Skip to content

T3Code — single canonical promotion queue (#42) #42

Open
Open
T3Code — single canonical promotion queue (#42)#42

Description

@kvnloo
kvnloo
opened on Oct 16, 2026

Authorization update (October 16, 2026): The user-directed GitHub-only factory policy supersedes Linear as a posting prerequisite. Read the human decision. A READY row remains only a qualification result and never grants origin write or merge authority.

Consolidated duplicates — 16 October 2026

Only this issue is the active promotion queue for this repository. #43, #44 are duplicate snapshots retained closed for provenance. Preserve original PR authorship/review; never equate a fork READY title with current-head validation or permission to post upstream.

No unique PR links were missing from the older issue.

T3Code upstream promotion queue — one evergreen issue

Canonical fork promotion queue. Add new code, reviews, branch handoffs, wave receipts, and blocked upstream writes here; don't mint further T3Code promotion queue issues. Keep original implementation PRs, issue #38, and attribution threads intact as evidence sources. Cross-repo index: OSS Factory #14. Updated October 16, 2026.

A · Verified origin disposition (16 October 2026)

  • LANDED: #20299 — duration-format boundary fix; source head 8c0f2b81e3da7305b3067c613b0cd873ed90eced, independently merged by juliusmarminge on 2026-10-18T19:33:36Z as bd93830550d57e38fa9f2cf7a486c76058818359. Both changed-file blobs match accepted source head. Credit: arhxam / ValeraZSD original reports, Muse Spark donor [muse] fix(shared): round duration to seconds before choosing unit suffix #30, GPT-6 port under Kevin’s direction. Historical CI/review evidence retained below; merge is not new runtime/performance proof.
  • LANDED / historical hosted CI SUCCESS: #20736 — Android atomic staging cleanup, head e4d931d376caabb20722151c093ce7a2ce3d4c2a on fork branch fix/mobile-atomic-temp-cleanup-20261016; source parent 2a337fea92f3232e185e3ecc44e3f1c414a3661c. Original CI 39004211536 failed formatting only (Lint/Check); CodeRabbit finding repaired in follow-up. Latest CI 39004564952 SUCCESS, mobile fingerprint SUCCESS. Earlier exact source isolated 2/5→5/5 and strict stubbed TS PASS; Expo device NOT RUN. Macroscope approved earlier source, maintainer acceptance/merge pending. Original credit: fork #26 Muse Spark; new port GPT-6. Independently merged by juliusmarminge on 2026-10-18T19:33:52Z as c15a793282f349ede0d6b9e4492bb32906979b29; both changed-file blobs match source head. Muse Spark original diagnosis/fix/tests and GPT-6 async port credit retained. Expo/Android runtime remains NOT RUN here; merge alone adds no runtime proof.
  • ORIGIN_LIVE / hosted CI SUCCESS; reviewer reapproval pending: #20738 — web final-close-save retry, fork branch fix/web-file-save-close-retry-20261016 at da6e9d98f08b31769d1e86ffd930c0f4ef02c156; based on upstream 99fac2687d43d50d523b440b06f20750c362f06b. Original CI 39004473920 SUCCESS, but Macroscope identified a high stale-overwrite risk (review). Follow-up da6e9d9 adds shouldRetryAfterClose tied to live optimistic draft via useFileSaveCoordinator and one native regression test; new exact-head CI 39004708801 SUCCESS (Lint, Build/Typecheck, Test, Web Test, Check); independent re-review of the original stale-write finding still pending. Isolated TypeScript model 2/6 baseline→6/6 fixed and isolated strict TypeScript PASS; full native/browser NOT RUN locally. Source: fork #33 Muse Spark; adapted port GPT-6. Do not represent the prior CI pass as certifying the new head.
  • SUPERSEDED / DUPLICATE: #20255 was closed unmerged as a duplicate of #15599; do not reopen or repost. Preserve source #28 provenance.

Other work remains CHECK, LIMITED or LOCAL_ONLY until independently justified and current-head verified; a blanket promotion instruction never overrides upstream's one-problem-per-PR, evidence, duplicate, or prior-feature-approval rules. No origin/default-branch merges or maintainer pings.

B · Immediate promotion prerequisites

C · All other open downstream PRs (qualification intake, not automatically ready)

This list is generated from the fork's open GitHub issues/PRs on October 16, 2026. It is a deduplication ledger, not an assertion of CI, requirement evidence, or mergeability. Update each row in place to PROMOTE_PR, PROMOTE_COMMENT, REPAIR, WAIT, LOCAL_ONLY, LANDED, or DROP only with exact-head evidence.

