* Retire projection adapter tests and use real SQL journal fixtures
* Persist bounded history detail and conversation outline projections
* Select rewind cuts by provider indexes and delete uniform rows as a set
* Cache bounded conversation outlines after reader projection
* Remove retired journal fold and message adapters
* Add the 4a main-vs-candidate native chat comparison harness
One entry (native-chat-4a-comparison.ts) seeds the 55k-history/310-chat
profile once through the seed arm, clones it per arm at a fixed path,
launches each built checkout in the background with an isolated home,
and drives the same stub provider events through the host RPC surface
both builds serve. Envelopes come from each arm's own source bundle.
Rows cover send/queue, 1/8/16 MiB streams with a competing send,
maintenance windows, open/reopen, history/detail, outline/fork,
rewind, record operations, R3 retained-history admission and, reported
separately, first-launch conversion (optional 20 GiB source). Output is
one JSON and one markdown table keyed by both head SHAs.
* Fail the 4a harness launch fast on a non-e2e build and stop the app it launched
* Shim tsx's __name in 4a harness pages and install the probe inside the guarded launch
* Read the native chat working flag from the 4a harness's visible root itself
* Retry transient main-process evaluates in the 4a harness host-work probe
* Use the history page's itemId in the 4a harness and name what a visible-state wait timed out on
* Activate 4a harness chat tabs through their tab group and seed enough smoke filler chats for the unopened-chat row
* WIP: migrate native chat tests to SQL journal readers
* Treat refusals carried inside a successful 4a harness RPC result as refusals
* Give the 4a stub's user echo the uuid its transcript row records
* Remove retired journal writer test machinery
* Chain the 4a stub's resumed transcript to the last message, past a fork copy's title row
* Fork the 4a harness's large chat through its latest response, not its latest prompt
* Port persisted chat tests to SQL fixtures (red WIP)
* Add the 4a main-vs-candidate native chat comparison harness
One entry (native-chat-4a-comparison.ts) seeds the 55k-history/310-chat
profile once through the seed arm, clones it per arm at a fixed path,
launches each built checkout in the background with an isolated home,
and drives the same stub provider events through the host RPC surface
both builds serve. Envelopes come from each arm's own source bundle.
Rows cover send/queue, 1/8/16 MiB streams with a competing send,
maintenance windows, open/reopen, history/detail, outline/fork,
rewind, record operations, R3 retained-history admission and, reported
separately, first-launch conversion (optional 20 GiB source). Output is
one JSON and one markdown table keyed by both head SHAs.
* Fail the 4a harness launch fast on a non-e2e build and stop the app it launched
* Shim tsx's __name in 4a harness pages and install the probe inside the guarded launch
* Read the native chat working flag from the 4a harness's visible root itself
* Retry transient main-process evaluates in the 4a harness host-work probe
* Use the history page's itemId in the 4a harness and name what a visible-state wait timed out on
* Activate 4a harness chat tabs through their tab group and seed enough smoke filler chats for the unopened-chat row
* Treat refusals carried inside a successful 4a harness RPC result as refusals
* Give the 4a stub's user echo the uuid its transcript row records
* Chain the 4a stub's resumed transcript to the last message, past a fork copy's title row
* Fork the 4a harness's large chat through its latest response, not its latest prompt
* Port ACP tests to SQL journal named reads
* Port Claude tests to SQL journal named reads
* Port Codex tests to SQL journals and drop the legacy row rollback test
* Port failure and persisted-read fixtures to the active chat database
* Remove obsolete internal-work counting from chat inventory tests
* test(native-chat): repair SQL epoch fixtures and sender closure case
* fix(native-chat): own async option preparation and port SQL runtime fixtures
* test(native-chat): encode the full founding identity
* fix(native-chat): recover saved live work on SQL open
* fix(native-chat): select retained image sources before history paging
* fix(native-chat): preserve catch-up authority and scoped journal teardown
* Cover the 4a conversion, history-shape and maintenance-debt cases through outside observation
Conversion: seed a medium chat (310 chats on the full profile) and refuse a
cached seed from another recipe. Observe the candidate's existing
epoch-installed ready boundary with a read-only poll of journal_chat_state.
An idle seed copy yields launch to every chat ready and the per-size
ready-mark intervals; the families copy verifies an unconverted first open and
waits for every chat ready before any steady-state family.
History/detail: the stub emits ordinary Claude subagent frames (interleaved
and sparse-root corpora) and a shapes turn (huge completed tool originals, one
above the detail reply cap, an oversized ordinary message). Each named shape is
verified through the real history/detail route before its samples count; diff
items stay explicit missing evidence because the Claude adapter writes none.
Maintenance: write and rewind large completed rows on a disposable seeded chat
under a held outside reader, then measure other-chat sends during the hold,
after release and while freed pages are reclaimed, from read-only page/WAL
state. Retired-epoch pruning is skipped unless such rows are observed.
* fix(native-chat): preserve stopped result disclosure and async fixture ownership
* Resolve lost-session warning identity at the journal writer
* Cover the 4a conversion, history-shape and maintenance-debt cases through outside observation
Conversion: seed a medium chat (310 chats on the full profile) and refuse a
cached seed from another recipe. Observe the candidate's existing
epoch-installed ready boundary with a read-only poll of journal_chat_state.
An idle seed copy yields launch to every chat ready and the per-size
ready-mark intervals; the families copy verifies an unconverted first open and
waits for every chat ready before any steady-state family.
History/detail: the stub emits ordinary Claude subagent frames (interleaved
and sparse-root corpora) and a shapes turn (huge completed tool originals, one
above the detail reply cap, an oversized ordinary message). Each named shape is
verified through the real history/detail route before its samples count; diff
items stay explicit missing evidence because the Claude adapter writes none.
Maintenance: write and rewind large completed rows on a disposable seeded chat
under a held outside reader, then measure other-chat sends during the hold,
after release and while freed pages are reclaimed, from read-only page/WAL
state. Retired-epoch pruning is skipped unless such rows are observed.
