fix: classify unmounted chat writes and Settings unavailability

[undivisible]

Summary

Follow-up to #12914. Production chat writes stay unadmitted, but they now use the same nested error grammar the chat client already parses. Browser Settings, conversation detail, empty libraries, capture ownership, and the PWA development selector stop looking like empty success or a generic retryable outage when the producer, coverage, or door is missing.

Granted chat.read conversation reads no longer dump every chat: row onto the first Listen-sequence page. Production GET /v1/conversations pages Listen and granted chat sessions together by updatedAt descending then id ascending, matching Worker readConversations / paginateConversations. Each page keeps the requested limit. The union cursor is a distinct HMAC policy from the Listen-sequence cursor, bound to the Listen revision and chat snapshot sequence. A Listen-sequence cursor cannot continue on the union path. The last item may be a chat: or Listen row; the position table stores that identity instead of a fake Listen sequence. Missing chat.read keeps the Listen sequence reader. Empty history still does not invent chat:chat-main. Migration 0058 is in the checksummed manifest.

HEAD continues after the union page is worker-green:

• 2fea38f4d1 / 5e90b3d7e6 / 9c231cb7ca / 7fa813af6f / 51928e1989 / 59b1556925 / 34899a269d / 23d1fba7e8 / 0baa4b0950 / 8a71bd029b / d74db69efc / 7d8e9f0891 / 1941186ad7 / ee83ece2a4 / b3470ebc06 / 2e7944a829 / 8a6bc1b61e / f167d65b01 / 7cfd1cc9ed / 83dae78a57 / 05b6a00930 / d65bcf3fcb / f8ddd69f8b / 8d8a7186da / 78ede54213 / 9e4e6316f2 / 2360277217 / fc56024139 / 96328b6ff9 / f5637cf962 / 528e1e2d74 / a10392f4f6 / 0459fda85e / 97128c21d2 / 04524f08aa / 71247a5d85 / 874d87687d / c2650d7f4c / 8a1479b42b / 4be501c906 / 1faf7c91ac / 320d851045 / a5ae2b8d92 / 9c2280dda8 / a89cc8473a / 4d2acbb59a / 9e6fb129a1 / 9c47a5c78c / 9bf8c4beef / e2422d1543 / bff42ffece / 7ee8cd617f / 8429c828c3 / 3e1d36eec0 / ce722cbdc0 / 97c85dc5be / 1cb3a58fba / 0e507e9392 / 7614cb77f0 / 27cc153c21 / 27126e8ac6 / 51aa6489e7 / 9a64d9027f / 6ef4dcb9e4 / b90ec9df4e / 2d65d843c1 / c61c54164b / f25a1e7b6e / fba3e2150f are worker-green including Portable PostgreSQL 18.4.
• Current HEAD e45def0560 is waiting on GitHub Validate backend worker, including Portable PostgreSQL 18.4.
• 49f083f2cf failed GitHub Validate backend worker at Client contract regressions (run 34169977662): macOS Home memory rows preferred summary over title. Portable PostgreSQL was skipped. Repaired in 2d65d843c1.
• Worker and production ownership without a receipt producer are nested {error:{code:"capture_ownership_unavailable",retryable:false,action:"none"}} without inventing a receipt. Production identity-verification and authorization-source 503s stay {error:{code:"unavailable"}} with retry-after: 1.
• 9a64d9027f: wide Home search includes matching tasks instead of claiming "No results" over a complete conversation/memory miss. A task page that did not load still omits those rows.
• 6ef4dcb9e4: wide Home search rows use the same visible conversation title and summary fallbacks as Conversations, compact Daily Recaps, and macOS Home, instead of blank gaps for untitled processing Listen/recording rows or empty summaries.
• b90ec9df4e: compact Home Daily Recaps open the matching conversation detail instead of remaining display-only. View All still opens the conversation list.
• 2d65d843c1: Memories page, macOS memory rows, and wide Home search use parsed visible memory text instead of blank bodies or raw entity: prefixes. Home list titles stay on the memory title; cards use the body. Search indexes that copy. Old /v3/memories still does not invent provenance digests.
• c61c54164b: compact Home omits Open calls instead of routing that control to Conversations. Conversations stays on its tab. This does not invent a phone-calls producer.
• f25a1e7b6e: compact Home and the Tasks page no longer label a disabled read-only task control Open. Incomplete read-only rows stay Task; completed read-only rows stay Completed; Complete/Reopen stay when writes are available. Tasks page Open task still opens the editor when writes and an edit handler are present.
• fba3e2150f: compact Home Daily Recaps use the same Today/Yesterday/date grouping as Conversations instead of weekday-only labels, preferring startedAt then createdAt.
• e45def0560: macOS Tasks no longer labels a disabled read-only task control Complete or Reopen. Incomplete read-only rows stay Task; completed read-only rows stay Completed; Complete/Reopen stay when writes are available.

