance: worker/writer-held correctness fixes do not yet establish absolute350ms under this load. Equal-payload opaque control now running, own compilation paused. All failed attempts retained.
Equal-payload opaque control on committed
d6cd6529: p50 311778us / p99 359287us, FAIL 350000us; load 11.10/16.85/17.23 → 11.17/16.34/17.05, 38.07s. No canvas decoding/remapping/writes in this control. The absolute deadline therefore fails in this window independently of canvas CPU; this is evidence of host/transport variability, not a waiver or attribution of every import millisecond. Final-source raw scale and ARM/TypeScript checks next, then an additional committed-source confirmation set without own compilation. Loaded CDR-04 failures remain retained and P1 is not declared resolved yet.Final source
d6cd6529raw scale PASS: 50 accounts × 50 views × 200 windows, 250 authenticated device session rows, WAL/NORMAL pool8, 8 runtime workers. Load23.55/18.28/17.59→24.81/18.93/17.82; normal edit p50/p99=907250/7894838ns; concurrent50 p50/p99=44087804/175800952ns; post-workload RSS delta7626752B (152535B/account), peak same, seeded delta6205440B. Real PTY is covered separately; this scale is layout references/session rows, not10000running PTYs or maximum queued imports. TS/compiler/production build/transfer/differential PASS (162 streams,17235schedules,0divergences). ARM PASS static stripped/noPT_INTERP13801216B (+11952B vs reported af baseline), under13817816cap; CLI server/agent smoke PASS. Own compilation finished; load5.24/13.66/16.11 at start of an additional committed-source CDR-04×3/CDR-02 confirmation. Prior loaded failures remain retained; no acceptance yet.Further committed-source confirmation still fails at lower load; all logs retained. Remaining receive-path contention: websocket.rs unbiased select interleaves ready Background::Canvas error replies with buffered input frames; each reply awaits fresh authority before send, delaying later terminal Input despite background decode. Proposed bounded scheduling refinement [D11,D41]: prioritize already-buffered wire frames, yield after16 (existing admission-window scale), and yield immediately when no buffered frame so ready publications/background/revocation work progresses. Every action retains existing per-frame while_authorized guard and deadlines. No relaxed authority, parser, frame bounds or350ms budget. Existing real-PTY regression is failing before this socket change; workload unchanged. Store
d6cd6529code remains.Store-only lower-load committed confirmations: CDR-04 p99 364857/355911/343268us (FAIL/FAIL/PASS), loads 5.06→6.33,6.14→6.08,6.16→5.14 (full3load averages retained). CDR-02 p99 329793us PASS; canvas37passed/6ignored. This still is not three passing CDR-04 confirmations. Socket refinement now prioritizes only complete buffered frames for at most16 before restoring the existing unbiased select. Shared extraction helper preserves decoder/split/deadline semantics; no transport wait occurs while other branches are disabled. Every action retains its authority guard. Rejected blanket biased select because it could starve terminal output behind publications. Native Clippy and18socket tests PASS, including partial5s deadline, revocation of incomplete RFC/idle, recovery16devices, FIFO/cursor/writer/authority checks. Release rebuild ongoing. Existing failing real-PTY regression remains unchanged.