  • #40 — draft: scoped read-only voice intent gate for Android assistant — LOCAL_ONLY · parent fix(mobile): make assistant approvals filter exact (downstream preview) #39, needs native test + consented voice transport
  • #39 — fix(mobile): make assistant approvals filter exact (downstream preview) — LOCAL_ONLY · native UI verification + approved feature scope
  • #37 — draft QA: single-flight Pi/CUA stdio restart (for T3 feat(cua): attach the managed Cua Driver to every provider session pingdotgg/t3code#16528) — CHECK · fork QA for owner PR feat(cua): attach the managed Cua Driver to every provider session pingdotgg/t3code#16528, live Pi/CUA test absent
  • #36 — draft QA: Windows SIGKILL Codex recovery test portability (for upstream fix(server): release Codex sessions when the app-server dies pingdotgg/t3code#18139) — CHECK · fork QA for owner PR fix(server): release Codex sessions when the app-server dies pingdotgg/t3code#18139, Windows test absent
  • #35 — [muse] fix(server): gate T3 Connect credential clear on the credential semaphore — CHECK · exact-head tests, requirement, overlap and HITL unverified
  • #34 — [muse] fix(server): serialize host-backed files-viewed writes per change request — CHECK · exact-head tests, requirement, overlap and HITL unverified
  • #33 — web final file-save retry — ORIGIN_LIVE / CI GREEN, RE-REVIEW PENDING #20738, head da6e9d98f08b31769d1e86ffd930c0f4ef02c156, CI 39004708801 SUCCESS; stale-overwrite finding addressed with guarded draft retry; Macroscope re-review not confirmed. Muse Spark original + GPT-6 port.
  • #32 — [muse] fix(web): hold viewed-marks until a read that could have seen the write — CHECK · exact-head tests, requirement, overlap and HITL unverified
  • #31 — [muse] fix(client-runtime): promote subagent token counts that round to 1000k into the M unit — CHECK · exact-head tests, requirement, overlap and HITL unverified
  • #30 — [muse] duration rounding donor — LANDED via adapted origin #20299; accepted source 8c0f2b81e3da7305b3067c613b0cd873ed90eced, merge bd93830550d57e38fa9f2cf7a486c76058818359 (2026-10-18T19:33:36Z). Original donor remains OPEN at distinct head 194df3f3255839a0ffe817ad13b5fe12ac4384ce; not an exact-head mirror and not closed. Retain Muse Spark source/history plus arhxam / ValeraZSD and GPT-6 port attribution; no claim the old donor branch itself merged.
  • #29 — [muse] fix(web): promote rounded-up compact counts into the next unit — CHECK · exact-head tests, requirement, overlap and HITL unverified
  • #28 — token unit rounding — SUPERSEDED/DUPLICATE · #20255 closed unmerged in favor of #15599. Original Muse Spark provenance preserved; no resubmission.
  • #27 — [muse] fix(web): prune useLiveRefresh fallback view entries on unmount — CHECK · exact-head tests, requirement, overlap and HITL unverified
  • #26 — mobile atomic temp cleanup donor — LANDED via adapted origin #20736; accepted source e4d931d376caabb20722151c093ce7a2ce3d4c2a, merge c15a793282f349ede0d6b9e4492bb32906979b29 (2026-10-18T19:33:52Z). Muse Spark original contribution and GPT-6 async port credited. Original donor remains OPEN at distinct head d12c3d11ae636228f5ecfe1a46fb5a4c8bbae004; not an exact-head mirror and not closed. Android E2E NOT RUN; no claim the old synchronous donor itself merged.
  • #25 — [muse] fix(server): bound analytics batch send with a 10s timeout — CHECK · exact-head tests, requirement, overlap and HITL unverified
  • #24 — [muse] fix(server): bound Codex feedback/upload with a 60s timeout — CHECK · exact-head tests, requirement, overlap and HITL unverified
  • #23 — [muse] fix(web): bound ghostty wasm downloads with a 30s fetch deadline — CHECK · exact-head tests, requirement, overlap and HITL unverified
  • #22 — [muse] fix(server): bound OTLP trace export proxy with 30s timeout — CHECK · exact-head tests, requirement, overlap and HITL unverified
  • #21 — [muse] fix(server): bound GitHub media redirect hops with a 10s timeout — CHECK · exact-head tests, requirement, overlap and HITL unverified
  • #20 — docs: bounded activity evidence R&D — CHECK · exact-head tests, requirement, overlap and HITL unverified
  • #19 — [muse] fix(server): bound device hub proxy HTTP with 30s time-to-first-response timeout — CHECK · exact-head tests, requirement, overlap and HITL unverified
  • #18 — [muse] bound sync setup-script join so a wedged script cannot stall thread bootstrap — CHECK · exact-head tests, requirement, overlap and HITL unverified
  • #17 — [muse] fix(server): fail stalled project clones after 5 quiet minutes — CHECK · exact-head tests, requirement, overlap and HITL unverified
  • #16 — [muse] fix(server): bound git push with a deadline and non-interactive env — CHECK · exact-head tests, requirement, overlap and HITL unverified
  • #15 — [muse] fix(server): bound Bitbucket API requests with 30s timeout — LANDED · origin #14140 merged 2026-10-14T12:15:14Z, merge df8df0d53b39bfd6a5d8d69fabade19bd668e0a5; exact fork/origin/retained-branch head 5adf42ff4adefb7340f519e88388a580b0f49b0c. Ordinary mirror CLOSED without merge or branch deletion on 2026-10-18 (receipt); full accepted two-file patch matches merge commit. Credit: Kevin Rajan / kvnloo + Meta Muse Spark (Muse); GPT-6 follow-ups; Macroscope/CodeRabbit review. Original evidence preserved; no new tests/CI or origin writes; do not promote again.
  • #14 — [muse] fix(shared): bound cloudflared download with 10-minute timeout — LANDED · origin #14139 merged 2026-10-08T20:31:54Z, merge 580948708b66f2a971199670f76cb6b43119e9a4; exact fork/origin/retained-branch head 89f9bff9627ef4d7c38ac35ba6be737b8c6a7bc7. Ordinary mirror CLOSED without merge or branch deletion on 2026-10-18 (receipt); full accepted two-file patch matches merge commit. Credit: Kevin Rajan / kvnloo + Meta Muse Spark (Muse); juliusmarminge rebase/test port. Original evidence preserved; no new tests/CI or origin writes; do not promote again.
  • #13 — [muse] fix(server): bound OpenCode text generation with 180s timeout — CHECK · exact-head tests, requirement, overlap and HITL unverified
  • #12 — [muse] fix(acp): bound extension requests with per-request timeout option — CHECK · exact-head tests, requirement, overlap and HITL unverified
  • #11 — [muse] fix(server): bound relay environment unlink with a 5s timeout — CHECK · exact-head tests, requirement, overlap and HITL unverified
  • #10 — [muse] fix(server): bound OAuth token HTTP calls with a 10s timeout — CHECK · exact-head tests, requirement, overlap and HITL unverified
  • #9 — [muse] fix(server): bound managed-tunnel recovery retry window to 10 minutes — CHECK · exact-head tests, requirement, overlap and HITL unverified
  • #8 — [muse] fix(server): retain open approvals and native questions past the activity cap — CHECK · exact-head tests, requirement, overlap and HITL unverified
  • #7 — [muse] fix(web): write localStorage values even when the stored blob fails schema decode — CHECK · exact-head tests, requirement, overlap and HITL unverified
  • #6 — [muse] fix(server): reject checkpoint revert while a turn is active — CHECK · exact-head tests, requirement, overlap and HITL unverified
  • #5 — [muse] fix(server): recompute checkpoint turn count after slow git capture — CHECK · exact-head tests, requirement, overlap and HITL unverified
  • #4 — [muse] fix(server): bound app-server RPC waits with per-request timeouts — CHECK · exact-head tests, requirement, overlap and HITL unverified
  • #3 — drainable worker shutdown — DROP · origin fix(shared): don't count dropped post-shutdown enqueues toward drain pingdotgg/t3code#14129 closed as superseded by merged fix(shared): DrainableWorker keeps running after a failed item pingdotgg/t3code#16223; preserve original credit, no duplicate.
  • #2 — [muse] harden threadReducer status helpers against unknown future statuses — CHECK · exact-head tests, requirement, overlap and HITL unverified
  • #1 — [muse] fix(server): print pairing credential expiry as ISO timestamp — LANDED · origin #14128 merged 2026-10-10T03:14:36Z, merge 97009b049a13fac5be5bee13a34b04cd6b87a7e7; exact fork/origin/retained-branch head b614eb0f967fbdf85c333f236646f5a422d6e7ec. Ordinary mirror CLOSED without merge or branch deletion on 2026-10-18 (receipt); full accepted two-file patch matches merge commit. Credit: Kevin Rajan / kvnloo + Meta Muse Spark (Muse). Original evidence preserved; no new tests/CI or origin writes; do not promote again.

D · Promotion receipt schema

For each ready candidate, append a short row or comment with: source PR/branch + commit SHA; target origin PR/issue; behavior and independent requirement evidence; base→head test/CI (native where relevant); reviewer feedback; current ownership/credit; current HITL status; proposed smallest origin action; final origin URL or blocker. Deduplicate on <origin-repo>#<number> and never reopen work already landed/declined.

No-human-pings policy: downstream queues use plain contributor handles or source links without GitHub account mentions. Original reporters, authors, testers and reviewers retain explicit credit.

Activity

  1. kvnloo
    changed the title [-][OSS Factory] T3Code — single upstream promotion queue[/-] [+]T3Code — single canonical promotion queue (#42)[/+] on Oct 16, 2026

  2. kvnloo commented on Oct 16, 2026

    @kvnloo
    kvnloo
    on Oct 16, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    Consolidated Lane 4 campaigns (historical Waves 1–34, not 34 separate upstream contributions)

    One row per distinct requirement and existing carrier. Keep all original wave-level test/patch receipts as provenance and do not mint more promotion queues.