* Remove the retired ACP warning-reader fixture field
* Validate warning writer authority before duplicate selection
* Wake queued delivery when pending requests change
* Validate authority before all resolved item selection
* Use current chat test fixtures and name the handover journal owner
* Keep warning authority validation on the semantic selection branch
* test: lose unsaved ACP creations before a successful resume
* refactor: tighten SQL journal types and publication reads
* test: use SQL chat writers and async journal observations
* Replace casts and empty type imports in the 4a harness scripts with annotations and guards
Renderer times and tab ids from waitForFunction handles go through typeof
guards, the visibility probe is a declared Window global, the runtime call
keeps its own typed response, and cached manifests, Electron paths, profiles
and families are narrowed by guards. The empty `import type {}` blocks name
AppStore and use it. Three casts remain, each with a line-specific SAFETY:
the generic RPC result and Node's performance inside main-process callbacks.
* refactor: type handover owners and finite recovery snapshots
* Name the 4a arm's bundled envelope builders by their tracked source files
The protocol bundle imported from './src/shared/agent-session/...', a folder
the path-literal ratchet reads as an unresolved import. Each module is now a
tracked-file constant joined onto the arm's own checkout, the same form
runtime-file-watcher-resource-probe.mjs uses; the bundle and its exports are
unchanged.
* Replace casts and empty type imports in the 4a harness scripts with annotations and guards
Renderer times and tab ids from waitForFunction handles go through typeof
guards, the visibility probe is a declared Window global, the runtime call
keeps its own typed response, and cached manifests, Electron paths, profiles
and families are narrowed by guards. The empty `import type {}` blocks name
AppStore and use it. Three casts remain, each with a line-specific SAFETY:
the generic RPC result and Node's performance inside main-process callbacks.
* Name the 4a arm's bundled envelope builders by their tracked source files
The protocol bundle imported from './src/shared/agent-session/...', a folder
the path-literal ratchet reads as an unresolved import. Each module is now a
tracked-file constant joined onto the arm's own checkout, the same form
runtime-file-watcher-resource-probe.mjs uses; the bundle and its exports are
unchanged.
* Port cross-version wire tests to SQL journal reads
Hosts take the shared domain database, reads go through named async
journal reads and catch-up history pages, and released-build fixtures
type the release's own synchronous journal API.
* Align cross-version downgrade tests with one-way conversion
A downgraded build sees the chat and records as converted and its
later writes are not carried forward. Drop tests whose subject was
this build's legacy row and outcome writes; seed newer legacy rows
before the first conversion.
* Port cross-version wire tests to SQL journal reads
Hosts take the shared domain database, reads go through named async
journal reads and catch-up history pages, and released-build fixtures
type the release's own synchronous journal API.
* Align cross-version downgrade tests with one-way conversion
A downgraded build sees the chat and records as converted and its
later writes are not carried forward. Drop tests whose subject was
this build's legacy row and outcome writes; seed newer legacy rows
before the first conversion.
* test: open runtime fixtures with SQL journal workers
* test: combine runtime fixture imports
* test: prune resolved compatibility timeout finding
* test: use bundled SQL workers for runtime admission fixtures
* test: await SQL reader delivery and complete real rewind cuts
* test: include the medium chat in comparison profile metadata
* test: cover snapshot holds after replacement rollback and read failure
* test: keep clear history assertions on saved and rendered results
* Inject the deletion scenarios' record removal at the SQL record store's reads
The SQL record store has no transact or record-deletion command, so the
authoritative-deletion cases make the store's public record reads answer as
for a missing record and restore them before teardown. Assertions unchanged.
* Align cross-version fixtures with async SQL publication
Wait for frames that follow committed reads, await the async
completion feed, route the outline and item calls to their current
host methods, and expect the restart unreconciled latch on loaded
records.
* test: delete automation records with their command receipts
* Seed completed diff originals through the baseline writer and measure them
The 4a stub speaks Claude stream-json, whose adapter writes no diff items, so
completed diff originals were a skipped row. The seed now appends known
diffs once into its last filler chat through the seed arm's own original
journal writer, after that arm stops and before the seed is renamed or
copied, so every arm starts from the same rows and item IDs. Both arms verify
kind, original length, a short page head and the exact patch from detail
before timing the tail page and the detail read, and the conversion sweep
reports the diff chat apart from the small chats.
* Pin each 4a arm to a full SHA and prove its build came from it
Each --arm now names name=<checkout>@<full sha>. The harness refuses an arm whose HEAD
differs, whose product sources are dirty, whose renderer build-commit stamp is not that
HEAD, or whose sources changed after the build, and records that provenance in every
result. A cached seed from another seed-arm commit is refused, and report-only refuses to
mix results from different pins, seeds or recipes. Tables name full SHAs and disclose that
writer BEGIN-to-COMMIT spans are not observed.
* Establish restart recovery debt in the record writer
* Add active-chat resident memory comparison to 4a harness
* Commit complete provider dispatches and preserve Stop sources
* Coalesce pending publications across provider dispatches
* Capture CI watch actions at SQL writer publication
* Restore Claude task linkage in SQL acquisition facts
* Lift restarted queue holds through SQL admission
* Forward brief clear through Claude close
* Isolate SQL test worker lifetimes and prove fork durability
* Preserve saved queue order and recover restart custody on SQL open
* Keep saved queue contracts explicit and type fixtures accurately
* Run startup chat workspace conversion through its SQL owner
* Make journal command classifications exhaustive and remove unchecked casts
* Temporarily reverse quality cleanup to isolate translation regression
* Restore verified behavior-neutral journal quality cleanup
* Initialize real saved snapshot routes in Claude translation tests
* Repair native chat campaign readiness and contention measurements
* Measure fork contention under isolated retired history pressure
* Verify contention still targets a live stream at dispatch
* Run chat maintenance within the record-store lifetime
* Bound chat activity reads to work transitions
* test: adopt saved snapshots in direct Claude sinks
* Cover maintenance activity during registered starts
* test: initialize saved facts for Claude permission and resume fixtures
* test: await durable Claude resume and chain publications
* Complete provider dispatch identities in maintenance fixtures
* Preserve journal body admission and text close finality
* Scope optional permission backfill failure to its record change
* test: seed SQL reader fixtures through their owning contract
* test: assert saved Codex outcomes through SQL readers
* test: seed replay-budget withdrawals through command turns
* fix: refuse chat access on newer journal schemas
* test: migrate Claude echo wait; fails on known product finding
The retained Working assertion still fails after awaiting initial publication and accepted echo. The product finding is handed to the author.