Completed socket module
c14b40e1(HEADc14b40e11c). Native18 socket tests and full workspace tests PASS; no baseline exemption. scripts/verify fast exits1 solely at unchanged x86 size cap:16418384B, +4704B for socket step, +14816B fromaf7b63e3, overcap13568B; D205 growth reported with profile/cap/dependencies unchanged. Source exact patch retained. Committed-source CDR-04×3/CDR-02 and optimizedcanvas running, own compilation paused. Gate summary verbatim:+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | FAIL (1) |
+---------------------------+--------------+
Committed
c14b40e1loaded CDR-04 set FAIL: #1 websocket Close(None) before metric at19.24s; #2 p50/p99=330404/390687us FAIL, load23.44/15.18/13.45→24.56/16.81/14.10,53.77s; #3 Close(None) before metric. Phase load observations21.38/13.58/12.87 and21.25/14.50/13.21, then20.83/17.52/14.58; no per-run metric environment for closures, not fabricated. CDR-02 p50/p99=305778/334995us PASS load24.62/17.33/14.33→21.45/17.31/14.43; optimizedcanvas37passed/6ignored. P1 not accepted yet. Final-source ARM build next, then another committed-source window without own compilation. Earlier opaque control itself failed359287us, so no blanket attribution/waiver.c14b40e1further CDR-04 set FAIL p99 373335/375709/381572us. Start→end load averages24.10/18.68/16.38→30.93/21.10/17.32;30.93/21.10/17.32→26.04/21.34/17.60;26.04/21.34/17.60→19.27/20.09/17.36. CPU pressure/start/end recorded even on closures. CDR-02 fails too; canvas37passed/6ignored. Existing real-PTY regression remains failing before next fix. Remaining head-of-line path: queue_canvas sends completion errors into the same capacity4 Background channel as terminal Output; an echo can sit behind multiple error replies/authority reads after Input is admitted. Proposed separation into bounded canvas-completion channel (capacity4, existing pending16 bound), with terminal/background reply priority limited to16 then fair selection. No new tasks, engine, dependency, action/authority/budget change. Accepted publication remains ordered on the existing broadcast path; producer count remains bounded. Contract clarification proposed here before edit.Completion-channel refinement on
c14b40e1plus uncommitted websocket diff: unchanged CDR-04 p99 358797/348171/376863 us (2/3 failures), CDR-02 p99 345352 us pass, canvas 37 pass/6 ignored. Independent read-only review identified no authority/fairness regression but did not accept latency completion. Remaining verified socket-side work: full-message copy (websocket.rs receive_wire), seven raw JSON copies before queue permits (canvas/store.rs From<&[u8]>), per-frame SQL authority reads. These are observations, not established causes. Measuring receive-copy, guards and enqueue with temporary cfg(test) numeric-only instrumentation; no payload/authority logging. The production budget and review workload are unchanged.Temporary instrumented CDR-04 trial: p99 346183 us, low-load 3.61→3.87, not acceptance evidence because probes alter code. 100-sample stage timings: full-message copy p99/max1733/1745 us; seven-frame authority sum p99/max12843/16577 us; enqueue sum6385/6935 us; full buffered admission16799/23090 us. First blocking decoder can run during later authority reads. Propose controlled bounded start gate before first decoder of one socket buffered turn, FIFO unchanged: release before unrelated frames or immediate replies, before waiting on transport/partial data, at16frames, or on cancellation. No lock/connection/writer held waiting. Dropped sender permits admitted work to finish. This delays canvas CPU until trailing Input guard/admission and avoids overlapped allocation during seven prior guards. Existing completion refinement still uncommitted/unproven. No authority deadline or budget changes.
Bounded start-gate candidate (uncommitted store/socket diff, completion separation retained) passed unchanged CDR-04×3: p99 334992/336676/337921 us, CDR-02 332147 us, canvas37 pass/6 ignored. Loads9.97→6.77,6.77→4.33,4.33→4.26; third precise endpoints in raw logs. CPU pressure low in this window; earlier failures remain evidence, not dismissed. Read-only review found post-loop cleanup could retain the start sender; explicit release is now added before cleanup awaits. Added a real SQLite test for no held writer/state lock and dropped-gate FIFO durability, plus ignored residency measurement for50accounts/250real authenticated canvas sockets (client and server RSS together; no PTYs; empty docs). Verifying store module separately before socket module; final exact-source optimized trials will be repeated after commits.