    Campaign / related waves Durable implementation carrier Qualification / next gate
    Android read-only fast actions and approvals (initial waves) RFC #38, fork draft #39 LOCAL_ONLY/CHECK. Exact Android preview build, remote T3 Connect, recent CI and supported UX evidence not certified.
    Delegated subagent approvals and cross-thread summary (W3, W16, W22, W27–34) Verified commits e50ef5ba (preview approval adapter) and 47782030 (pure digest). Upstream original feature #19630 had its own original authors. CHECK/LIMITED. Later environment-conflict, stale-revision, wrong-all-clear, and summary UI patches (W28–34) were reported as local handoffs; do not infer they are committed. Reconcile one cumulative source diff, preserve upstream contributor credit, run real mobile and server integration tests.
    Scoped voice intent admission and lifecycle (W2, W4–15, W18–26) Fork draft #40 (read-only gate), stacked on #39; additional local patches addressed session cancellation, teardown/timeout, concurrent dispatch, microphone lease and dictation races. Source reference: elliptic1's closed/unmerged app-wide prototype #15544. LOCAL_ONLY for later patches. Isolated red→green/regression counts in historical waves were not independently rerun on current repository head. Rebase once, native Vitest/typecheck/build and physical Android + actual provider teardown before any readiness claim; do not inherit the prototype's standing mutation permission policy.
    Jev navigation admission + safe thread selection (W17, W24–26, W29–31) Existing fastActions.ts / read-only voice gate, prior local compound-intent/issued-target/stale-selection patches CHECK/LOCAL_ONLY. No live Jev model wiring or benchmark. Reject compound write intent; recheck current authorized shell targets at dispatch; verify source preservation on conflict.
    Fork QA for upstream-owned fixes #36 (Windows Codex SIGKILL), #37 (Pi/CUA stdio single-flight) CHECK. Revalidate on original owner PR heads; no competing upstream PR or claim of native Windows/Pi certification.
    Other fork source PRs All 39 open PRs indexed in the body of this issue INTAKE/CHECK; evaluate each against existing upstream owners, supported requirements, head tests and current policy before moving to READY.

    Source-truth boundary: only the linked GitHub commits/PRs are remotely published work. Prior conversation patch/bundle filenames are historical references, not remote code until recovered, applied and read back by SHA. No real Android spoken round trip, full repo Vitest or autonomous origin promotion has been verified here.

    Current permission: follow the October 16 human-directed GitHub-only cutover. A ready candidate still requires explicit, scoped human authorization; neither the old Linear board nor this queue gives automatic permission. Credit the original T3 maintainers, LovelyCodeMonkey/t3dotgg on delegated attention, saphid and elliptic1 on app-level voice concepts, and the original owners of QA PRs. Do not ping anyone from this internal queue.

  3. kvnloo commented on Oct 16, 2026

    @kvnloo
    kvnloo
    on Oct 16, 2026
    OwnerAuthor

    Executed native promotion + current origin-owner disposition — 16 October 2026

    Actual origin action: submitted pingdotgg/t3code#20255 for review. Source is the published commit 34b602ca3c433cedda0cd449db0dbc106a2a2b16, branch fix/token-unit-rounding-native-20261016, based on current upstream cfafb4bb54d244e4612f5681aad3832ea64cb0fb. This is a code contribution, not a queue-only readiness claim. No default merge, force push, new queue, or execution-policy workaround.

    Selected executable leaf: source #28 → origin pingdotgg#20255

    • Defect: the real shared formatTokens returns 1000K, 1000M, or 1000B when rounding crosses the next suffix boundary. The fix selects the suffix at the corresponding numeric half-unit boundary; existing precision and top-unit behavior stay intact.
    • Provenance: [muse] fix(shared): promote rounded-up token counts into the next unit #28 (Muse Spark / Muse) retains credit for the original report/alternate implementation. The promoted patch and its tests were written afresh with GPT-6.1 Sol through omp on current upstream main; no cherry-pick or copied array/string-promotion implementation, no attribution laundering. Model/harness history is disclosed in the origin PR.
    • Requirement/scope: current-main repro and the CONTRIBUTING exception for a very small obvious bug. Not a new feature, global timeout policy, or app-level approval request. Origin searches for formatTokens, 1000K, rounded-up, and token round found no competing rounding repair.
    • Native evidence: Linux arm64, Node v24.14.0, repository-pinned vite-plus@1.0.0 + effect@4.0.5, actual contracts workspace. vp test run packages/shared/src/usageFormat.test.ts → 1 file, 30 tests passed, including 21 new token cases. Dependencies were isolated outside the repository, without provider installation or mocked contracts.
    • Separate native imports of the complete unchanged base module and complete head module observed/asserted all six positive/negative promotions: ±999500: ±1000K → ±1M, ±999500000: ±1000M → ±1B, ±999500000000: ±1000B → ±1T. Immediately-below-boundary cases, unchanged formatting, and 1000T saturation are in the committed suite.
    • Limits: no full build/typecheck, native mobile run, UI screenshot/recording, Android/voice/assistant acceptance, upstream CI approval, maintainer acceptance, or merge is claimed. The exact source tree tested was then committed and pushed. This is PROMOTE_PR / pending review, not LANDED. No user-guide update is needed for a numeric formatter correction; this existing queue is the durable campaign/evidence record.

    Current owned origin feedback sweep, before the new submission

    The live author query returned 44 existing owned origin PRs: 3 MERGED, 41 CLOSED unmerged, 0 OPEN. Latest owner/maintainer dispositions and review summaries were read; old fork OPEN state must not be mistaken for a live origin carrier.

    Authorization: the direct user instruction authorized qualified promotion; it does not authorize merging, passing review gates, or claiming successful mobile integration. Existing contributor credit and maintainer review remain intact. All subsequent work stays in this queue.

  4. kvnloo commented on Oct 16, 2026

    @kvnloo
    kvnloo
    on Oct 16, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    ACTIVE_ORIGIN_REVIEW — newly verified exact-head hosted CI (not a merge or additional PR).

    • Original author/carrier: pingdotgg/t3code#20255, branch kvnloo:fix/token-unit-rounding-native-20261016, SHA 34b602ca3c433cedda0cd449db0dbc106a2a2b16. OPEN, not draft, GitHub mergeable; no submitted human review or unresolved inline thread at check.
    • Required behavior: shared formatTokens shouldn't display rounded transitional 1000K/M/B; native Node 24.14.0 old-vs-new tests at ±999500, ±999500000, ±999500000000 and 30 focused pass were previously executed/reported in original submission receipt. The origin PR credits the original Muse bug discovery/alternate design and explicitly credits GPT-6.1 Sol + omp for the new numeric implementation/tests.
    • New exact-head hosted proof: CI run 38914501632 SUCCESS; 15 successful jobs (lint, changes, 8 server tests, Test, Release Smoke, Build and Typecheck, Web Test, Check) and 2 skipped (Rust and Mobile Native Static Analysis, not failures). Mobile Fingerprint Check SUCCESS, Cursor hygiene SUCCESS; Mobile EAS Preview SKIPPED. CodeRabbit's exact-head review reports no actionable comments. This turn read existing hosted results; no local T3 native invocation, physical mobile test or measured impact was performed.
    • Overlap/authorization: no competing formatter owner was located in the originating submission sweep; GitHub-only user-scoped publication already occurred on the original thread. Do not create duplicate PR, invent approval, or ping maintainers; this queue adds evidence without additional origin write.
    • Next action: original maintainers independently review/accept the small shared formatter fix. No factory-origin/default merge.