* test: await SQL transcript and command publications
* test: migrate public rewind cursors and teardown warning scopes
* test: await child-work and status re-entry publications
* test: bind operation fixtures to SQL current-work reads
* test: establish recovery fixtures through owner restart reconciliation
* Keep child work owned across null status publications
* test: await subscriber and late-proof SQL observations
* test: resolve the profile transfer fixture from the repository root
* test: assert restart recovery capsules instead of internal call counts
* test: migrate Claude echo wait; fails on known product finding
The retained Working assertion still fails after awaiting initial publication and accepted echo. The product finding is handed to the author.
* test: await runtime session publications and final writer acknowledgement
* test: migrate coordinator mail SQL APIs; known product failures remain
* test: persist fork sources and use SQL RPC fixture contracts
* test: observe conversation publications in worker abandonment
* test: admit downgrade fixture owners through the SQL store
* test: await ordered attention prompt relay observations
* Keep status observer failures outside provider ingress
* Order provider facts before late delivery receipts
* test: submit replay fixture turns through the general writer command
* test: await durable worker delivery and lifecycle outcomes
* test: follow current provider ownership in coordinator mail
* fix(chat): settle mail custody from writer outcomes
* fix(perf): format retired fixture row count explicitly
* fix(chat): admit automatic worker close from current work
* Require live tool contention witness at send dispatch
* Await attention fixture updates and prune the fixed echo wait baseline
* Preserve the Pi startup exit verdict after recording process identity
* Check restored image deletion through the transcript view
* Adapt history pressure fixture and probes to current item storage
* Repair CI import paths and asynchronous lint findings
* Keep journal storage and projections acyclic
* Preserve proven startup facts across acquisition settlement
* Wait for the owning chat boundary in recovery and delivery tests
* Observe admitted delivery work in native chat fixtures
* Make native chat comparison measurements fail closed
* Isolate SQL worker fixtures across test files
* fix(sqlite): avoid retaining large bindings in cached statements
* perf(native-chat): reuse the captured queue publication
* test(orchestration): await refused mail settlement before recovery
* fix(orchestration): reconcile owned mail before consuming checks
* fix(orchestration): preserve each mail check response
* test(orchestration): diagnose surviving timers through public SQL reads
* perf(native-chat): place item metadata before large forms
* test(native-chat): require the octet-length column flag
* fix(native-chat): version persisted item presentations
* fix(native-chat): bound queued-image history admission
* test(orchestration): update shared mail source support
* fix(native-chat): preserve Stop transitions and admitted forms
* perf(native-chat): select the existing latest-turn index
* perf(native-chat): reuse history admission facts
* perf(native-chat): reuse shortened history wire forms
* perf(native-chat): batch bounded fork metadata reads
* fix(native-chat): synchronize CI fixtures and type mailbox receipts
* perf(native-chat): bound fork scratch presentation work
* test(native-chat): await subscriber catch-up completion
* fix(native-chat): retire readers after fork setup failure
* perf(native-chat): batch bounded fork metadata and output reads
* Reuse validated journal publication inputs on demand
* fix(chat): cancel reader requests on requested shutdown
* perf(native-chat): reuse narrow SQLite work reads
Read canonical current work and queue eligibility in one snapshot, and reuse validated work through the existing journal observation entry. Preserve full status publication, live authority validation, optional queue failures and final writer claims.
Frozen700 matches the reviewed 27-file source manifest and measured tree 6423b1cfbb. Cold and changed-head reads meet the one-point budget; unchanged publication frames improve.
Disclose report698 strict-rule misses accepted by the coordinator as noise: the approximately 4us warm in-memory hit has paired p50 ratio 1.047; one writer-ack cell (empty / 2 subscribers / changed) is +5.5% at p50, 0.259 to 0.274 ms, while completion is approximately twice as fast.
* test(native-chat): synchronize Stop with interrupt entry
The request note is written before the separate dispatch read and native cancel call, so observing the note cannot prove cancelTurn has started. Await the mock interrupt entry, then inspect the request note while its response stays unanswered.
Remove eventual polling and verify the single status note before and after the response without asserting its wording. No production ordering change, sleep, retry or timeout increase.
* fix(native-chat): refresh invalid full work projections
Use the existing SQL authority and context validation before preserving a
full projection, so refreshed narrow work can be reused after row-free
invalidation. Preserve a valid full projection arriving during a narrow
read and extend the existing owner scenario for both transitions.
Correct the description in b98a2544bf: the report698 strict misses are
small measured overhead, not proven noise. Empty warm currentWork p50 is
3.542 to 3.709 us (+0.167 us, 60/80 pairs slower, ratio 1.04715, 95% CI
1.02291-1.07259). Empty/2-subscriber/changed writer ack p50 rises 5.5%,
0.259459 to 0.273833 ms, with its CI excluding parity, on an unchanged
writer path; completion falls 1.546834 to 0.657125 ms. The coordinator
accepts these marginal costs; the strict FAILs remain disclosed.
Frozen714 patch 6a4ded1ee72e8c0134a9a2121fb39bde618213e3f740b4888fd13c8900274620.
Owning 53 tests pass on both configured entries; static gates pass. Private
point attribution verifies repeated narrow reuse and all 92 serving/frame
outputs match. Focused714 against pre-P7 base still measures a small warm
currentWork median overhead; report716 preserves raw samples and CIs.
* fix(native-chat): retain full work projections with saved Stop
Reuse the existing work-answer validity lookup when a narrow read returns.
A full status projection includes the saved Stop, while narrow work leaves
that overlay unrequested. Comparing only the authority work actually read
preserves a valid arriving full projection and retires stale authority or
context without a second cache or comparator.
Extend the held-read owner scenario with a real saved Stop. Private point
attribution shows unchanged full demand going from one reader point to
zero, with full and work outputs equal; invalidation reuse remains one
read followed by three cache hits. Owning 53 tests pass on both entries and
static gates pass. Frozen721 is parent plus two W3 files only; paused SQL
diagnostics work is excluded. Historical P7 benchmark costs remain small
measured overhead as corrected in 12d479e640 and report716.