Completed store module
df188df9(df188df931): optional decoder start gate, no locks/connections while waiting, dropped sender preserves FIFO durable work. scripts/verify fast exit1 solely historical x86 size cap; all test/fmt/clippy/deny rows pass. Static stripped x86 16419536 bytes (+1152 this step, +15968 vsaf7b63e3). Native137 pass/15 ignored. Full verbatim log will be retained in docs/verification/canvas-final-head-evidence.txt.+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | FAIL (1) |
+---------------------------+--------------+
Completed socket module
dbacf79dd3: bounded decoder admission gate, separate4-slot canvas completion channel, bounded16-frame/background turns, explicit gate release before cleanup. Read-only review found no remaining authority/FIFO/fairness defect after cleanup release. Fast exit1 only historical size cap; every non-size row passes. x86 static/stripped16426096B (+6560 step, +22528 vsaf7b63e3). cargo tree --locked -d exit0; manifests/lock unchanged. Final optimized source verification pending test module.+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | FAIL (1) |
+---------------------------+--------------+
Completed validation module
fe4a9f51d4: dropped-gate real SQLite lifecycle/FIFO test and release-only fifty-account/250-actual-socket residency measurement. Corrected initial test assertion: sync(0) returns checkpoint+suffix; sync(2) returns live state. Fast exit1 solely old x86 size cap; server138 pass/16 ignored, all workspace tests/fmt/clippy/deny pass. CLI size unchanged16426096B (+0 test module). Independent read-only review found no blocking correctness/security issues; contract wording clarified current/past base revisions for early capacity refusal. Fresh final-source optimized harness/ARM builds, followed by exact latency repeats and both memory scenarios, are next.+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | FAIL (1) |
+---------------------------+--------------+
Completed additive contract clarification
2927d842f8: bounded transaction CPU worker, deferred first decoder per16-frame buffered turn, separate4-entry completion queue, bounded background priority and all gate-release paths. Current/past revision restriction for early capacity refusal is explicit; future/accepted authority and transactional paths unchanged. ARM built fromfe4a9f51(identical production code), static/stripped/noPT_INTERP13813888B (+24624 vs af7b63e3,3928B below old cap); stub checks pass. x86 remains16426096B (+22528), cap exceeded21280B under D205. No size-policy/profile/dependency changes. Latest fast non-size rows all pass; docs add0 binary bytes. Final optimized harness compiling; final-head bursts and scale remain pending.Final-source CDR-04 at
2927d842(production sourcefe4a9f51) fails all three trials: p99 370009/368206/392582 us against 350000 us. Start/end one-minute loads 17.30→21.47, 21.47→18.93, 18.93→14.13; CPU PSI avg10 endpoints 11.91→61.75, 61.75→31.56, 31.56→6.64 (full raw logs retained). No compilation ran alongside the trials. Earlier quiet candidate passes do not supersede these final-source failures; P1 is not yet resolved. CDR-02 and scale gates are still running. Now that CPU pressure has fallen, repeat the unchanged final source in another recorded window; retain both windows and all failures. No budget, workload, auth deadline or parser limit changed.At production source
fe4a9f51/ HEAD2927d842: CDR-02 p99 330441us passes; canvas38 passed/7ignored. Raw50-account×50-view/200-window SQLite WAL/NORMAL,pool8 scale passes: apply p50/p99 1.006/5.107ms, checkpoint p99 58.914ms, concurrent50 p99 86.092ms; post-raw RSS delta7434240B (148684B/account, measured50 total; no real PTYs/sockets). Load11.70→9.64. New actual250-socket scenario (50accounts×5): baseline11472896B, active87588864B, delta76115968B (304463B/server socket including client; measured250 total76115968B); load9.64→9.64, emptydocs/noPTY, includes auth/cache/SQL warmup, not isolated channel cost or populated-session RSS. Correction to previous CDR-04 comment: third trial PSI avg10 ended10.14;6.64 was a subsequent live reading. All raw logs retained. Second unchanged-source latency window is running; first window failures remain failures.Second unchanged-source CDR-04 window at2927d842: p99 340118/350967/349796us; two pass, one fails350000us. Both final-source windows remain evidence; no load exemption. CDR-02/canvas follow. Remaining code overlap: websocket.rs drops canvas_start before trailing Input authority/handle_client_frame forwarding, allowing decoded allocation work to start during terminal admission. Refine the existing bounded gate to release immediately after Input forwarding completes (including failure), retaining pre-wait release for other actions and post-loop/cancellation release. No authority/deadline/admission changes. The existing failed real-PTY regression precedes this refinement. Independent review will check that Input cannot depend on gated canvas work; additive contract clarification will reflect this release boundary.
Socket refinement committed
d8d674f7: retain the first decoder gate through terminal Input authority/forwarding, release before success/error continuation. Independent read-only review found no canvas dependency or gate-induced resource cycle; backpressure may extend FIFO waiting without holding canvas state/writer. Full fast: fmt/VT fmt/clippy/test/cargo-deny PASS; only static-size row FAIL at historical x86cap. x86static/stripped16426416B, +320B this module,+22848B vsaf7b63e3,21600B above unchangedcap underD205. No deps/deadline/budget changes. Additive contract clarification reflects this release boundary; exact-source builds/timing follow. Full raw gate output is retained for the finish update.Latency acceptance remains blocked/unresolved at head9b8207889b0847eacd9f3df588491b21ff4c1ad8 (productiond8d674f7). Final CDR-04p99 416839/379871us; third trial closes before metric, CDR-02 also closes. Opaque refusal control358915us fails too; distinct error path, not causal proof. All CPUWeight10000 local runs, no own compilation alongside timing. The orchestrator needs to provide a recorded noncontended local measurement window for further isolation; host load is not proven to be the sole cause. No other host, workload/deadline/budget relaxation or load exemption used. Full retained evidence:docs/verification/canvas-final-head-evidence.txt; report:docs/verification/canvas-final-head.md. P1 is not resolved and issue stays open.