  5. kvnloo commented on Oct 16, 2026

    @kvnloo
    kvnloo
    on Oct 16, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    ORIGIN_LIVE — new original upstream #20299, not a queue-only draft. Ported the concrete duration-formatting defect from fork #30 onto current origin main@cfafb4bb54d244e4612f5681aad3832ea64cb0fb, leaving head 8c0f2b8, two files, 2 ahead/0 behind. formatDuration(59_500) used to produce 60s; new test checks 59,499→59s, 59,500/59,999→1m.

    Exact-head hosted CI 38932010613 SUCCESS, Mobile Fingerprint #38932010475 SUCCESS; hygiene SUCCESS, EAS skipped. Earlier fork source reported RED 2→GREEN 32/32, shared 955/955 and web tsc; those are historical donor tests, not newly rerun locally against this port. Origin PR is OPEN, NON-DRAFT, MERGEABLE, NOT MERGED; pending human review. One original issue (pingdotgg#5026 by arhxam) was closed stale with maintainer maria-rcks explicitly inviting current-main rebuild; ValeraZSD's combined pingdotgg#13412 was rejected per one-problem rule and split. Credit both, Muse Spark's original fork implementation, new GPT-6 current-main port; AI disclosed. No new duplicate origin PR, reviewer ping, force/default merge. Next: respond to actual maintainer feedback on existing pingdotgg#20299, if received.

  6. kvnloo commented on Oct 17, 2026

    @kvnloo
    kvnloo
    on Oct 17, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    Lane 4 promotion decision — 16 October 2026

    Human scope: Kevin directly authorized an upstream T3Code promotion wave in the active conversation. Per the current factory HITL contract, this permits independently verified, nonduplicative, policy-compliant origin PR submissions within T3Code; it does not authorize an origin/default-branch merge, unrelated projects, force pushes, feature-policy bypass or maintainer pings. Linear is retired. Recheck requirements and origin policy per PR.

    Selected focused campaign: Android atomic-write temporary file cleanup — original fork PR #26; original work prepared with Muse Spark under the owner's direction (retain that credit). Current origin main pinned at 07956d1ac54200f14c0f2b5221d1fe3f81a7cc7f; its apps/mobile/src/lib/atomic-file.ts blob f4318b6e068e68f231ba02a0d36f0c13005429cb awaits File.write, unlike the older fork #26. Do not cherry-pick the stale implementation without adapting async behavior.

    Requirement/behavior: staging file cleanup on failed write or rename; retries from composer/outbox can otherwise accumulate .tmp entries. Fresh isolated TypeScript-model test against exact upstream source: base 2/5 PASS (three cleanup failures), adapted source 5/5 PASS with asynchronous mock write; isolated strict TypeScript check PASS (stubbed Expo typing). Repo-native Vitest, real Expo and Android: NOT RUN, no claim of physical runtime benefit. Confirm current-head CI after publication. Next: port focused source/test to isolated fork branch from pinned upstream main and request origin review only if diffs remain narrow.

    Other carriers remain separate: #20299 is already origin-live (do not duplicate); #20255 closed as duplicate of pingdotgg#15599 (do not refile); #39/#40 Android assistant preview/voice remain LOCAL_ONLY pending native and feature-direction proof. No factory #14 change needed.

  7. kvnloo commented on Oct 17, 2026

    @kvnloo
    kvnloo
    on Oct 17, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    Current-head correction for existing origin pingdotgg#20738: e62985e, open/unmerged. Do not retain the older two-finding assessment against da6e9d9.

    • Retry finding is resolved: source now caps close retries at three with 500/1000/2000 ms backoff and retains pending state.
    • Cross-client thread remains unresolved, but CodeRabbit's updated summary treats the unverified race as owner awareness, not a merge blocker. Unconditional server writes predate this PR; no cross-client data loss was reproduced here. Macroscope reapproval is not established.
    • CI 39009201991 succeeded. Web tests executed: 503 files / 7004 tests, including coordinator 16 and hook 12. All eight server-test jobs skipped their Test steps. CI tested synthetic merge f0f1ba8, combining this head with base 8653c8f; this is not an independent raw-head or browser/runtime execution.
    • GitHub reported mergeable=true at 06:19:58 UTC, correcting the transient earlier false value. Maintainer acceptance remains pending. Preserve original fork [muse] fix(web): retry failed close-time file flush instead of dropping it #33 Muse Spark provenance and GPT-6 port credit.

    Connector/source/hosted-log reconciliation only; no new implementation, local tests, origin posting, or merge. Continue with the existing owner and carrier, not a duplicate PR.

  8. kvnloo commented on Oct 18, 2026

    @kvnloo
    kvnloo
    on Oct 18, 2026
    OwnerAuthor

    Lease released; bounded closeout complete. Fork ordinary mirrors #15, #14, #1 are CLOSED, not merged. Each exact fork/source/retained-branch head matched freshly verified merged canonical-origin work; each complete accepted patch matched its independently resolved merge commit. The three existing LANDED rows were reconciled together in one queue-body update, preserving other human and worker content. Canonical queue #42 remains OPEN.

    Original attribution, source bodies/receipts and historical branches preserved. No noneligible item was closed; no origin writes, source/CI changes, tests/build/lint/format, merges or branch deletions. This releases the original bounded T3LandedCloseout lease, not a new claim.

  9. kvnloo commented on Oct 19, 2026

    @kvnloo
    kvnloo
    on Oct 19, 2026
    OwnerAuthor

    Bounded canonical-queue lease: T3NewMergesReconcile, only reconciliation of independently merged origin pingdotgg#20736 and pingdotgg#20299 into existing rows. No source changes, origin writes, mirror closure, branch deletion or acceptance expansion. Prior lease is released; current body and all seven comments read. Release follows this coordination update.

  10. kvnloo commented on Oct 19, 2026

    @kvnloo
    kvnloo
    on Oct 19, 2026
    OwnerAuthor

    Lease released — accepted-state reconciliation complete. Existing four queue rows now record LANDED for independently merged origin #20736 (2026-10-18T19:33:52Z, merge c15a793282f349ede0d6b9e4492bb32906979b29, source e4d931d376caabb20722151c093ce7a2ce3d4c2a) and #20299 (2026-10-18T19:33:36Z, merge bd93830550d57e38fa9f2cf7a486c76058818359, source 8c0f2b81e3da7305b3067c613b0cd873ed90eced). Both were merged by juliusmarminge, authored by kvnloo; these are prior contributions, not merges caused by this worker.

    GraphQL source-only proof: all changed-file blobs at accepted source and merge match exactly. pingdotgg#20736: atomic-file.test.ts = deb7c217b2f4968aa7ebd8c0a1091e57c3f3ebe2, atomic-file.ts = a6ed504c707a94047f1ac8490330fb6f7af3deb9 (under apps/mobile/src/lib/). pingdotgg#20299: orchestrationTiming.test.ts = b3bb0a8f07561d05ecf8afc173c68d5c72fe9b59, orchestrationTiming.ts = 53c9d9a6dc76fd91fcb44977de00c9712599a594 (under packages/shared/src/). Merge trees respectively 0a786e6386b104bcd28b32e0e4a7d1b4e7a21257 and d2bb61ba76490ac587196e7f22feba9688a47ed7; single-parent merge records, not a claim that source head is an ancestor. No current-main relevance or runtime/performance acceptance inferred.