Writes still need a source-owned entitlement producer. Settings identity/entitlements still need an owner-backed producer. This PR does not mount admission, project token claims, or invent completeness.

Why this boundary

Unmounted Hono {error:"not_found"} (string) left throwBackendError with code: unknown, so send failures looked generic. Nested non-retryable not_found is the chat client's existing grammar and does not auto-retry. A live Ask/Send control after that door still looks like a working composer. Settings 503 without a producer is unavailable, not an empty signed-in page, and Retry-After on that door advertised a transient outage. Overlaying chats onto listen-sequence pages duplicated rows, skipped listen items, or minted a cursor the listen position table cannot save. Combined Home search that ignores an incomplete task page still claims a complete miss. Worker and production ownership 503s with retryable: true or retry-after advertised a transient outage for a missing receipt producer. Native then reclassified other nested non-retryable ownership 503s as OMI_HTTP_TRANSPORT, which JavaScript treats as transient. Apps Retry that ignores nested retryable:false advertised a live Retry for a catalogue door that cannot succeed until a producer exists. Generation cancel that maps nested non-retryable 404/503 to OMI_HTTP_TRANSPORT makes Stop look like a blip. Desktop Apps gallery that ignores that same nested catalogue 503 claims a load blip instead of an unmounted catalogue. Memories later-page Load more that ignores nested retryable:false claims a load blip for a door that cannot page further. Native OMI_DEV_BACKEND_UNSUPPORTED history that falls through to connection copy keeps Check again on a closed door. Conversation-detail Load older that replaces the loaded page with a full-page error makes persisted messages look gone. A later-history error that flips the composer into the resting stage claims "I'm ready." / "Nothing's waiting on you." over a blocked older cursor. Later Rewind Load more after OMI_REWIND_UNAVAILABLE or OMI_REWIND_AUTH advertises another page against a capability door that cannot succeed. A chat-write latch that survives Old/New switch keeps Ask disabled on a plane that may have writes, and keeps the previous plane's transcript. Desktop Conversations that report "More conversations are available" without Load more advertises a first-page window the Mac cannot continue. Desktop Home that reports "More memories are available" without Load more advertises a first-page window with no Memories destination. Nested non-retryable task-write 503s and OMI_DEV_BACKEND_UNSUPPORTED throws that classify as retryable advertise Retry for a door that cannot succeed. Write-ops control_unavailable 503s must stay retryable. Native transcript GET throws of OMI_DEV_BACKEND_UNSUPPORTED or nested retryable:false that always set retryable: true advertised Check again and "Transcript could not be loaded." for a closed door. Closed capture and ownership doors that still say "Reconnect your Omi" or "reopen the app" advertise a recovery action that cannot succeed until a producer exists. Closed task-write doors that omit Retry but still say "This change was not accepted" claim the edit was invalid instead of unavailable. Native OMI_DEV_BACKEND_UNSUPPORTED send throws that already latch Ask but still say "Message not sent. Check your connection and try again" claim a blip instead of an unmounted write door. Nested non-retryable POST /v1/users/* writes that reuse saved-data copy or "Settings change could not be saved. Try again" claim a library/local blip instead of a closed account-setting door. Desktop Home mixed Conversations & memories that shows a generic Load more while only paging memories looks like it continues conversations. Nested non-retryable GET /v1/users/* slices that still say "This saved data is not available" claim a library door instead of a closed account-setting door. Conversations, Memories, and Rewind Load more controls that still say generic Load more after Home memories and Tasks named their noun look like they continue a mixed list. Conversation-detail and mobile Home Load older that still say generic Load older after desktop Home named Load earlier messages look like they continue a mixed transcript. Desktop Settings Account that falls back to "Signed in to Omi" when /v1/users/profile is nested non-retryable invents a signed-in profile line over a closed account door. Desktop Alerts that treat a still-loading account snapshot as recording storage and private cloud sync being unavailable invent a closed privacy door, and a page-level loadAccountSettings throw that leaves Account on "Loading account…" invents a load that cannot finish. Desktop Alerts that load /v1/users/training-data-opt-in but never render it hide a closed account-setting door as if that privacy control does not exist. Desktop AI & Automation that load /v1/users/developer/webhooks/status but never render it hide a closed developer door as if webhook status does not exist. Connectors My Apps that says owned apps are unavailable until the account profile loads after a nested non-retryable /v1/users/profile read invents a load that cannot finish. Connectors Installed that keeps catalogue enabled bits after a nested non-retryable /v1/apps/enabled read invents an installed list the enablement door cannot confirm. The macOS Apps gallery that drops that same enabled-list error claims "No apps are available" or uninstalled tiles over a closed enablement door. Mobile Home recaps, tasks, and mind map that say "Couldn’t load …" after a nested non-retryable library 503 claim a transient load blip instead of the mapped unavailable door. Home, Tasks, and desktop Tasks that say "Task editing is unavailable for this connection" while the task read is still loading or after that read failed invent a closed write door over an unsettled or failed library read. Explore and the macOS gallery that say "Not installed" / "Not connected" after a nested non-retryable /v1/apps/enabled invent a known-empty install state the enablement door cannot confirm. Wide Home search that says "Conversations are unavailable" / "Memories are unavailable" after a nested non-retryable library 503 claims a generic load blip instead of the mapped unavailable door. The macOS library banner that says "Some of your history isn't loaded yet" after every failed door is nested non-retryable claims a delay instead of a closed producer. Desktop Settings Current plan that omits already-loaded transcription seconds after a successful subscription read hides usage the mobile Settings Plan already shows. Desktop Settings Account that omits already-loaded company, job, and data protection after a successful profile read hides identity fields mobile Settings already shows. Desktop Settings Account that says "Signed in to Omi" when a successful profile read has no email invents a signed-in identity line over a known-empty email. Desktop Settings Account that omits already-loaded Account id and treats a null name as no Name row hides identity fields mobile Settings already shows. Wide Home search that says "Saved data is unavailable." above mapped saved-data copy when every library door failed claims a generic parent over a closed producer. Explore Install that stays live after a nested non-retryable /v1/apps/enable POST advertises a write door that cannot succeed. Settings Privacy Opt in / Update that stay live after a nested non-retryable recording-storage, training, or private-cloud-sync POST advertise a write door that cannot succeed. Conversations Refresh that stays live after a nested non-retryable first-page library read advertises a retry for a door that cannot succeed. Conversations, Memories, and Tasks that still say "More X are available" after a nested non-retryable later page omitted Load more advertise a continue door that cannot succeed. Empty searches on those same closed later pages that still say "More X are available" advertise that continue door as the miss title instead of "No loaded X match." Memories and Tasks first-page error states that showed only "Memories/Tasks unavailable" with no Refresh left retryable library failures without a recovery CTA, while a live Refresh after nested non-retryable copy would advertise a retry for a door that cannot succeed. Compact Home recaps, tasks, and mind map, and the compact Tasks tab, that showed only mapped unavailable copy with no Refresh left retryable library failures without a recovery CTA on the surface that actually hosts those errors. macOS Home that still says "More conversations/tasks are available" after a nested non-retryable later page omitted Load more on those destinations advertises a continue door that already closed. A Home search miss that still says "More conversations/memories/tasks are available" after that same closed later page advertises the continue door as the miss title instead of search-miss copy. Claiming "Nothing captured yet" / "No tasks yet" on an unfiltered empty Home that still has more items would invent an empty library over remaining pages. Wide Home search OutcomeStatus that still says "More conversations/memories are available" after that closed later page advertises the continue door in the results footer even when the empty title already omitted it. Compact Home recap and task strips, and the compact Tasks tab, that show loaded rows from an incomplete or has-more page without coverage copy look like a complete library. Wide Home search OutcomeStatus that reports only conversation and memory completeness hides task errors, incompleteness, and more-available copy behind a search that already treats tasks as part of the combined library. Compact Home mind map preview that always shows the same collapsed nodes without coverage copy looks like a complete map over an incomplete or has-more memory page. Wide Home search that hides that task OutcomeStatus whenever conversation and memory reads both failed hides task coverage behind a parent line that only describes conversations or memories. Wide Home search that says "Showing saved data. Could not refresh." when conversation and memory doors both failed invents a loaded search list over empty conversation/memory rows just because tasks still have items. Wide Home search that lists only conversations and memories claims "No results" over tasks that match the query. Wide Home search rows that keep raw empty conversation titles and summaries render untitled processing Listen/recording rows as blank gaps after Conversations, compact Daily Recaps, and macOS Home already use visible fallbacks. Compact Home Daily Recaps that stay display-only hide conversation detail the Conversations tab already opens for those same rows. Memories page, macOS memory rows, and wide Home search that keep raw empty bodies or namespaced entity: prefixes render blank or machine-id rows after canonical parseMemoryText already separates that prefix. A memory list helper that prefers summary over title hides a distinct Home headline. Compact Home Open calls that routes to Conversations invents a phone-calls door over a tab that already exists. Compact Home and Tasks page controls that say Open on a disabled read-only task invent an open action the write door cannot perform. Compact Home Daily Recaps that label cards with weekday-only dates make last-month conversations look like this week's Monday. macOS Tasks controls that say Complete on a disabled read-only task invent a write action the door cannot perform.

Verification

fba3e2150f GitHub Validate backend worker passed, including Portable PostgreSQL 18.4: https://github.com/BasedHardware/omi/actions/runs/34171480621

Current HEAD e45def0560 is waiting on that same worker gate, including Portable PostgreSQL 18.4. Local RN suite: bun run --cwd react-native test -- --runInBand (696 pass).

A GitHub “1 check success” notice is not worker-green. Remaining production-readiness is producer-gated (chat writes, Settings identity, DEV IAM, hardware). Linux cannot certify Apple Debug builds, ScreenCaptureKit, physical BLE, or iPad.

Linux cannot compile scripts/test-apple-auth. Docker/test:postgres is still unavailable in this Cloud VM.

Not verified here: applying migrations 55–58 to based-hardware-dev, Cloud Run deploy, live Firebase grants, Apple Debug builds, ScreenCaptureKit, physical BLE/iPad.

main and production deploys are untouched. The New-backend query-origin fix is already on v5 (dc0ca0524f / #12914).

Remaining (not this PR)

• Chat POST/SSE/cancellation with a real entitlement producer
• Settings identity/entitlement producers and attachment storage
• Worker chat admission still uses STAGING_CHAT_LIMIT as a lifetime ceiling, not a subscription-period authority
• DEV IAM / Cloud Run (no gcloud in this VM)
• Hardware: physical BLE, iPad, live ScreenCaptureKit / macOS capture
• Closed-door later-page more-available copy is now omitted on Conversations, Memories, and Tasks pages, including empty searches of loaded rows, on macOS Home after a closed later conversation or task page, on Home search misses after those closed doors, and on wide Home search OutcomeStatus including tasks. Compact Home loaded recaps/tasks/mind map and the compact Tasks tab now keep completeness and more-available copy, and omit more-available after a closed later page. The mind map preview stays collapsed. Wide Home search still shows task OutcomeStatus when conversation and memory doors both failed, and that parent line uses mapped copy instead of "Showing saved data. Could not refresh." when tasks still have rows. Wide Home search results include matching tasks and visible conversation title/summary fallbacks. Compact Home Daily Recaps open the matching conversation detail; View All still opens the list. Memories page, macOS memory rows, and wide Home search use parsed visible memory text instead of blank bodies or raw entity: prefixes; Home list titles stay on the memory title. Compact Home omits Open calls instead of routing that control to Conversations. Compact Home and the Tasks page no longer label a disabled read-only task control Open. Compact Home Daily Recaps use the same Today/Yesterday/date grouping as Conversations. macOS Tasks no longer labels a disabled read-only task control Complete or Reopen. First-page Home more-available without a Home pager stays. An unfiltered empty Home with remaining items still reports more-available. Non-mac Memories and Tasks first-page reads and compact Home/Tasks match Conversations Refresh omit/offer. Remaining production-readiness is producer-gated. Do not hide Home conversations/tasks more-available copy just because Home has no pager. Do not claim "No X yet" on an empty unfiltered page that still has more items. Do not mount chat writes or invent Settings identity. Do not add Refresh to missing Settings/Apps/Conversations content stages. Do not expand the collapsed Mind Map.