Handoff head:
9b8207889b; branch canvas-doc, baseaf7b63e3. P1 remains unresolved; this is not numerical completion.Requested test
a8eebb6fis already equivalent80403af8 (matching patch-id62109600633094756241791031c3910f6d2dd5a2); empty cherry-pick skipped, existing author identity retained and timestamp difference documented. Base CDR-04 failed363456/375425/365914us. Final productiond8d674f7/documented1f63ffa9: CDR-04p99 416839/379871us plus third socket interruption; CDR-02 socket interruption. Final wrapper one-minute loads9.54→11.42,11.42→17.18,17.18→17.97; CDR-02 17.97→18.37. Opaque control358915us also fails, load20.09→23.90. No contention exemption or sole-cause claim.Canvas38pass/7ignored; workspace server138pass/16ignored; raw50-account scale passes (normal p50/p99 1.177/10.220ms, concurrent50p99 168.938ms, post-raw RSS4354048B,87080B/account measured50 total); actual250-socket pairs residency delta76816384B,307265B/server socket including client, measured250 total76816384B, emptydocs/noPTY. Load raw19.22→20.99/socket20.99→20.99. Size x8616426416B (+22848vsbase,21600over unchangedcap), ARM13814528B (+25264vsbase,3288belowcap), bothstatic/stripped/noPT_INTERP. No dependencies added; existing duplicate versions unchanged. ARM/stub/TypeScript/transfer/differential checks pass separately; no UI change.
Atomic commits separate store/socket/tests/contracts/evidence. Independent source and report review found no blocking correctness/security issue; report load labels corrected. Final head differs from tested production only in documentation; git diff d8d674f7..HEAD for production sources is empty. No push/deploy/issue close. Further latency isolation requires orchestrator-controlled local measurement conditions, not unmeasured source changes or relaxed checks.
Evidence: docs/verification/canvas-final-head.md and docs/verification/canvas-final-head-evidence.txt (all failed/passing windows retained).
Exact-source scripts/verify fast output verbatim follows. Gate ran immediately before production commitd8d674f7 on HEAD2927d842 plus retained input-release/source.diff; only docs changed afterward. Exit1 solely at historical x86 size cap, reported under ownerD205.
Correction to the handoff comment: final opaque-control load was24.05→23.90, not20.09→23.90 (20.09 was an earlier live host reading). The committed raw log and generated report table already show24.05→23.90. All final metrics/statuses unchanged; head9b8207889b0847eacd9f3df588491b21ff4c1ad8. Removing only this job’s scratch builds/logs now that evidence and full gate output are durable in the repository and #98.
CDR-04 / CDR-02 on the idle perf VM (load 0.00–0.38): static musl builds, alternating A B A B A B, simulated link 300 ±30 ms. Base =
80403af8(pre-fix canvas code with the CDR-04 test; production has no canvas code). Branch = canvas-doc9b820788.Next: a delta review of af7b63e3..9b820788. CDR-05 (P2, the Share module retry) is still open for the next round.
Delta verification starts on review-canvas-doc at
9b8207889b; dev merge base7d6df4470c. Scope af7b63e3..9b820788 and CDR-01..05 only. Prior review retained as review-canvas-doc-prior-9b820788. Read #98/#93 history and final report, including owner idle-host CDR-04/CDR-02 confirmation. Local tests only, no push/deploy or implementation fixes. Gate/build evidence will be retained separately from measured runs.Completed prior-test retention: cherry-picked CDR-05 as488552d2 on review-canvas-doc; CDR-01..04 already present on target. Production browser CDR-05 still fails at clusters.spec.ts:1207: expected2 chunk requests, received1 after5000ms, first retry-toast/interruption assertions pass. P2 unchanged, D206 fix forward. No implementation changes; fresh gate/release compilation continues, timings will run separately. Evidence cdr05.log to be committed with delta report.