    Retention observed: fork refs fix/mobile-atomic-temp-cleanup-20261016 and promotion/format-duration-unit-boundary-20261016 still point to the exact accepted heads. Original donor #26 remains OPEN at d12c3d11ae636228f5ecfe1a46fb5a4c8bbae004; #30 remains OPEN at 194df3f3255839a0ffe817ad13b5fe12ac4384ce. They are distinct historical implementations, not exact-head mirrors; no closure. Preserve Muse Spark original discovery/implementation/test credit, GPT-6 port attribution, and arhxam / ValeraZSD duration sources. No source/history/body edits to these donors. No exact-head ordinary mirror in the parent’s complete open-fork scan; no new mirror scan or fabricated closable PR. Older #1/#14/#15 were not revisited.

    Actual writes: bounded lease comment, this issue’s four affected body rows, this release/result comment. Origin writes: none; source changes: none; PR closures: none; merges/branch deletion: none. Queue remains OPEN. No tests/build/lint/formatters or new native execution; physical Android/Expo and new duration runtime proof remain NOT RUN here. Original receipts/history remain intact. This is coordination-only under the current user instruction, not publication or merge authority.

  11. kvnloo commented on Oct 22, 2026

    @kvnloo
    kvnloo
    on Oct 22, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    Origin pingdotgg#20738 — maintainer takeover; HOLD until cross-client conditional write

    Live origin #20738 is OPEN/non-draft/mergeable at 3cfe94a3651e9d70645121c4fb2316258e0729e6. Exact-head hosted CI #39369671055 completed SUCCESS; local native/browser tests NOT RUN in this audit. Previous queue's da6e9d9 status is superseded. The author also added bounded close-retry backoff (max 3), preserving pending state on exhausted failures.

    New authoritative human maintainer review: Julius (juliusmarminge) explicitly took over this PR for a focused web-misc batch, verified native coordinator/hook tests 30/30 plus real Linux editor close-save failure/recovery, and left an unresolved cross-client data-integrity blocker: disposed client A's delayed retry can overwrite client B's newer saved file, even with same-runtime draft guard. The required fix is an atomic expected-content/revision check at the server file-write boundary plus a two-client negative regression. Steve-cooks linked #22956 as adjacent conditional-write design/issue, not an approved PR or merged solution.

    Disposition: ORIGIN_LIVE / OWNER_TAKEOVER / HOLD (CI green, correctness not accepted). Do not mark merge-ready, post duplicate upstream comments, or overwrite Julius's in-progress branch. Existing original diagnosis and patches retain Muse Spark provenance; the live source port and maintainer review maintain distinct authorship. Next gate belongs to original owner: narrow conditional server-write behavior and two-client test, then fresh current-head review/CI. No source code, default branch, origin PR/comment/review, or CI were changed here.

  12. kvnloo commented on Oct 23, 2026

    @kvnloo
    kvnloo
    on Oct 23, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    FAC4-T3CODE-CAS-01

    goal_lock: READ-ONLY qualification of origin #20738, specifically the cross-client delayed close-retry overwrite and proposed atomic expected-content/revision server write. No implementation, source lease, competing PR, origin comment, mobile #40/Tern/Unii work, or merge. Success here = current-head/source/review/required-check evidence and an exact next gate, not a source fix. Proof needed to clear HOLD = native two-independent-client write-conflict regression plus conditional server write and maintainer acceptance.

    Exact live refs (re-fetched 2026-10-23): pingdotgg#20738 OPEN, non-draft, unmerged, GitHub mergeable_state=clean; source kvnloo/t3code:fix/web-file-save-close-retry-20261016@3cfe94a3651e9d70645121c4fb2316258e0729e6 (4 commits, only three web files changed); PR target pingdotgg/t3code:main@b1167b6ca20c19790694ca3552429b8868865285 (live PR base_sha); separately, origin main tip is 9a391eb3f55b738113b61768cf2d8263b4f3ac2e. No new branch/PR/head SHA from this audit. Previous queue receipt 6341101979 remains a correct blocker report; owner has not fixed it at the observed PR head. Current main independently lacks server CAS too.

    Requirement/reviews: Julius's owner takeover and confirmed native 30/30, Linux close-save recovery, and explicit cross-client HOLD are the human requirement/source. Macroscope r4301464091 remains unresolved but outdated; CodeRabbit r4301505149, submission 5556348738, is unresolved, current, correctly identifying the missing cross-runtime guard. CodeRabbit retry-backoff r4301505144 is resolved/outdated, covered by bounded exponential retries. Submitted review states seen: COMMENTED, no current approval or CHANGES_REQUESTED; Julius's HOLD is in the conversation. Steve's adjacent #22956 pointer is not approval or a merged prerequisite; attempts to fetch origin pingdotgg#22956 as issue/PR currently return 404 via connector. Credit: original fork #33 / Muse Spark, GPT-6 current-main port, Julius's maintainer investigation, and original reviewers remain separate.

    Exact file-write boundary at PR head:

    Test gap: coordinator test:275-299 uses a mocked current draft; web lifecycle suite mocks writeFile; query-state test:114-160 protects the single optimistic registry. server WorkspaceFileSystem.test.ts:353-675 checks ordinary writes/path safety, not competing conditional writes; client projectCommands.test.ts:128-230 checks metadata sequencing in one registry. No native two-independent-client negative CAS test was found in these relevant suites. Avoid a source-string assertion or second implementation.

    Checks (exact head, not stale history): hosted CI 39369671055 SUCCESS for 3cfe94a; Lint, Build and Typecheck, Test Web, Test, Check and Test Server 1–8 SUCCESS. Active main ruleset #13856153 requires Test, Check, Mobile Native Static Analysis, Release Smoke, Test Server 1–3 and Rust; latter three context names completed SKIPPED at this SHA (not missing/failed). Branch protection API itself was 403, but the ruleset is readable. Green CI and mergeable_state=clean do not clear Julius's correctness HOLD. This connector performed tests NOT_RUN, browser/E2E NOT_RUN; maintainer's historical 30/30 and Linux run are reported, not rerun.

    Sequential handoff; ownership (no competing source lease):