* refactor(native-chat): remove obsolete work-state read plumbing
Remove the test-only combined work/queue wrapper and its queue callback after the work-state RPC removal. Delete unused projection and queue-list wrappers, keep internal functions private, and point the hydration overlap assertion at surviving current-work and queue owners.
Retain the narrow SQL work path, work-only projection entry and invalidation/Stop reuse guards: subscriber frames, history/current requests and background-task publication still demand them. Combined work and queue eligibility plus resolved-work reuse remain in production.
Validation: 7 owning files, 26 cases on direct Node and configured Bun entry; full configured Node typecheck and static gates pass. Focused parent-versus-change micro preserves exact output equality and point shape across 36 live queue/frame cells and 80 pairs; no paired interval excludes parity. Removed RPC work-state measurements are historical only.
Prior P7 strict misses remain disclosed small measured overhead: warm current-work median 3.542 to 3.709 us (+0.167 us, ratio 1.047; 60/80 pairs slower), and empty / 2 subscribers / changed writer acknowledgment 0.259459 to 0.273833 ms (+5.5%, CI excludes 1) on an unchanged writer path; completion 1.546834 to 0.657125 ms. Neither cost is established as noise.
* test(native-chat): preserve released chat queue publication coverage
Use the surviving queue publication owner after rewind and reopen,
preserving visible card persistence checks across both providers and all
three release cohorts without a production wrapper used only by tests.
Validation: all 49 cross-version and owning files pass on Node and the
configured Bun entry (148 passed, 1 skipped each); the e2e typecheck
ratchet has zero test errors and the owning static gates pass.
* Register native chat SQL workers with the main-blocking ratchet
The journal SQL writer and reader entries run on worker threads. Their
dependencies are grandfathered in the SQLite baseline as worker-only, the
same way existing worker dependencies are; none run SQL on Electron main.
Prune baseline rows the branch no longer needs.
* test(orchestration): hold native admission in mail reconciliation busy chats
The file-local busyChat answered turn/start, so main's automatic mail
steering (#41476) handed each queued mail card to the accepted turn about
80 ms after send. Cases that wait for a visible card then timed out (or
found it gone), and teardown logged the closed SQL reader. Reuse the
custody fixture's busyChat and settleTurn, which keep admission
unanswered until the scenario settles the turn.
Bun: 4/7 failed before; 35/35 passed across 5 runs after. Node: passes
with the custody file (18/18).
* test(agent-session): wait for the at-rest opening snapshot on the open stream
Subscribers queue the opening snapshot behind an asynchronous SQL work
read, so agentSession.subscribe can reply before the snapshot frame; the
queued-image wire contract depends on that ordering. The at-rest case
read frames only up to the reply and lost the race under CI load.
With a 50 ms opening delay injected locally: old assertion 3/3 failed
(expected undefined), new assertion 3/3 passed.
* Correct subscribe comment: the opening snapshot follows the reply
* test(agent-session): assert no agent start after the at-rest opening snapshot
* test(agent-session): wait for the status summary's own publication in the child-records switch
The session-list summary publishes after an async journal projection read that
neither flushStreamedEvents nor the strip's batch covers, so asserting it right
after either raced the SQL worker.
* fix(explorer): resync a recovered remote watch only after the host watcher is installed
The contact-regained resync fired when the files.watch subscription was accepted, before the
restarted host reported its watcher ready, so a file created in that gap was neither in the
re-read listing nor reported by the watcher. The managed-orcad explorer recovery spec now waits
for that resync before writing its probe file.
* fix(explorer): re-read a recovered remote explorer once when its host watcher fails to install
* test(explorer): the recovered watch resyncs after its ready signal
* test(agent-session): await the queued-operation results instead of polling a settled flag
The operation-order cases polled a settled flag and the compact spy with
vi.waitFor's 1 s default. Under SQL worker contention the goal or rewind
answers after more than a second, so the poll gave up while the operation
was still on its way (CI: "expected false to be true", then "closed by
quit" from the unhandled result). Await the result itself and a promise the
compact stub resolves.
With a 30 ms SQL reply delay injected locally plus CPU load, 3 repeats: the
old file failed "releases a startup goal" (expected false to be true) and
"answers a goal" (compact called 0 times); the awaited version passed all.
* fix(agent-session): reserve queued sends before a waiting operation's own place
DeliveryOrder.reconcile became async when the first-queued read moved to the
SQL readers, but the ready-operation path still called it without awaiting
and reserved the operation's place right after. The operation then took its
place before the queued send it was meant to follow, so a goal, rewind or
other operation requested while the agent starts could run ahead of a
message sent earlier; a failed read also became an unhandled rejection.
Await it, restoring main's order (reconcile, then reserve).
Found by typescript/no-floating-promises over src/main/native-chat.
* test(agent-session): let delivery park before the attention case's idle sweep
The single idle-sweep tick keeps a chat whose delivery loop is still
running, and the loop parks only after SQL reads that follow the second
send's completion event. When the tick ran first it touched the session
instead of retiring it, and the 1 s hasSession poll failed. Wait for the
loop to park (wake resolves when it does), as goal-steering does.
With an 8 ms SQL reply delay injected locally plus CPU load: old 2/5
failed (expected true to be false), new 5/5 passed.
* test(agent-session): await the fake Codex child's requests in compact-exit
Restarting after a mid-command exit runs the exit settlement, a fresh
acquire and the queued send's handover through the SQL workers before
turn/start, which outran vi.waitFor's 1 s poll under load. The shared fake
Codex now resolves nextRequest(method) when a child receives that request;
compact-exit awaits it instead of polling the calls list.
Seen once in a contended local sweep (8 ms SQL reply delay plus CPU load):
"expected [] to have a length of 1" at the turn/start poll. The new
version passed 5/5 under the same delay.
* fix(agent-session): keep a settled send's frame over an older work restatement
Subscriber delivery reads current work before the history page, then lets
that work restate unanswered sends over the page's rows. When a send's
settlement committed between the two reads, the page carried it accepted
but the earlier work restated it pending, so the frame at the new cursor
published the stale state. Later caught-up frames restate only still
unanswered sends, so the client never learned of the acceptance: the
Claude echo case kept a "pending" bubble although the journal held it
accepted. A restatement only describes sends its read saw unanswered, so
an accepted or rejected page row is newer and now wins.
structured-agent-session-claude-echo-working (failed once in CI, never
reproduced) with an 8 ms SQL reply delay injected locally plus CPU load:
before, most repeats stayed pending for 15 s while the stored row was
accepted at the subscriber's own cursor; after, 7/7 passed in ~100 ms.
* fix(native-chat): record the original journal copy identity
* chore(native-chat): grandfather the writer worker's one-shot source receipt
The receipt is captured once inside domain initialization, which runs only in
the SQL writer worker, so its synchronous stat and SQLite write never run on
Electron main or the orcad loop.
* test(native-chat): await current-request reads instead of polling for one second
The child-request case waited 1 s for the SQL reader's current-request
answer and failed on a loaded CI shard. Wake on each real state change
from the subscription and the request reader instead.
* fix(native-chat): re-answer current work when a catch-up page passes its cursor
A subscriber catch-up answered current work at one journal cursor, then read
the history page in a later reader transaction. The restated copy of a send
still pending at the work cursor replaced the page's accepted row, so the
renderer kept showing the send as sending.
Re-answer work when the page cursor has passed the work answer, refresh the
fan-out's shared work answer once the journal adopts a newer commit, and keep
the page's own rows when the page holds a commit not yet adopted.
* fix(native-chat): read subscriber page rows and current work in one reader snapshot
The catch-up overlaid a work answer from one journal cursor on a history page
read at another. Re-answering work afterwards still left a page that ran ahead
of the adopted cursor without its work, so a send shown as unknown could
revert to pending under an unchanged work fingerprint.
The history read now answers current work in its own transaction. The main
thread validates that answer against live owners and handover with the
existing currentness check, and reads the frame again until it has adopted
the frame's cursor. A cached answer is reused only when the page head is that
same cursor. The fan-out's queue now follows the work answer it was read
with.
* fix(native-chat): capture each subscriber frame at one held command-lane position
A subscriber frame paired rows, current work and the queue from different
positions, and waiting for the main thread to adopt a newer head re-read the
page until it did.
Each frame now captures its page and work (one reader transaction) and its
queue inside a single readInOrder on the chat's command lane, then releases
the lane before emitting. The queue reaches the frame through the explicit
queuePublication option, so emission never reads a newer one. A capture
whose live authority changed mid-read is discarded without advancing the
subscriber; the change's own publication delivers its replacement. Inactive
subscribers, closed journals and replaced session handles abandon the frame.
The resume path no longer decorates stop notes with work read before catch-up;
they restate the work of the frame the subscriber caught up to.
* fix(native-chat): validate whole captured frames and capture every work overlay
The queue gate inside a frame capture re-read work until it matched live
authority, holding the command lane, and the capture stopped validating
before its queue read. Stop-note pages, history replies, attach hydration
and queued-image decoration still paired rows and work from different
positions.
The queue gate now reads once at the frame's own authority, and outside a
capture once at the live one; a moved authority abandons the frame for the
change's own redelivery. The capture re-validates authority, handle and
cursor after its queue read. Stop-note pages are read on the lane only
while the journal is still at the delivered frame, otherwise the resume
catches up first. History replies and attach hydration use the same held
capture, and image decoration that finds the journal past its frame is
abandoned in favour of the newer commit's delivery. With every overlay
coherent, a settled page row can no longer meet an older restatement, so
the settled-send guard is removed.
* fix(native-chat): owe restatements after an emitted replacement and refuse exhausted captures as unavailable history
* test(native-chat): follow captured history frames in cross-version and queued-image wire tests
* Remove the converted legacy chat journal after its grace period (#42024)
* fix(native-chat): retire certified legacy journals after the grace period
* perf(native-chat): pace source proof through existing maintenance
* test(native-chat): exercise retirement with the native source lock
* fix(native-chat): account for queued card epochs during source proof
* fix(native-chat): settle retained journals and cancel stalled source leases
* fix(native-chat): keep the prepared retirement state narrowed
* fix(native-chat): apply retirement backoff before writer admission
* fix(native-chat): retry restored legacy retirement eligibility
* fix(native-chat): retain pending legacy eligibility helpers
* chore(native-chat): grandfather the writer worker's one-shot source receipt
The receipt is captured once inside domain initialization, which runs only in
the SQL writer worker, so its synchronous stat and SQLite write never run on
Electron main or the orcad loop.
* fix(native-chat): make retirement filesystem checks asynchronous
The four maintenance SQLite uses run only in the SQL writer worker and the 28 proof-page SQLite uses run only in the SQL reader worker; main-side proof coordination dispatches worker requests.
* fix(native-chat): build lock helper at the server glibc floor
Build Linux server helpers with the existing pinned glibc 2.28 slot images when the host is newer. Keep native floor and musl builds, and select the separate desktop toolchain explicitly. This prevents fast Ubuntu prebuilds from linking GLIBC_2.33/2.34 into a 2.28 payload.
Bound the helper PR workflow to 20 minutes and cover compiler selection without compiling native code locally.
* fix(native-chat): honor read-only retirement ownership
Do not acquire a writable retirement lifecycle for a newer-schema database, so shutdown never sends its read-only writer a retirement-credit command. Keep the existing preservation and empty-diagnostics regression unchanged.
Select the native exclusion test with the dedicated workflow flag instead of generic CI, and merge duplicate database imports in the retirement test.
* fix(native-chat): remove source proof table assertion
Annotate the content table inventory as readonly strings so membership checks accept schema table names without a type assertion.
* fix(native-chat): bound legacy retirement proof work
Persist source-intrinsic refusals for the exact copy, source and destination descriptor. Resume completed proof work after transient failures, and let the existing conversion owner finish pending imports.
Use covering-index key pages for history membership and exit terminal retirement states before writer admission. Preserve originals and prepared unlink manifests.
* fix(native-chat): recover legacy proof without repeating source work
Use the fixed profile-copy columns for source certification and keep damaged destination inventory retryable. Advance the shared refusal policy so earlier false inventory results are re-proved.
Complete verified empty heads after transient conversion failure, and carry proven original-source diagnoses through SQL errors without changing their ordinary identity. Persist only source-intrinsic refusals.
Validate in-place schema recovery, bounded empty completion, and malformed/newer histories at 128/1280 rows with zero retirement proof, conversion, restore or helper work across subsequent owners. Focused tests, tc:node, scoped checks and all 27 ratchets pass.
* test(native-chat): trace cursor resume frames on failure
Capture synthetic subscriber frame payloads and emission stacks when the existing restart assertion fails in CI. Keep the two-frame expectation and production behavior unchanged.
* test(native-chat): allow held-cursor roster frames on resume
A restarted host can publish an empty task and command roster before catch-up when its initial coherent capture is superseded. Validate that optional metadata frame, preserve the two history/work frames and no-replay checks, and await the work restatement instead of polling packet counts.
Remove temporary per-frame stack tracing now that CI identified the publisher. Production wire behavior is unchanged.
* test(native-chat): assert empty resume batches independently
Use literal empty arrays in the resume contract so a defect in the host's batch constructor cannot also change the expected value. Keep the optional held-cursor roster prefix and the two required catch-up/work frames.
* test(native-chat): expect the current conversation fence on resume
The roster publisher reads the conversation fence after restart and send, which can advance beyond the earlier runtime lease fence. Derive the expected fence from that current record and preserve every other resume assertion.
* test(native-chat): hold the domain database lock while a revoked history step is dispatched
* test(native-chat): accept held-cursor state frames before a resumed catch-up and fold them in a released client
* Start the chat journal writer earlier and defer maintenance until serving (#42045)
* Boot the chat journal writer during startup waits
Start the existing record-store slot after login env and before the daemon
wait in orcad, and right after runtime construction on Electron, through one
shared location builder that probes for saved chats once. Startup restoration
consumes that same attempt, so a refused journal is not reopened before RPC.
orcad's push-service start moves to its own module to keep the entry small.
* Start journal maintenance after startup restoration
The CPU profile showed the background sweep's reader spawn and writer
work competing with pre-RPC startup for the disk and CPU. A startup
open now holds maintenance until its restoration settles; other openers
start it on open as before. Reads still convert saved chats on demand.
* Move the headless-serve browser check to its own module
Behavior-neutral; keeps main-process-runtime-launch.ts within the line limit.
* Collect saved chat ids once and start journal maintenance after serving
orcad passes the ids it collected for the early open into runtime
construction instead of collecting them again. Background journal
maintenance now waits for the host's serving milestone (orcad readiness
published, Electron serve ready, desktop RPC start) rather than
restoration settling, so a stalled renderer cannot hold it. The desktop
early open starts after the first-window services fence. The refusal
test now observes that the journal is opened once.
* Keep the deferred desktop chat open inside shutdown, and start CI-line watches after serving
A first-window fence that settles after quit or a failed startup has
committed no longer opens the chat journal past its teardown; the
Electron startup-failure path now commits host shutdown as orcad's does.
Host installation re-arms CI-line watches only after a teardown stopped
them, so the first run starts at each host's serving milestone (orcad
after readiness, Electron after startup settles) instead of during
restoration.
* Admit CI-line watches at each host's serving milestone and let installs retry them
The first watch start no longer depends on renderer load: orcad admits it
after readiness, Electron serve after the serve-ready line, desktop once
the window and RPC start settle. Before admission, chat installation
leaves watches to that milestone; after it, installation's idempotent
start covers a failed first start as well as a teardown. Starts are
skipped once host shutdown has committed.
* Fence desktop watch admission, make warmup retry-only, and release failed watch starts
Desktop admits CI-line watches after the bounded first-window fence, so
automatic journal work never precedes it. The startup warmup timer only
retries a failed start; admission stays with each host's serving
milestone. A watch service whose start rejects after registering its
outcome observer and job hooks is stopped before a retry replaces it.
* Retry a failed CI-line watch start on the journal's maintenance pass
After admission, a saved-chat host whose first watch start failed had no
automatic retry. The journal's existing periodic maintenance pass now
calls the idempotent start when watches are admitted but neither running
nor starting; it does nothing after committed shutdown or while a service
runs. No new timer or loop, and nothing moves before readiness.
* Wire PR-watch recovery into every record-store opener
The chat host's install could open the once-slot first, without the
maintenance-tick hook, leaving a failed first watch start with no automatic
retry. The hook is now a required location field, set through one shared
builder by every production opener.
* Keep runtime identity state within the file-length limit
The saved-chat startup open's import now uses one namespace line, so the
file stays at the 300-line cap after the early-open field and method.
* Load the real chat host once before the PR-watch tests
The host-install-first regression loaded the real chat host module inside
the test, which CI's in-test vi.importActual gate refuses. It now loads in
beforeAll; the test body and its assertions are unchanged.
* Mark the desktop serving test's runtime stand-in as a reasoned cast
CI's changed-code gate requires the lint suppression form for a test cast;
the stand-in and its SAFETY reason are unchanged.
* Share journal database open options so the file stays within its line limit
* test(chat): restore released-client resume projection coverage
* test(chat): type the released-client fold accumulator
* test: fail the first opening subscription data frame
* test: update benchmark module paths after main sync
* test: resolve benchmark modules within each checkout
* test(native-chat): inject late receipts without a history read
* wip
* wip
* wip
* wip
* Improve experimental worktree cards with compact agent summaries
- Add an optional details row for workspace metadata and indicators
- Roll up descendant activity timestamps to parent cards
* Reduce worktree card metadata indentation
* wip
* Expand sidebar agent lines with subagents and remote host status
- Show subagent activity, send targets, and unread signals in slot cards
- Identify remote hosts and provide SSH reconnection controls
* Show child workspace status counts in sidebar cards
Distinguish monitoring agents and refine lineage alignment so workspace
activity is easier to scan.
* Enable navigation from worktree sidebar activity indicators
- Open the matching agent or workspace directly, or choose among multiple sources
- Use host-qualified identities for nested workspace activity
- Show pull requests in 2.0 card details and refine compact card layout
* Show every status in the sidebar card corner and let cards open and close
The title-row corner now shows one glyph per status the card speaks for
(needs, failed, unread, working), most urgent first, followed by the time,
instead of only the most urgent one. Each glyph opens its own sources.
Collapsed child workspaces report all their statuses through a flat,
shallow-comparable record.
Experimental 2.0 cards can also be opened and closed; a closed card's
title slot speaks for its hidden agents and children.
* final worktree design
* wip
* rm
* wip
* wip
* fix style
* fix commit
* Improve worktree card interactions and spacing
- Let users toggle cards by clicking their headers.
- Delay details until the pointer rests to avoid accidental popups.
- Add breathing room around card content.
* wip
* fix issues
* wip
* Improve workspace sidebar icons and navigation
- Batch AI icon generation and add settings to customize and regenerate icons.
- Fix agent navigation and unread handling across execution hosts.
- Keep linked reviews visible while loading and reduce unnecessary refresh work.
* Fix sidebar agent ownership and targeted title updates
Resolve unstamped agent sessions to their workspace runtime so sidebar
summaries and unread state follow the correct host. Limit title-change
invalidation to affected workspaces.
* fix build
* Simplify worktree sidebar icons and agent rows
- Generate monochrome icons that match the sidebar foreground
- Move agent model names into row tooltips to reduce clutter
* Keep agent timestamps visible alongside dismiss controls
* Fix worktree icon regeneration and bound the cache
Cancel stale requests when clearing icons so older results cannot
restore the previous cache. Evict unused renderer entries to limit
memory growth.
* Unify experimental workspace cards around title status
- Surface hidden agent and child workspace activity in the card title.
- Retire the second experimental layout and AI-generated icons.
- Preserve existing experimental card selections and add a details row option.
* wip
* wip
* wip
* fix bugs
* improve perf
* Fix sidebar lineage rollup: unread dot on children, running status on collapsed parent
- A card's unread dot and bold title now include its own visible agent rows'
unread results, so expanding a parent reveals which child the unread came from.
- A collapsed parent's status lane shows the most urgent descendant state
(needs you > failed > working) when it beats the parent's own status.
- Host-scoped workspace unread markers and related attention fixes.
* Improve sidebar activity rollup performance
- Refresh only stale descendant slots and scope unread updates to their workspace.
- Share agent row projections and index unread markers to reduce repeated work.
- Preserve host-specific agent activation and show the latest activity time.
* wip
* Fix sidebar attention state and optimize slot invalidation
- Preserve unread flags raised by users or earlier sessions when markers clear.
- Scope agent list expansion to each host.
- Track displayed panes and freshness deadlines to limit slot updates.
* wip
* Fix sidebar workspace status and host ownership
- Keep agent navigation and unread state scoped to the correct host,
including paired SSH workspaces and runtimes.
- Correct collapsed lineage status, stale review display, and settings
synchronization while reducing unnecessary sidebar refreshes.
* Show unread agent completions and scope workspace reads by host
* fix compile issue
* wip fix static checks
* wip
* Fix workspace sidebar agent ownership and PR display
- Update agent rows when terminal host bindings arrive and preserve
local ownership for unstamped retained completions.
- Keep newer hosted PRs visible when an older merged PR is cached.
ubuntu-latest now resolves to the Ubuntu 26.04 image, which installs the
amd64v3 package variant. Its GCC defaults to -march=x86-64-v3, so the
Electron-ABI node-pty in 1.4.257 shipped AVX instructions and the terminal
daemon died with SIGILL on CPUs without AVX. Pin the Linux x64 release
build to ubuntu-24.04, the image that produced the working 1.4.256.
Fixes#41637
* test(browser): measure agent input focus on the Windows desktop
* test(browser): show Orca inactive before the Windows holder takes the foreground
* test(browser): name the foreground window in Windows holder replies
* test(browser): lift the foreground lock before the Windows holder takes the foreground
* test(browser): run the Windows agent focus check from a dispatch-only workflow
* test(browser): skip the Windows focus checks before launch off hosted runners
* test(browser): harden the Windows focus holder and its dispatch workflow
* test: remove low-value push and relay coverage
* test: delete orphaned fixture and closure support
* test: trim runner and mobile recording matrices
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
* Improve bug report template for desktop, remote, and mobile
Capture where users hit the bug (local desktop, SSH, remote server, WSL, mobile, web) without extra host jargon, and collect remote OS when relevant. Extend the OS labeler for mobile.
* Reconcile OS and mobile labels from the bug form's current state
Form: one "Where were you using Orca?" choice (Desktop only, + SSH host,
+ Orca server, + WSL, Mobile app, Web browser, Other), device OS with iOS
and Android, optional remote host OS, shorter help copy and per-platform
version instructions. Main's English request is kept.
Labeler: read the issue as it is now instead of the webhook snapshot,
recognize only a bug form at the very start of the body (optionally after
the exact machine-translation note line), and stop at the free-text
heading. Unknown, repeated, out-of-order or multi-line metadata leaves
labels untouched. Only os:macos, os:Windows, os:linux, os:mobile and
mobile are ever added or removed, one label at a time, so labels added
concurrently by people or other workflows survive. Each pass is verified
by a re-read and retried up to three times; runs are serialized per issue.
Fixes stale mobile labels after an edit to desktop, stale OS labels after
an edit to Other or blank, empty sections reading the next heading as a
value, quoted form sections relabeling unrelated issues, and prototype
names such as "constructor" being sent as labels. Retired Where option
strings and the Client / Host operating system headings keep working for
open issues.
Tests run the workflow's inline script against a stateful mock of the
issues API.
* Trim OS labeler tests to behaviour that fails when the fix is reverted
Review finding F11140-C1-1: several added tests pinned form copy, option
inventories, schema keys, workflow constants or script source, and kept
passing with the production change reverted.
- Delete bug-report-issue-form.test.mjs (schema keys, copy, option lists,
About-menu source regexes). The form/labeler contract is kept as one
behavioural case: every option the shipped form offers is recognised.
- Drop the workflow-constant and script-source regex tests, the log-copy
assertion, the note-length check and the plain-string label case.
- Replace the Where x OS matrix (with its test-side oracle) and the other
Cartesian tables with one literal case per distinct behaviour.
- Point negative fixtures at an OS the old script would label, so each
kept case fails against the reverted workflow rather than passing because
the old script skipped iOS.
220 -> 59 tests; all 59 fail with only the workflow reverted to main.
Test-only change; no runtime path changed.
* Keep the shadowed legacy value case in the heading-presence test
It covers a distinct rule (an invalid legacy value is ignored when the
current heading is present) and was dropped by mistake in the trim.
* fix(computer-use): scroll, expand and set sliders on Windows without raising the window
* fix(computer-use): wait for Windows scroll and slider writes to settle before verifying
* fix(computer-use): reject NaN for Windows slider set-value
* test(computer-use): wait on the Windows fixture state with vi.waitFor and a schema
* test(computer-use): check activation per action against a holder window in the Windows fixture
* test(computer-use): log fixture window events for activation failures
* fix(computer-use): report foreground when a Windows app raises itself for a UI Automation action
WPF activates its own window for Scroll, ExpandCollapse, RangeValue and SelectionItem calls from any UIA client, so the runtime now compares the foreground window before and after a pattern action instead of assuming background. The Windows e2e checks delivery against the fixture's own activation count, with a holder window in another process.
* test(computer-use): skip an unstarted holder when closing the Windows fixture
* fix(computer-use): bound Windows pattern scroll paging and tighten slider read-back
* fix(computer-use): cap Windows slider read-back tolerance and run the UIA e2e only on CI
* refactor(ai-vault): group scanner modules by defining owner
* refactor(ai-vault): consolidate owner imports and isolate path absence
* Preserve mobile CI triggers for extracted absence predicate
The site now lives at orca.dev; the old onorca.dev and www.onorca.dev hosts
redirect there. Linking to orca.dev directly skips that redirect.
Only page links change. Service hosts, sign-in and relay endpoints stay as they are.
* chore(endpoints): call orca.dev for feedback, plugin lists and update notes
The site moved to orca.dev. Feedback, connection diagnostics, plugin install
stats, the plugin kill list, update nudges and the changelog feed now use
orca.dev, as do the diagnostics token URL baked into builds and the release
download mirror (downloads.orca.dev). The old hosts serve the same paths,
so released builds keep working.
Skill share links on share.orca.dev are accepted, and the mobile scanner
recognizes the orca.dev Android download code. The old hosts stay accepted.
* chore(ci): leave the release JavaScript benchmark workflow unchanged
Editing it triggers the benchmark, whose parity check currently fails on
arm64 because max-quality brotli output for the mobile page differs by
architecture. The benchmark only needs some diagnostics URL, and the old
host still serves it.
* fix(runtime): hold tui-idle until a cold-starting Claude has painted (STA-2380)
A shell auto-title (oh-my-zsh preexec) names the pane `claude` the moment
the command execs. Claude's `idle_title` rule counts that bare name as weak
idle once output has been quiet for 3s, so a Claude that took >3s to draw
its first frame settled `terminal wait --for tui-idle` on a blank screen.
`dispatch --inject` then pasted into a TUI that had not mounted yet and the
prompt was lost.
Name-only idle lanes (agent rule verdicts that require quiet, and the
sustained-title lane) now also require that the running command has painted
something since the shell's OSC 133;C command-start marker. Shells without
the marker keep today's behavior.
* fix(runtime): corroborate Claude's name-only idle with its own composer marker (STA-2380, C1 F1)
Orca's zsh OSC 133;C hook is first in preexec_functions, so a later user or
framework preexec hook (zsh-you-should-use, a custom echo) prints after the
command-start marker and before Claude runs. The any-visible-byte paint latch
counted that text as Claude's paint, so a silent cold start under such a hook
still settled tui-idle ready-weak on the shell's bare `claude` title.
For agents whose worker start already trusts their composer marker (Claude),
"painted" now means that marker (`❯`+NBSP after DECSET 2031, which no shell
sends) arrived since the command started. Other agents keep any-byte paint;
markerless shells and output gaps keep the permissive default.
Evidence: a real-zsh live-shell test under the production wrapper with
oh-my-zsh title-only, p10k/starship-style silent, and you-should-use-style
printing hooks, replayed through the real wait; runtime tests for the hook
text, a boot banner, the positive bare-title + composer path, and worker-start
readiness plus brief delivery timing.
* fix(ci): route command-paint attribution sources to shell_contracts; attribute live-shell bytes by stream offset (STA-2380, C2 F1/F2)
- pr-shell-contract-prefixes: the live-shell test, terminal-command-paint.ts,
tui-idle-evidence-source.ts and draft-paste-ready-scanner.ts route to the
shell_contracts job; a routing test reads the job's step from pr.yml and
asserts every listed test routes there.
- tui-idle-zsh-preexec-hook-order.live-shell.test: locate the DECSET 2031
anchor by offset in the accumulated stream, split a straddling read, carry
pending escapes across the shell/agent halves, and assert attribution is
invariant under coalescing and 3-byte re-chunking.
- terminal-command-paint: disclose the accepted trade-off (a known Claude with
marker history but no supported composer signal times out; markerless shells
and output gaps still fail open; no version cutoff claimed).
* test(ci): stream-offset launch-order proof, route tui-idle-evidence.ts, parse the whole shell-contracts step (STA-2380, C3-1/2/3)
- live-shell test: assert the launch order on the joined bytes by stream
offset (133;C, then the user hook's output, then the agent's anchor and
composer); no read-boundary or timestamp assertions remain. Re-chunk
cases add a split anchor and a shell-tail/agent-start coalesced read.
- pr-shell-contract-prefixes: route tui-idle-evidence.ts, the readiness
evaluator the live-shell replay exercises.
- routing ratchet: read the step's run script through the YAML parser so
a blank line or later command cannot truncate it; cross-check against
the real-shell tests UNIT_EXCLUDE drops so a dropped entry fails rather
than a smaller count; fixture tests for blank line, exact list, missing
step.
* test(ci): answer compinit's insecure-directory prompt in the zsh preexec live-shell test (STA-2380)
Ubuntu's global zshrc runs a plain compinit, which on CI runners stops at
"Ignore insecure directories and continue [y] or abort compinit [n]?"
before zle exists, so the stand-in never launched and the shell-contracts
job failed with "no composer frame from the stand-in". Answer the prompt
with y as zsh-startup-hook-pty-harness.ts does. The prompt bytes precede
Orca's OSC 133;C marker, so stream-offset attribution is unchanged.
* test: remove 60 low-value cases and orphaned conversion fixtures
* docs(ci): list supported Windows SSH host cells
* test: recognize direct Windows orcad server entry
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
OrcaWinandOrcaWin
Brennan Benson
Neil
Jinjing
Kelvin Amoaba