Evidence step committed7a8e56c3 on review-canvas-doc: prior CDR-05 failing test488552d2 plus current production-browser failure, expected2/observed1 dialog requests. Delta source checklist finds no new confirmed correctness/security gap: FIFO16, oneblocking worker/account, decoder before state, bounded input/background turns, explicit gate drop before cleanup, unchanged per-frame authority. Fresh native/release builds continue; no latency measurement during own compilation. No dependencies or production bytes added.
Fresh gate first attempt refused112B fixture socket path before canvas execution. Short-alias retry passes setup but fails unchanged real_binary_preserves_input_and_output_across_24_abrupt_stops at agent_daemon.rs:18: terminal command queue full; reattach and replay unacknowledged input,58.48s. No baseline exemption for this row; retain and retry unchanged after compilation. Release build still active, load25.99/25.48/21.16; no own latency measurements started. Direct canvas functional suite now running separately.
Functional verification committed8f3050d42197b3e16d30ab86c2b210c8e6318bf2: focused native canvas38passed/0failed/7ignored in17.26s. CDR-01/02/03 prior regression tests allpass; dropped decoder-gate FIFO/resources, full-recipient refusal before writer, invalid raw JSON recovery, authority/account isolation and durable ordering pass. Logs docs/verification/canvas-doc-delta-review-evidence.txt. No implementation changes or production binary growth. Optimized timing/scale and final fast retry remain pending.
Final corrected scripts/verify fast exits1 solely historical x86size:16422064B,17248over16404816; static/stripped/noPT_INTERP. All fmt/nativefmt/Clippy/test/deny rowsPASS; server138passed/16ignored. Earlier112B fixture refusal and command-queue-full restart failure retained; both pass in final unchanged retry, no baseline exemption. Separate TS/transfer/differential exits0:162streams/17235schedules/zero divergences. Local release measurements now start sequentially, own compilation stopped; load8.26/14.93/18.74. Full gate output will be committed and posted verbatim with final verdict.
Fresh local CDR-04 fails366185us p99 vs350000us; p50=323866us,100samples,7x524275B imports,50views/200windows,300±30ms,WALpool8,8workers,CPUWeight10000,no own compilation. Load8.40/14.64/18.58→11.03/14.33/18.27. Retain this failure alongside owner idle-host branchpasses336/332/338ms; this local shared-host run does not establish causal attribution or invalidate that controlled comparison. CDR-02/scale/native probes continue. Evidence cdr04.log will be committed; no code/deadline/workload changes.
Verdict: MERGE (no P0/P1); counts P0=0, P1=0, P2=1, P3=0. CDR-05 is fixed forward under D206.
Target canvas-doc
9b8207889b; reviewed only af7b63e3..9b820788 and earlier findings. Review head0a5c2804d3, local review-canvas-doc. Prior branch retained as review-canvas-doc-prior-9b820788. No implementation fixes, push, deployment or issue closure.CDR-01/02/03 pass native and optimized real-engine tests; CDR-02 real-PTY echo p99 328.504ms passes 350ms. CDR-04 local run fails 366.185ms; equal-payload opaque refusal control fails 403.260ms. Both failures are retained, not relabeled as passes or attributed solely to load. The owner's recorded controlled idle-host comparison on the exact head (branch336/332/338ms versus pre-fix461/581/540ms, no socket loss in12runs) is acceptance evidence for resolved P1. No new causal P0/P1 finding in the scheduling delta. No fresh canvas burst socket loss. CDR-05 still fails: expected2 dialog chunk requests, observed1 after5s; retained failing test488552d2.
Raw50-account/250-session-row scale: normal apply p99 5.789ms; concurrent50 p99 102.597ms; post-worker RSS growth7770112B total (155402/account). Separate actual250 client+server socket pairs: growth76169216B total (304676/server socket including client), emptydocs/noPTY. No own compilation during sequential CPUWeight10000 timing; load retained. Native data-path baseline/other-session echo pass; unchanged same-session echo475.97ms/growth152.37ms fail, same rows recorded on dev in earlier review; no fresh baseline attribution. Broad unchanged browser suites/physical iPhone not repeated.