    1. Julius / existing fix(web): retry failed final file saves after editor close pingdotgg/t3code#20738 maintainer ownership: decide accepted CAS semantics at the project-file write boundary; if Edit text files outside the workspace in the file panel pingdotgg/t3code#22956 is usable later, reconcile instead of treating its currently inaccessible reference as an approved implementation. For same defect only, require expected bytes/revision from the client read and a typed stale-write/conflict result across contract/RPC/handler; compare-and-write must share the server-side per-target critical section across clients. Merely checking client cache, or read-then-write outside a lock, is insufficient. Preserve the existing path/symlink safeguards.
    2. Same owner, after design: native two separate clients/registries against the same real server/file test: A fails final close write and queues a delayed retry; B successfully writes a newer value; A's old expected-version retry is rejected and B's bytes remain intact, with A's pending draft not falsely cleared. Also concurrent same-base write barrier: at most one succeeds. Target owner source/tests: packages/contracts/src/project.ts, packages/contracts/src/rpc.ts, apps/server/src/ws.ts, apps/server/src/workspace/WorkspaceFileSystem.ts and WorkspaceFileSystem.test.ts, packages/client-runtime/src/state/projectCommands.ts, apps/web/src/components/files/useFileSaveCoordinator.ts and relevant lifecycle tests. No separate PR by factory worker.
    3. OMP read-only/native verifier only: independently fetch exact head, run the commands below against the actual checkout, then re-check owner commit, review threads and ruleset-required CI before any HOLD→cleared receipt. Only owner/maintainer can confirm accepted semantics/review, no origin posts from this worker.
    git fetch https://github.com/kvnloo/t3code.git fix/web-file-save-close-retry-20261016
test "$(git rev-parse FETCH_HEAD)" = "3cfe94a3651e9d70645121c4fb2316258e0729e6" && git switch --detach FETCH_HEAD
vp test run apps/web/src/components/files/fileSaveCoordinator.test.ts apps/web/src/components/files/projectFilesQueryState.test.ts apps/web/src/components/files/useFileSaveCoordinator.browser.test.tsx apps/server/src/workspace/WorkspaceFileSystem.test.ts packages/client-runtime/src/state/projectCommands.test.ts
vp run --filter @t3tools/web typecheck
vp run --filter t3 typecheck
vp lint apps/web/src/components/files/fileSaveCoordinator.ts apps/web/src/components/files/useFileSaveCoordinator.ts apps/server/src/workspace/WorkspaceFileSystem.ts packages/client-runtime/src/state/projectCommands.ts

    After an owner CAS change, resolve its new full head SHA and rerun these exact relevant suites plus the newly added native two-client regression on that checkout. Current disposition: ORIGIN_LIVE / OWNER_TAKEOVER / HOLD, NOT CLEARED. Source/PR/default branch writes: none. Origin writes: none. Only this downstream queue comment.

  13. kvnloo commented on Oct 23, 2026

    @kvnloo
    kvnloo
    on Oct 23, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    FAC5-T3-CAS-REVIEW-01

    goal_lock: One read-only/source-only review of origin #20738 at exact kvnloo/t3code:fix/web-file-save-close-retry-20261016@3cfe94a3651e9d70645121c4fb2316258e0729e6, compared with the adjacent #22956 reference. Objective: determine whether client A's delayed disposed-editor retry can overwrite client B's newer file, locate the server-side conditional-write seam, and specify the native negative proof for the existing owner. Control: origin main@c8c9ccf916d53c80e4272b7e925c8c34db218874 (independently resolved this wave); pingdotgg#20738's recorded PR base is b1167b6ca20c19790694ca3552429b8868865285, not the live main tip. No source edits, new branch, PR, tests, CI, upstream comment, merge, or competing Julius/mobile #40/Tern work. Successful result here is a HOLD handoff, not a CAS fix or runtime pass.

    Disposition / review-first evidence: pingdotgg#20738 remains OPEN, non-draft, unmerged at 3cfe94a (four commits; only three web files changed). Hosted run 39369671055 is SUCCESS on precisely that source SHA; no inference of correctness from green CI. Julius's maintainer takeover and native 30/30 + isolated Linux save recovery, with explicit two-client HOLD are reported owner evidence, not tests run here. Review threads re-fetched: Macroscope stale-retry finding unresolved/outdated; CodeRabbit bounded retries resolved/outdated; CodeRabbit cross-client data integrity unresolved/current. No human approval/re-review clearing Julius's HOLD was found.

    Source-backed lost-update path (possible, not physically replayed here):

    1. useFileSaveCoordinator.ts:84-98 checks that runtime's own unsaved optimistic draft for matching text, then submits writeFile({cwd,relativePath,contents}). fileSaveCoordinator.ts:58-103 retries disposed flush failures with bounded backoff; onConfirmed is after persist. projectCommands.ts:203-218 serializes by environment/path within one runtime, not across separate client registries.
    2. ProjectWriteFileInput: project.ts:489-499 has only cwd/path/contents; the read result project.ts:423-428 supplies contents, size and truncated flag, no authoritative revision. RPC rpc.ts:1216-1220 has no typed conflict outcome.
    3. ws.ts:2623-2633 passes through to WorkspaceFileSystem.writeFile:467-509, which resolves a safe target and writes using NodeFSP.writeFile O_TRUNC without comparing any expected source or coupling validation with mutation. Hence A can still see its unchanged draft while B (different runtime) saves newer contents; A's delayed old write can truncate B's file. A post-write confirmation guard cannot undo it. Current origin main@c8c9ccf still has only cwd/path/contents and the same unconditional O_TRUNC write. This is a source-valid potential overwrite, not a claimed reproduced loss.
    4. The existing coordinator guard test mocks one current draft; server workspace tests test ordinary/path-safe writes, not two independent clients with a stale expected revision.

    pingdotgg#22956 is adjacent, not an adopted solution: Steve's comment describes a proposal for refusing edits when a file changed after reading, with workspace autosave coverage still an open question. Connector reads of both /issues/22956 and /pulls/22956 returned 404 this wave. Therefore its full contents, approval, implementation, or disposition are unverified; do not infer closure/merge, reimplement a second design, or replace pingdotgg#20738's owner.

    Atomic seam for the original owner (not an implementation instruction to this worker): preserve workspace/path/symlink and permission checks; expose an authoritative read-time expected-content fingerprint or revision token (including an absent-file sentinel and truncated-read policy), carry it through ProjectWriteFileInput → WsProjectsWriteFileRpc → ws.ts → WorkspaceFileSystem.writeFile; return a typed stale/conflict error without changing bytes or falsely confirming/clearing the pending draft. The compare and filesystem mutation must execute in one server-controlled critical section keyed by the same resolved target across all clients, not a separate read followed by O_TRUNC or a client-only generation check. The owner must decide how to handle external writers, multiple server processes, same-content ABA and safe truncation before claiming broader atomicity.

    Owner's two-client negative regression / adoption gate: in the existing server RPC/native harness, make two genuinely separate client sessions/registries against one real server and temp file, both obtaining the initial authoritative revision. A edits then its final close flush fails, queues a delayed retry; B writes newer bytes successfully; release A's timer and assert typed conflict, file remains exactly B's bytes, A remains pending and no false confirmation. Add a barriered same-base concurrent write case: exactly one accepted and one rejected, with preserved winning bytes. A fake single getUnsavedProjectFileQueryData cache/test or synthetic source-grep is insufficient. Target ownership: Julius / existing pingdotgg#20738 maintainer for contract/RPC/service + apps/server/src/workspace/WorkspaceFileSystem.test.ts and appropriate apps/server/src/ws.test.ts; existing web/client owners only for propagating expected token, conflict handling and focused tests. Reconcile pingdotgg#22956 only if independently accessible/accepted. Native qualifier/OMP verifies after an owner-authored head; this worker has no source lease.

    Commands for OMP — NOT RUN here (existing-head baseline; requires source checkout and dependencies):

    git fetch https://github.com/kvnloo/t3code.git fix/web-file-save-close-retry-20261016
test "$(git rev-parse FETCH_HEAD)" = "3cfe94a3651e9d70645121c4fb2316258e0729e6" && git switch --detach FETCH_HEAD
vp test run apps/server/src/workspace/WorkspaceFileSystem.test.ts apps/server/src/ws.test.ts apps/web/src/components/files/fileSaveCoordinator.test.ts apps/web/src/components/files/useFileSaveCoordinator.browser.test.tsx packages/client-runtime/src/state/projectCommands.test.ts
vp run --filter t3 typecheck
vp run --filter @t3tools/web typecheck

    After the original owner adds a real rejects stale two-client file writes RPC test and pins a new full head SHA, run vp test run apps/server/src/ws.test.ts -t "rejects stale two-client file writes" on that new exact checkout (this named test does not yet exist), plus the service/web suites above; then refresh PR reviews and hosted required checks before any HOLD change.

    What changed this wave: only this one downstream queue comment. PR URL #20738; observed branch/head above, no new branch/head; code edits/tests/CI/native/browser/origin writes: none. Final: ORIGIN_LIVE / OWNER_TAKEOVER / HOLD; not ready. Credit retained for Muse Spark's original downstream #33, GPT-6 port, Julius's native investigation, and original Macroscope/CodeRabbit review.

  14. kvnloo commented on Oct 23, 2026

    @kvnloo
    kvnloo
    on Oct 23, 2026
    OwnerAuthor

    FactoryScale exact-head native adjudication — HOLD_CROSS_CLIENT_CAS

    Exact candidate: 3cfe94a3651e9d70645121c4fb2316258e0729e6; live origin pingdotgg#20738 still has this head, OPEN/non-draft. The missing focused native suite has now actually executed: 61 PASS / 0 FAIL, five files, exit 0. This is not a CAS acceptance or a source repair.

    Execution: Boat fleet 20261023-180111-d320f219, Ubuntu amd64 / fresh public Git checkout, pinned Node 24.21.0 / pnpm 11.10.0 / Vitest 5.0.1, requested4G/4CPU; overall92.299s, tests9.54s. VM deleted after fetching evidence. Dependencies used the existing frozen lock and --package-import-method=copy, 26/33 workspace projects. Initial bootstrap attempt ...b94fd36f failed before test collection because requesting distro npm conflicted with image packages; corrected verifier uses the existing Node/npm to provision the pinned toolchain. No source/manifest/lock changes or assertion suppression.

    Actual command from the immutable checkout:

    pnpm exec vp test run --maxWorkers=1 \
  apps/web/src/components/files/fileSaveCoordinator.test.ts \
  apps/web/src/components/files/projectFilesQueryState.test.ts \
  apps/server/src/workspace/WorkspaceFileSystem.test.ts \
  packages/client-runtime/src/state/projectCommands.test.ts

    Observed collection (the query-state selector also matched its TSX suite):

    • WorkspaceFileSystem.test.ts: 23 passed.
    • projectFilesQueryState.test.tsx: 14 passed.
    • fileSaveCoordinator.test.ts: 16 passed.
    • projectCommands.test.ts: 4 passed.
    • projectFilesQueryState.test.ts: 4 passed.

    CAS scope remains a real blocker, independently re-read at this exact SHA: ProjectWriteFileInput still accepts only cwd, relativePath, contents; it has no expected content/revision or conflict result. WorkspaceFileSystem.writeFile still calls NodeFSP.writeFile with O_TRUNC, not atomic expected-check-and-write across clients. The existing reviewer finding is against the same head and remains applicable. Current tests passing cannot establish a behavior the contract does not expose.

    Disposition: HOLD_CROSS_CLIENT_CAS / OWNER_TAKEOVER, native-suite gate passed but requirement not cleared. Browser lifecycle/E2E and two-independent-client real-server delayed-retry/concurrent-write negative controls were NOT_RUN/NOT_PROVED; no full typecheck/lint or new hosted-CI certification claimed. Maintainer Julius's ownership/acceptance remains required. Next gate belongs to the existing owner: accepted conditional-write semantics at the shared server target boundary, then two independent clients where B's newer bytes survive A's stale delayed retry, plus simultaneous same-base writes allowing at most one success. Do not create a competing source branch/PR or count single-client optimistic-cache tests as that proof.

    Evidence: /tmp/factory-native-t3/evidence/t3code.json; operator log /home/kvn/.local/state/fleet/runs/20261023-180111-d320f219-boat.log (61/61, FAC4_T3_FOCUSED_EXIT=0, VM deletion). Prior source/review qualification retains its other boundaries. Original Muse Spark/GPT-6 port, Julius investigation and reviewer credit preserved. No origin posts, source fixes, live client/service/memory changes, merge or upstream publication.

  15. kvnloo commented on Oct 23, 2026

    @kvnloo
    kvnloo
    on Oct 23, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    FAC5-T3-ATOMIC-SEAM-01

    goal_lock: One read-only, source-only OS/filesystem atomicity follow-on for kvnloo/t3code:fix/web-file-save-close-retry-20261016@3cfe94a3651e9d70645121c4fb2316258e0729e6 (existing origin #20738). The prior server-contract/CAS inventory owns RPC/schema/client coverage; this is not a second CAS report or implementation proposal. Determine whether an existing lock/transaction protects expected-revision validation + actual filesystem replacement across independent clients; hand the original maintainer precise OS-race acceptance controls. Success of this wave is a path-backed limitation/negative schedule, not runtime proof, author acceptance or a code change. Disposition: HOLD_CROSS_CLIENT_CAS / OWNER_TAKEOVER, unchanged.

    Evidence boundary: Re-fetched origin #20738: OPEN/non-draft, head 3cfe94a3651e9d70645121c4fb2316258e0729e6, three changed web files; Julius's two-client HOLD and current cross-client review thread remain unresolved (the prior single-runtime thread is outdated/unresolved; retry-backoff thread resolved). The 61/61 focused native receipt is a separate operator's actual run, not executed or extended here; it does not exercise conditional filesystem replacement. This review performed only connector source/review reads. Tests, browser, independent server processes, OS-race injection: NOT RUN.

    Filesystem/lock seam, exact target SHA

    1. Write path has no coupled check/commit. ws.ts:2623-2633 directly dispatches projectsWriteFile to the workspace service. WorkspaceFileSystem.ts:467-509 performs knownWorkspaces.assertContains, resolveWriteTarget, recursive makeDirectory, then NodeFSP.writeFile with O_CREAT | O_TRUNC | (O_NOFOLLOW ?? 0), then index refresh. There is neither a target lock nor a revision validation at the write operation. O_TRUNC is an unconditional in-place write, not an atomic compare-and-replace or old/new-byte visibility guarantee. WorkspaceFileSystem.ts:287-365 opens/stats/reads a file but has no lock/snapshot generation attached to the bytes. The event-sourced database transaction described in AGENTS.md does not wrap this direct OS write.
    2. Available in-process locks are not wired to this path. workspaceLease.ts:4-21 is an Effect semaphore in a module-level Map keyed by the input cwd string; it is neither imported nor applied in the workspace file write/WS handler. Even if reused, aliases of the same physical target can have different cwd strings and separate Node processes have separate maps. KeyedLock.ts:16-48 offers correct per-key serialization within its own Effect instance, but is likewise not used by projectsWriteFile, and is neither a cross-process lock nor a filesystem transaction. A cross-process proper-lockfile pattern exists for ChatGPT credential rotation, not project-file CAS; adopting that mechanism would require distinct file identity, failure and multi-process guarantees.
    3. Atomic rename helper is not a conditional replace. atomicWrite.ts:24-92 stages bytes in a temp directory under the target parent, then unconditionally fs.rename(tempPath, targetPath) (POSIX), or bounded Windows retry. That can provide atomic name/old-vs-new visibility on a successful same-filesystem rename, not expected-version CAS or crash durability. Its Windows retry checks an ino:size:mtime stat fingerprint only after a failed first rename, and can race the subsequent rename; it is not a reliable ABA/revision token. atomicWrite.test.ts:180-215 proves a specific Windows locked-rename retry refuses one intervening save, not two-client CAS. This helper is used for settings (e.g. serverSettings.ts:597-613), not the workspace writer. Its symlink.ts:16-49 resolves final symlinks to preserve the link, but resolution and later rename are distinct syscalls.
    4. Path safety has TOCTOU limits, which adoption must preserve or strengthen. WorkspaceFileSystem.ts:383-465 realpaths the root/deepest existing ancestor, checks both named and resolved paths for escaping and Git metadata, and rejects dangling links. Existing WorkspaceFileSystem.test.ts:461-566 exercises outside-root rejection and allowed in-root symlink aliases; WorkspaceFileSystem.test.ts:625-675 protects Git metadata. Yet realpath/lstat/Git checks, mkdir, final open(O_TRUNC) and any future rename are separate: swapping an ancestor symlink or renaming a directory between them can redirect a pathname. O_NOFOLLOW on supported systems guards only the final component at open, and this code explicitly has no O_NOFOLLOW on Windows. A final-path string check is not equivalent to pinning/checking the parent directory identity at replacement time.