Final scripts/verify fast exit1 solely historical x86 size cap, D205: static/stripped/noPT_INTERP16422064B,17248B overcap. All non-size rows PASS, server138passed/16ignored. Earlier112B fixture refusal and restart command-queue failure both pass unchanged final retry; no baseline exemption. Separate TS/transfer/differential checks pass:162streams/17235schedules/zero divergences;7protocol tests/51790expectations. No dependencies or production bytes added by review. Author size deltas+22848B x86/+25264B ARM are retained; no ARM/source-baseline rebuild here.
Evidence committed: docs/verification/canvas-doc-delta-review.md and canvas-doc-delta-review-evidence.txt. Complete final gate output follows verbatim in four comments. Gate summary verbatim:
Target
9b820788; final independent scripts/verify fast exit 1 solely historical x86 size cap (D205). Complete captured output part 1/4, verbatim.Target
9b820788; final independent scripts/verify fast exit 1 solely historical x86 size cap (D205). Complete captured output part 2/4, verbatim.Target
9b820788; final independent scripts/verify fast exit 1 solely historical x86 size cap (D205). Complete captured output part 3/4, verbatim.Target
9b820788; final independent scripts/verify fast exit 1 solely historical x86 size cap (D205). Complete captured output part 4/4, verbatim.Starting production integration/CDR-05 on canvas-doc, base
9b8207889b; merging production dev7e8545c4b9. Read #98/#93 history and repository contract. Retain bounded import workers/terminal-first scheduling, integrate secondary-socket canvas sync, cherry-pick retry regression488552d2. Prior MERGE verdict and owner idle-host CDR-04 acceptance retained; local loaded measurements will be labeled. No push/deploy.Merge finding: dev already resets sharing/index.ts loading in its rejection handler. Interrupted-download regression reaches the first retry toast but the second normal palette click is blocked by .cl-summary (production browser, cdr05-merged.log). canvas-doc closed competing overlays before the deferred download; dev moved that close inside the downloaded controller. Preserve early overlay closure in the small handle so a failed download leaves Share reachable; retain dev rejected-promise clearing. Native/build gates still compiling on shared host load 33–37. Browser plugin unavailable; repository Playwright production-build harness used, port4998.
Correction/continued diagnosis: the blocking .cl-summary is the existing world hover card, not the new view-recents popover; viewList.close does not own it. Reverted the unnecessary early-overlay-close change. CDR-05 retention will use keyboard selection from the same Share palette row to isolate deferred-load retry from unrelated pointer-hover layering, keeping interrupted first request, retry-toast, exactly2 requests and recovered dialog assertions. Dev already contains the required rejected-promise reset; it is retained in the merge. Original pointer failures and loaded-host startup/keyboard timeouts remain in logs; no deadlines or assertions relaxed.
CDR-05 reproduced after merge even with dev clearing loading: keyboard selects the same Share palette action, first chunk is interrupted, first retry-toast passes, second action still observes exactly1 request instead of2 (cdr05-keyboard.log). This is browser failed-module caching beyond the handle promise. Implement dependency-free retryable on-demand loader: clear rejected cached promise and, only on explicit retry, resolve the emitted chunk through the existing chunks.json build manifest and import with a fresh URL fragment. Keep static first import for build-graph classification/fast success, no eager fetch or automatic retry, same HTTP asset URL and unchanged transfer limits. Internal manifest addition is additive; no engine/library choice. Also first fast test failure is fixture setup target/ac missing, not timing: restore ignored job-local target symlink and rerun unchanged gate. All other printed native checks pass; static build underway.
Non-conflict integration defect found by full fast gate: both lanes have migration version0012 (0012_canvas.sql and production0012_mesh_api.sql). Real SQLite setup fails UNIQUE constraint failed: _sqlx_migrations.version, causing132 server fixture failures. Production dev also has0013_mesh_node_identity and0014_plugin_settings. Keep all shipped production versions/checksums untouched; move the unshipped canvas migration to0015, and strengthen canvas_migration.rs to upgrade an actual version14 migration journal with existing identity, not only execute prior SQL without a journal. This additive integration resolution will be recorded in the merge commit. No deployed canvas database exists in this brief; no history rewrite of shipped migrations.
Integration findings: workspace Rust tests now pass after reserving production migration versions 12–14 and moving the unshipped canvas migration to 15; canvas_migration_preserves_existing_identity passes with real SQLx migration journals/checksums. Full clusters.spec run: 40 passed, 2 failed (7.7m): overview expected old host text build-01 although production dev renders session label deploy; keyboard-row upward gesture failed at line549. Overview adapted to current label and passed targeted rerun (9.7s); investigating the gesture without changing production behavior or budgets. CDR-05 red: explicit second Share saw only one module request; fixed run: exactly two requests and dialog visible (7.7s), full suite CDR-05 also passed. Native fast final run and corrected static-binary link are still running; earlier real-spec startup failures used the stale pre-migration-fix binary and exposed only the safe auth-initialization error. No credentials logged. Host load currently ~32/8 cores; latency measurement will record it.
Production dev merged in
f0559729a2. Merge message records plugin/socket scheduling, sharing relocation, canvas migration15, and union fuzz resolutions. scripts/verify fast:| Rust gate | Result |
Full gate output will be attached at finish. x86 static PIE/no PT_INTERP: 16,831,248 B, exceeds unchanged 16,404,816 B cap by426,432 B (D205 inherited plugin growth). All other Rust rows PASS. CDR-05 review test cherry-picked, explicit keyboard action/toast adapted to dev; the red browser run saw exactly1 request instead of2. Corrected static binary now remains running in fresh startup probe; real specs rerunning including Mesh/host-facts. ARM build running separately because size row stops fast before ARM/TS; separate TS gate transfer passes.
CDR-05 fixes committed separately:
5bd11204emitted on-demand manifest;a85ff268shared rejected-Promise clearing/fresh module identity loader;fbbf2379sharing call site. Review test cherry-pick/adaptation:11f6962e. Targeted regression green (7.7s, exact2 requests after first abort); TypeScript fast gate PASS: protocol36 tests/51,862 assertions plus tracer tests/production compiler/build/unchanged transfer gate. Native size unchanged by these UI commits. Full integration reruns at load51–65/8 cores currently show terminal second-shell echo timeout, Mesh bulk enrollment3 refusals/450 and split maxDraw9.90ms vs unchanged4ms. Logs retained; investigating/rerunning failed rows after own ARM compilation completes, not claiming those gates passed. Corrected static binary starts, Host-facts real spec passed6.1s and Mesh live-host/grant specs passed.Integration test commits:
a3e0cf70mock labels/swipe/focused Share regression + screenshot;b1a4d307pooled canvas/29 real PTYs,28+1, primary-only recovery and terminal-open control calls; 5ef28954 phone setup now waits for every created window instead of500ms sleeps. Full clusters.spec:42 passed(7.1m), CDR-05 passed7.8s, screenshot apps/tracer/captures/canvas-doc/sharing-retry.png. Secondary canvas regression passes8.6s: revision1 on both sockets, export2 copied views, secondary echo PASS. ARM build completes18m29s: stripped static/no PT_INTERP14,170,432 B(+355,904 B vs initial13,814,528), unchanged cap13,817,816 exceeded352,616 B. x86+404,832 B vs initial16,426,416; growth comes from production plugin merge, no new dependencies in retry/tests. CDR-02 p99=329.323ms,p50=306.473ms,100 samples16 edits; CDR-04 p99=337.457ms,p50=310.416ms,100 samples7x524,275B imports. CPUWeight10000 local infraternal-dev/8cores,RTT300/jitter30ms,50views/200windows,WAL/NORMAL pool8. Loads CDR-02=8.81->7.00, CDR-04=5.05->4.31: lower-load window, both below unchanged350ms. Full real run has one phone creation setup failure(3/4 windows), now fixed by per-action waits; rerun will verify. One repeated native run had initial Mesh snapshot error(not a timeout), rerunning full fast rather than claiming #118 exception.Final native fast run now passes fmt,VT native fmt,clippy,workspace test,cargo-deny; only unchanged x86 size row fails under D205. Full output retained in complete-fast.log for finish comment. Focused workspace socket suite passes; both questioned tests pass on detached dev7e8545c4 baseline too, so no #118 failure exception is claimed. Baseline cache reuse briefly produced stale protocol metadata; affected debug artifacts were cleared and rebuilt, no code fix needed. Phone memory setup now uses focused palette Enter, waits per-window count, and does not require mobile terminal focus: 15.9MB canvases+29.3MB layers<150MB. Secondary regression after lifecycle history repeatedly refused terminal.open index17, even with output credit. Its fixture now starts a fresh server/account (reuses enrol helper via instance parameter), retaining the exact29 real-PTY/28+1 socket workload and normal output credit; verifying full canvas suite before claiming success. No production behavior, library or budget changes.
Final fixture commits:
623fc3b7phone palette Enter/window counts (intentional inactive terminals preserved);0fc7cdd2pooled regression reuses real retained session IDs, opens missing sessions only, verifies29 distinct PTYs/28+1, grants output credit/waits real prompts/answers keepalives. Reject extra29 shims on the populated lifecycle fixture: repeated earlier runs refused new terminal opens. Fresh-server allocation alone did not resolve the combined workload. Current full real suite: canvas10/10 passed; pooled test4.4s with revision1/copies2/secondary echo PASS; Host-facts4.3s, Mesh paging450 new hosts1.3s and live grant flows pass. Remaining real specs still running. Full native fast complete: all rows PASS except D205 static size; no #118 exception taken. CDR p99s329.323/337.457ms and full clusters42/42 remain the final unchanged-code evidence. Capturing full outputs/screenshot in docs/verification before scratch cleanup.Finished canvas-doc at
5da33c6dd8(code/test head0fc7cdd2; evidence-only final commit). Production dev7e8545c4 merged inf0559729; migration15 preserves shipped12–14 checksums; non-trivial resolutions are in the merge message. CDR-05 review test cherry-picked and fixed with cleared rejected promises/fresh module identity on explicit retry. Secondary sync/import/export tested with29 distinct real PTYs on28+1 sockets, primary control subscription only, both revision1 and secondary echo PASS.Final gates: clusters42 pass(7.1m), real server39 pass/3 configured skips(6.9m), including Mesh/host facts and54-session keyboard split check(0 growing failures). Canvas/pool unit45 pass; protocol36 pass/51,862 assertions. Production compiler/build/unchanged transfer budgets PASS: critical gzip285,968/Brotli237,302 B, deferred46,293/40,887 B, largest on-demand13,263/11,948 B. CDR-02/CDR-04 p99=329.323/337.457ms(<350ms), 100 samples each, local infraternal-dev8 cores under CPUWeight10000; load8.81->7.00 and5.05->4.31 (lower-load window), RTT300/jitter30ms,50views/200windows,WAL/NORMAL pool8. No load generator/perf VM/SSH.
scripts/verify fast exit1 only for D205 size; every other row PASS. x86 stripped static PIE/no PT_INTERP16,831,248 B(+404,832 vs initial), ARM stripped static/no PT_INTERP14,170,432 B(+355,904); unchanged caps16,404,816/13,817,816 exceeded426,432/352,616 B. Growth is the production plugin merge; later UI/test/docs commits have zero Rust/dependency delta. No budget raised and no #118 failure exception claimed. Reviewer checklist completed. Full verbatim fast output follows in numbered comments; other verbatim gates, hashes, earlier red/green evidence and measurements are committed in docs/verification/canvas-doc-integration-evidence.txt. Report: docs/verification/canvas-doc-integration.md; production-build screenshot for independent review: apps/tracer/captures/canvas-doc/sharing-retry.png. No push/deploy/issue closure. Temporary targets/checkouts are being removed.
Head
5da33c6dd8; scripts/verify fast — verbatim output part1/4. Concatenate the fenced content in order. Final result: only D205 size row fails.Head
5da33c6dd8; scripts/verify fast — verbatim output part2/4. Concatenate the fenced content in order. Final result: only D205 size row fails.Head
5da33c6dd8; scripts/verify fast — verbatim output part3/4. Concatenate the fenced content in order. Final result: only D205 size row fails.Head
5da33c6dd8; scripts/verify fast — verbatim output part4/4. Concatenate the fenced content in order. Final result: only D205 size row fails.Delta verification starts on review-canvas-doc at
5da33c6dd8; prior review retained as review-canvas-doc-before-5da33c6d (0a5c2804). Scope 9b820788..5da33c6d excluding production-dev changes, plus CDR-01..05 dispositions. Read #98/#93 history, contracts and author report. Tests/evidence only; no implementation changes, push/deploy or perf VM. Fresh job-head fast gate and production browser retry checks follow.kayg referenced this issue2026-10-28 17:53:56 +00:00