    Owner adoption contract (decisions, not edits)

    • Guarantee scope first: State whether the guarantee covers all independent T3 UI clients on one server, multiple T3 server processes sharing a tree, or uncooperative external editors/agents. A single-server lock can serialize cooperating RPCs, not external file writes. POSIX rename is unconditional; a read/check followed by rename under an in-memory lock is not a universal filesystem CAS against nonparticipants. Never claim the broader guarantee from the narrower proof.
    • Critical section and identity: For T3-cooperating writers, take one server-owned lock by canonical directory-entry identity (actual resolved parent + basename, with root/alias normalization), before validating current revision; hold through replace and commit accounting. Do not lock by client registry, raw cwd, filename supplied by a client, or only inode (rename changes inode and absent files have none). Resolve allowed in-root symlink aliases to the same physical target; choose/document hardlink behavior. If multiple server processes can write the same workspace, an in-memory Effect semaphore alone is insufficient.
    • Revision semantics: Obtain the expected token from a coherent read of the same file/snapshot (file may be absent), and atomically evaluate it with the write from the perspective of all participating writers. A content digest alone permits ABA (v0 → v1 → identical v0); ino:size:mtime likewise is not a safe monotonic generation (timestamp resolution, inode reuse, rename, unchanged-size writes). If strict intervening-write detection is required, owner needs a reliably advanced generation maintained by every participating writer, including delete/recreate; if not, explicitly document the weaker expected-current-bytes contract. Treat truncated/partial reads as unqualified for overwriting.
    • Path/replace invariants: Revalidate or anchor parent/target identity at the actual mutation boundary; reject an escaped/symlink-swapped/Git-metadata target with no outside write. Preserve existing in-root symlink behavior and reject dangling/out-of-root links; handle Windows reparse/rename sharing distinctly. If staging/renaming, temp must share the destination filesystem and commit must be inside the serialization boundary; stage cleanup and file/parent-directory sync for crash durability are separate guarantees, not proven by rename alone. Typed stale conflict must leave winner bytes intact, without false save acknowledgement or clearing the pending draft.

    Deterministic negative schedules for Julius / existing pingdotgg#20738 ownership

    Use the real workspace writer + one server with two genuinely separate WS sessions/client registries and disposable temp workspace; inject Deferred/barrier hooks at defined boundaries (per AGENTS.md, no sleeps/polling). On an owner-authored new head, require:

    1. Retired A vs newer B: Both read same initial revision R0. A's final close flush fails before touching disk, and its retired coordinator queues retry with expected R0. B commits R0→R1/newer bytes. Release A's delayed retry. Assert conflict/no write, exact bytes B, and A's pending draft unconfirmed; then fresh read yields R1. This is the existing HOLD's mandatory two-client regression.
    2. Same-base compare/replace interleaving: A and B read R0; release their start barrier together. Instrument after A validates R0 but before its OS mutation; B has issued its request while A is paused. With the lock held, B must not commit; release A: exactly one R0 write succeeds, the other reports conflict, disk bytes equal the winner. Also reverse A/B order. Do not set a barrier that requires B to enter a lock A holds (deadlock); observe B's submitted request outside the critical section.
    3. Absent-file + ABA: Two clients both expect MISSING; exactly one create succeeds. Independently, A reads R0, B commits different R1 and then content identical to old R0 as R2; A's R0 token must fail if strict intervening-write semantics were chosen. A hash-only contract cannot pass that ABA assertion and must remain explicitly limited.
    4. Alias and path swap: Have A address an allowed in-root symlink alias while B uses canonical target path; serialize as one identity, one success. Pause after the last path-escape/Git validation and before open/rename, swap an intermediate directory for an out-of-root link (and separately rename the ancestor); outside sentinel and Git metadata must remain unchanged and the write must reject. Assert the original in-root link remains a link after successful writing. Run analogous Windows reparse-path coverage where supported; POSIX-only O_NOFOLLOW is not Windows evidence.
    5. External replace + Windows retry: Pause A between validated revision and attempted rename; have an independent writer/process rename a new target into place (or write in place); then release A. If cross-process/external writes are in scope, new bytes must survive and A must conflict, including a Windows EBUSY/EPERM retry window. Otherwise record this as an explicit unsupported guarantee, not a PASS. Also exercise retry after a same-size/same-mtime or delete/recreate (inode reuse) ABA candidate to expose stat-fingerprint limits. No helper-level mocked rename test substitutes for one real target and real clients.

    File ownership / next smallest actions: Julius, as current origin #20738 maintainer, decides exact guarantee and lock/replace ownership in apps/server/src/workspace/WorkspaceFileSystem.ts and WorkspaceFileSystem.test.ts; only then adjust existing packages/shared/src/atomicWrite.ts (if intentionally reused), service/WS test seam, and existing read/expected-revision contracts with their owning web/client contributors. OMP owns only native verification of the newly pinned owner head and review/CI recheck. Keep pingdotgg#22956 as an adjacent unverified proposal; do not fork or race owner code.

    Commands for OMP (NOT RUN in this audit):

    git fetch https://github.com/kvnloo/t3code.git fix/web-file-save-close-retry-20261016
test "$(git rev-parse FETCH_HEAD)" = "3cfe94a3651e9d70645121c4fb2316258e0729e6" && git switch --detach FETCH_HEAD
vp test run apps/server/src/workspace/WorkspaceFileSystem.test.ts packages/shared/src/KeyedLock.test.ts packages/shared/src/atomicWrite.test.ts
vp test run apps/server/src/ws.test.ts

    These existing-head commands are baseline only, not missing negative proofs. When owner supplies an actual new full head SHA and named tests for schedules 1–5, checkout that exact SHA, run those focused server/WS/native tests and vp run check:changed, then refresh required hosted CI/review before reconsidering HOLD.

    Writes/results: No implementation, no branch/PR, no new SHA, no tests or execution, no upstream messages, no merge/default-branch activity. Only this single #42 source-backed filesystem atomicity handoff. Preserve Muse Spark's original fork #33, GPT-6 port, Julius's investigation and Macroscope/CodeRabbit reviewer provenance.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions