Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
1512246 to
41f5ab3
Compare
41f5ab3 to
04977de
Compare
|
@codex review Please review current head Generated with |
|
Codex Review: Didn't find any major issues. Another round soon, please! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
04977de to
2f180b0
Compare
|
@codex review Please review current head Generated with |
|
Codex Review: Didn't find any major issues. Keep them coming! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
2f180b0 to
7235c68
Compare
|
@codex review Please review current head Generated with |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7235c68bc0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
7235c68 to
a54cba5
Compare
|
Addressed PRRT_kwDOPxxmWM6hM7oo (finding) in The foreign row still lands after the first owned prefix and before the failing write. Exact call order and persisted sequence assertions prove interleaving; rollback must preserve that row and start no provider. All 11 isolated middle tests and 15 integrated runtime tests pass, as do canonical static checks. No production change was needed for this finding. Generated with |
|
@codex review Please review current head Generated with |
|
Codex Review: Didn't find any major issues. Chef's kiss. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
a54cba5 to
2c8c781
Compare
|
@codex review Please review current head Generated with |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2c8c7818a6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
ab882a4 to
1ce1db1
Compare
|
@codex review Please review updated head Final integrated validation passes on #4191 All eight members remain held until current-head review approval and required CI are complete. Generated with |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
Codex Review: Didn't find any major issues. You're on a roll. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
1ce1db1 to
ea3af70
Compare
|
@codex review Please review head Final integrated validation: #4191 The full eight-member phase remains held until every current head has reviewer approval and passing CI. Generated with |
|
Codex Review: Didn't find any major issues. Chef's kiss. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
ea3af70 to
e1120e5
Compare
|
@codex review Please review head Final integrated validation: #4191 The full eight-member phase remains held until every current head has reviewer approval and passing CI. Generated with |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
Codex Review: Didn't find any major issues. Nice work! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Signed-off-by: Thomas Kosiewski <tk@coder.com> --- _Generated with `xum` • Model: `unavailable` • Thinking: `unavailable` • Cost: `$unavailable`_ <!-- mux-attribution: model=unavailable thinking=unavailable costs=unavailable -->
e1120e5 to
6a000b0
Compare
|
@codex review Please review head Integrated validation on #4191 All eight PRs in the cancellation phase will merge together after every member has current-head approval and passing CI. Generated with |
|
Codex Review: Didn't find any major issues. More of your lovely PRs please. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
Adds a raw JSONL reader that streams large strings, keys and numbers without assembling a whole row. This is the inactive parsing prerequisite for the oversized-history witness finding in coder#4182; the runtime integration in coder#4182 consumes it through coder#4221. The reader reports byte ranges, content digests, JSON/UTF-8 validity and duplicate decoded keys. Consumers receive provisional tokens, optional isolated raw chunks, and awaited row completion. Explicit replacement decoding supports legacy identity accounting while keeping strict raw validity separate. Abort, early exit and visitor errors close the file and parser. Uses pinned stream-json 3.6.0 with scalar packing disabled. Retained memory depends on the read chunk plus nesting and object-key bookkeeping; this is not an absolute constant-memory guarantee for arbitrarily deep or wide objects. Callers must bound their own retention and revalidate file stamps before treating descriptors as evidence. Validation: 58 tests / 266 assertions, including 12 MiB scalar fixtures, one-byte reads, malformed UTF-8/JSON, split escapes, duplicate keys, LF/EOF framing, backpressure and cleanup. A bundled Node 22 smoke run passed 17 checks; four additional abort-guard checks passed after fixing cancellation from beginRow; canonical make static-check passed. Deterministic held-open and held-stat tests on an empty file verify exact abort reasons and file-handle closure after awaited setup. Runtime compatibility was checked against the repository's Node 22 Docker runtime. No provider calls. The Nix offline dependency-cache hash is updated to the value computed by CI for the added streaming parser dependency. A prior Flake Hash Check confirmed the generated value. Local Nix is unavailable. Risk: the new dependency and streaming-token contract need careful review before activation. Raw callbacks receive copies bounded by the read chunk, so mutation of the full backing buffer cannot corrupt parsed tokens, digests or later buffered rows. Cancellation remains observable after awaited visitor completion and asynchronous parser/file disposal. Nine adversarial regressions failed before these fixes and now pass; an additional bundled Node 22 run passed 16 mutation and late-cancellation checks. Canonical static checks passed on the final scanner fix. The scanner cleanup test now observes only the file handle opened for its own fixture, so unrelated concurrent opens cannot replace the handle under assertion. Closure remains required; scanner production is unchanged. Integrated validation on coder#4191 `87badaf62f925e118c2292cf3e788fc92894dafc` and coder#4209 `d83e1cb55f50676562e675398f76e0b5118053ab` above main `0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`: six affected suites passed on each integrated tree: A 549 tests / 3,337 assertions and B 602 tests / 3,649 assertions; full TypeScript and canonical static checks passed on both. The rebased A/B trees exactly match those validated trees. This stack integrates main `0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`, including coder#4225’s workspace-fork recovery fix. Each layer retains its previously reviewed diff and all addressed review fixes. The complete cancellation phase is ordered coder#4214 → coder#4215 → coder#4219 → coder#4221 → coder#4182 → coder#4187 → coder#4191 → coder#4209. The reader prerequisites and runtime changes merge together only after every member has current-head approval and green CI. --- _Generated with `xum` • Model: `unavailable` • Thinking: `unavailable` • Cost: `$unavailable`_ <!-- mux-attribution: model=unavailable thinking=unavailable costs=unavailable -->
Adds bounded scalar facts and canonical JSON evidence above coder#4214's raw token reader. This is an inactive prerequisite for the oversized-history witness fix in coder#4182; it does not decide message readability or grant cancellation authority. Strings retain a bounded prefix, length, digest and optional exact-match result. Numbers retain up to 2,048 significant digits plus exponent/position and a nonzero-tail flag, then delegate rounding to native Number. The retained prefix exceeds every finite binary64 rounding boundary's decimal expansion; a discarded nonzero tail preserves the side of that boundary. Canonical evidence accounts for escaping, split surrogate pairs, integer-property ordering, duplicates, raw digest/length and caller-reported normalization changes. Validation: reader/scalar tests previously passed 91 cases with 4,712 assertions; the final reader/scalar/projection combination passes 109 tests / 7,339 assertions. A Node 22 native oracle passes 4,704 checks, including midpoint/subnormal/overflow edges, huge exponent cancellation, 2,000 generated numbers and an 8 MiB canonical row. Both owned layers passed canonical static checks and independent review before composition; production scalar code remained unchanged during final test lint fixes. Risk: incorrect number or canonical equivalence could misclassify later history evidence, so this module stays inactive until the history-specific adapter is reviewed. Retention is bounded for scalars; nesting/key bookkeeping follows the raw reader's documented limits. No new persistence format or schema interpreter. The numeric proof comment names SIGNIFICANT_DIGITS so its retention bound cannot drift from the implementation. This review correction changes no behavior. Two fork/send integration assertions retain their success requirement while exposing the returned error when a request fails. Scalar-reader production is unchanged. Integrated validation on coder#4191 `87badaf62f925e118c2292cf3e788fc92894dafc` and coder#4209 `d83e1cb55f50676562e675398f76e0b5118053ab` above main `0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`: six affected suites passed on each integrated tree: A 549 tests / 3,337 assertions and B 602 tests / 3,649 assertions; full TypeScript and canonical static checks passed on both. The rebased A/B trees exactly match those validated trees. This stack integrates main `0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`, including coder#4225’s workspace-fork recovery fix. Each layer retains its previously reviewed diff and all addressed review fixes. The complete cancellation phase is ordered coder#4214 → coder#4215 → coder#4219 → coder#4221 → coder#4182 → coder#4187 → coder#4191 → coder#4209. The reader prerequisites and runtime changes merge together only after every member has current-head approval and green CI. --- _Generated with `xum` • Model: `unavailable` • Thinking: `unavailable` • Cost: `$unavailable`_ <!-- mux-attribution: model=unavailable thinking=unavailable costs=unavailable -->
…r#4219) Adds streamed message-readability evidence above the scalar reader in coder#4215. Oversized history rows need the same identity and readability decisions as ordinary JSON.parse rows without retaining entire message payloads. This prerequisite provides those facts; the separate row adapter and coder#4182 integration will consume them. The projection checks every part and workflow element against the existing schema fragments, including constrained strings, finite numbers, strict objects, array limits and ordered workflow events. It preserves legacy role coercion, duplicate-key behavior and normalization detection. Scalar retention is bounded; nesting and distinct object-key bookkeeping retain the raw reader's documented limits. There is no persistence change or replacement authority decision in this layer. Legacy array-coerced system roles remain readable collision evidence but are classified as system rows, matching the native reader. The system-role classification is gated by successful readability so malformed role objects are not coerced. Integrated validation on coder#4191 `87badaf62f925e118c2292cf3e788fc92894dafc` and coder#4209 `d83e1cb55f50676562e675398f76e0b5118053ab` above main `0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`: six affected suites passed on each integrated tree: A 549 tests / 3,337 assertions and B 602 tests / 3,649 assertions; full TypeScript and canonical static checks passed on both. The rebased A/B trees exactly match those validated trees. Risk: projection drift from the ordinary reader could change which historical messages count as readable. The implementation deliberately uses the current schema fragments and native-comparison tests; activation stays in the separately reviewed adapter/integration change. This stack integrates main `0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`, including coder#4225’s workspace-fork recovery fix. Each layer retains its previously reviewed diff and all addressed review fixes. This is one layer of the cancellation phase: coder#4214 → coder#4215 → coder#4219 → coder#4221 → coder#4182 → coder#4187 → coder#4191 → coder#4209. All eight PRs merge together after every member has current-head approval and passing CI. --- _Generated with `xum` • Model: `unavailable` • Thinking: `unavailable` • Cost: `$unavailable`_ <!-- mux-attribution: model=unavailable thinking=unavailable costs=unavailable -->
…r#4221) Adds the history-specific row adapter above coder#4219. It preserves ordinary-row parsing and legacy normalization, derives oversized-row identity without assembling whole payloads, and compares replay candidates using exact bounded byte ranges. The owning coder#4182 integration will use this adapter to finish the oversized-row review finding. Both existing reset protections remain in force through shared scanner helpers: raw reset markers, including control-separated keys, and the reverse token recognizer. Protected or invalid-UTF-8 readable rows still count for identity collisions, but cannot grant replacement authority. Digests reject mismatches cheaply; matching digests still require exact byte comparison and rechecking the captured content digest. LF termination is excluded from replay equality. Callers retain responsibility for file provenance and publication-lock validation. Small and oversized legacy array-coerced system rows retain collision identities but cannot qualify as replacement candidates. User and assistant role coercion remains supported; the small-row classification agrees with the streamed projection. Token scanning, captured size, and follow-up range reads now share the same open file handle. A path replacement cannot mix the new inode’s token evidence with the old inode’s bytes or size. The borrowed-handle helper retains the caller’s ownership and captured range; existing stamp and publication-lock checks remain required for in-place writes. Integrated validation on coder#4191 `87badaf62f925e118c2292cf3e788fc92894dafc` and coder#4209 `d83e1cb55f50676562e675398f76e0b5118053ab` above main `0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`: six affected suites passed on each integrated tree: A 549 tests / 3,337 assertions and B 602 tests / 3,649 assertions; full TypeScript and canonical static checks passed on both. The rebased A/B trees exactly match those validated trees. Risk: classification or reset-probe drift could admit ambiguous history. Native-reader comparisons and existing provider privacy suites exercise those contracts. This layer remains inactive until coder#4182 is integrated and reviewed; it introduces no new persisted state or scan budget for lifetime history proofs. This stack integrates main `0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`, including coder#4225’s workspace-fork recovery fix. Each layer retains its previously reviewed diff and all addressed review fixes. This is one layer of the cancellation phase: coder#4214 → coder#4215 → coder#4219 → coder#4221 → coder#4182 → coder#4187 → coder#4191 → coder#4209. All eight PRs merge together after every member has current-head approval and passing CI. --- _Generated with `xum` • Model: `unavailable` • Thinking: `unavailable` • Cost: `$unavailable`_ <!-- mux-attribution: model=unavailable thinking=unavailable costs=unavailable -->
…oder#4182) Retained Stop needs durable proof that a replacement was accepted before canceled recovery can be released. This layer adds guarded append, batch, and Resume publication, with receipts captured at the history commit point and witnesses verified across active history and archives. Runtime activation follows in coder#4191/coder#4209. Acceptance rechecks the captured cancellation nonce, journal generation, physical lock, and logical ownership. Visible bytes are distinguished from durable receipts, including file and directory flush failures. Preserve-mode publication grants no replacement authority. Request-entry capture and explicit malformed/unsupported-record repair share the existing history lock so repair cannot adopt an intervening Stop. A committed context reset can report its exact predecessor and successor generation through an in-memory receipt; advancing the generation or exposing bytes alone grants no queue-refresh authority. Stop retirement similarly reports the exact predecessor and cleared successor only after verified deletion under that same lock, retaining the receipt obligation through failed-unlink retries. Resume preserves the original row, signatures, and metadata. It accepts the exact typed target or its exact wire projection. Retrying an already stamped Resume can reuse byte-identical archive replay copies for its captured nonce; duplicate active rows or changes to identity, sequence, nonce, formatting, provenance, or generation still refuse authority. Ordinary unstamped Resume retains its existing checks. A consumed nonce cannot accept another replacement before retirement; the exact stamped Resume replay is the only reuse exception. Publication metadata is written back only to the original snapshotted message references, so caller array changes cannot interrupt the durable receipt. Witness traversal uses coder#4221's bounded row adapter. Protected and invalid-UTF-8 rows still occupy identities; fingerprints can only conservatively reject collisions, while replay authority requires exact byte ranges. Ordinary append sequence allocation still has its existing large archive-tail read; this PR does not claim the entire append path has bounded memory. A throwing retirement observer is logged after the state receipt and cannot skip directory durability or recreate deletion debt. Superseding a local retirement aborts that attempt’s provisional history scan and exact replay comparison through their existing cancellation signal; scanner handles are disposed before the queued Stop publishes. Current verification errors still propagate. Legacy array-coerced system rows cannot be stamped or used as replacement witnesses, while readable user and assistant compatibility remains unchanged. Under-lock witness verification now returns superseded only when its original attempt lost ownership; current verification errors still propagate. Every eligible occurrence of a nonce must prove the same exact receipt, so conflicting eligible identities anywhere in active or archived history refuse retirement. Ineligible legacy system stamps cannot consume replacement authority, while still occupying their ID and sequence for collision checks. Separately deserialized legacy user/assistant roles retain an accepted Resume receipt through a later history update. Comparison uses the existing role coercion; changed roles cannot inherit the receipt, and system/invalid rows remain ineligible witnesses. Validation includes real-file crash replay, foreign-writer/CAS races, malformed-record recovery, and deterministic file/directory durability failures. Integrated validation on coder#4191 `87badaf62f925e118c2292cf3e788fc92894dafc` and coder#4209 `d83e1cb55f50676562e675398f76e0b5118053ab` above main `0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`: six affected suites passed on each integrated tree: A 549 tests / 3,337 assertions and B 602 tests / 3,649 assertions; full TypeScript and canonical static checks passed on both. The rebased A/B trees exactly match those validated trees. Risk: conservative refusal can delay recovery when ownership or history evidence is ambiguous; flush latency affects publication. Tests retain exact history-byte and foreign-writer assertions. This stack integrates main `0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`, including coder#4225’s workspace-fork recovery fix. Each layer retains its previously reviewed diff and all addressed review fixes. This is one layer of the cancellation phase: coder#4214 → coder#4215 → coder#4219 → coder#4221 → coder#4182 → coder#4187 → coder#4191 → coder#4209. All eight PRs merge together after every member has current-head approval and passing CI. --- _Generated with `xum` • Model: `unavailable` • Thinking: `unavailable` • Cost: `$unavailable`_ <!-- mux-attribution: model=unavailable thinking=unavailable costs=unavailable -->
…coder#4191) Activates durable compaction cancellation across Stop, manual send/edit/Resume, queued input, and automatic recovery. Failed preparation preserves cancellation; a durably accepted replacement may release it. This V1 layer defers unresolved automatic recovery; coder#4209 adds settlement proof for eligible fresh input. Automatic prefixes wait for their trigger and publish through the existing captured-frontier history transaction. Comparing the original persisted Stop and appending the batch under one write lock prevents another backend’s Stop or Clear from leaving stale automatic rows durable. Ordinary automatic input preserves cancellation and its existing rollback ownership. Requests capture the persisted Stop frontier before pricing/settings preflight and retain it through preparation and queued dispatch. Publication must match that original nonce/generation, so an older request cannot adopt another backend's later Stop. Exact Send Now admission carries its initiating Stop receipt; manual malformed-record recovery remains a single operation. Context-budget continuations retain their originating capture, and committed local resets and verified Stop retirement advance only queued or active captures matching the exact predecessor nonce and generation. This preserves legitimate queued input across rollover without adopting a foreign Stop. The recorded admission is checked again after request preparation and immediately before provider construction, including prepared requests. A refusal after stream construction aborts that captured provider before releasing its resources. Stop joins physical execution and terminal policy outside history locks. Legacy summary/partial follow-up metadata is neutralized before the Stop sidecar is published, and live compaction completion retains its original admission generation so it cannot republish stopped recovery. Failed initial cleanup preserves the predecessor and exact local retry debt; it does not claim a successful durable Stop. Authored follow-up request content remains intact. Full Clear runs the existing deletion transaction under the cancellation history lock, after workspace cleanup barriers and before sidecar publication. This preserves malformed-history Clear while removing downgrade-readable recovery. Uncertain deletion is not retried over later foreign input; a confirmed deletion receipt permits only sidecar retry and retains UI/monitor accounting if publication fails. Edit/truncation receipts follow directory durability. Reset heartbeats refuse scoped-summary cancellation debt while ordinary scoped-V1 automatic admission remains supported. Rejected manual input keeps preserve-mode receipts so committed rejection rows are not duplicated into the composer and uncommitted drafts can be restored. Outstanding scoped cleanup debt prevents automatic input from starting legacy token-pressure compaction or publishing a token-budget reset. Reset publication checks the persisted cancellation scope under the existing history write lock, including same-nonce narrowing by another backend, so restart recovery can still find the canceled summary. Manual replacement and ordinary automatic input without a reset remain supported. The original persisted nonce/generation is revalidated while holding the existing shared history lock through synchronous provider construction, registration, and supervision. Prepared requests use the final caller’s fence. Playback, envelope writes, and cleanup are outside the lock. Factory or fence failure retains exact registered-resource cleanup ownership; mock playback keeps its existing immediately awaited admission check. A caller whose exact witnessed Stop was already retired by a peer can receive the same verified absent-frontier transition. The original nonce/generation is copied before waiting and the existing durable witness is revalidated under the history lock. This advances only matching owned admission and does not accept an arbitrary missing sidecar or a newer generation. Validation covers two-backend preflight races, queue/Send Now admission, downgrade publication boundaries, late compaction completion, directory flush failures, and real budget rejection. Integrated validation on coder#4191 `df5972870696ef9b78c2854f8a4b9ddf3fd15769` and coder#4209 `86e3487151fde2273d8e7595504f3b87a2ea9d62`: 14 affected suites passed on each tree (A 1,271 tests / 6,521 assertions; B 1,352 tests / 7,006 assertions), with full TypeScript, canonical static, and final changed-file lint/format checks. Four deterministic peer Stop/Clear cases fail on the original A head and pass with the fence; unchanged-frontier controls pass. B production is unchanged. Risk: ownership mistakes can resume canceled work or strand valid input. Held preflight/cleanup and foreign-supersession controls exercise those boundaries directly. This stack integrates main `0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`, including coder#4225’s workspace-fork recovery fix. All prior review fixes remain; the shared automatic-publication fence belongs to coder#4191. This is one layer of the cancellation phase: coder#4214 → coder#4215 → coder#4219 → coder#4221 → coder#4182 → coder#4187 → coder#4191 → coder#4209. All eight PRs merge together after every member has current-head approval and passing CI. --- _Generated with `xum` • Model: `unavailable` • Thinking: `unavailable` • Cost: `$unavailable`_ <!-- mux-attribution: model=unavailable thinking=unavailable costs=unavailable -->
After ordinary Stop settles, fresh automatic monitor or family input can start a new turn without reopening the canceled continuation. This layer restores that behavior above coder#4191's V1 deferral using V2 settlement proof, building on its shared automatic-publication fence. V2 authority waits for the captured producer/startup work and exact outer cleanup, including monitor retirement, retries, descendants, and queued-input handling. A failed physical Stop returns promptly while supervised completion can observe that same producer finishing naturally. Supersession and disposal release only the owned wait; failed cleanup grants no V2 proof. Successful exact settlement wakes deferred monitor output once. Failed physical Stop also runs the remaining outer cleanup through its existing supervisor; unresolved monitor retirement does not hold workspace shutdown. Automatic sends retain their original persisted Stop frontier through service preflight and every queued addition. A payload admitted before another backend's Stop cannot adopt the new settled V2 on dequeue; fresh post-Stop input remains eligible. Existing scoped-V1 ordinary preserve-mode admission remains supported. Separate queued inputs remain eligible after their own accepted replacement resets history or retires Stop; only the exact committed transition advances their captures, and a later foreign Stop still blocks them. Both mid-stream compaction continuation paths retain the originating stream capture. Superseded retirement refuses automatic acceptance/startup while preserving the already committed input and budget accounting. Fresh reset summaries retain captured generation/provenance for immediate or restarted follow-up recovery. Legacy unmarked or stale evidence grants no permission, and only the actual accepted follow-up row can retire replacement cancellation. A transient recovery-frontier read failure preserves pending work for retry. Automatic batches preserve rollback accounting; durable trigger publication makes acceptance irrevocable before fallible observers. The legacy token-pressure guard prevents automatic compaction from bypassing scoped-V1 cleanup debt while preserving manual replacement. The inherited automatic-reset guard keeps canceled summaries reachable for recovery. Already-qualified settled V2 input retains its automatic-replacement exception, including token-budget rollover; unsupported scoped V2 records still refuse admission and remain byte-for-byte intact. Automatic replacement now requires settlement/version evidence from the original admission capture. A request captured during V1 cleanup cannot gain authority when the same nonce/generation later reaches V2. Mixed-version queued batches refuse in either order; fresh V2 input and ordinary scoped-V1 preserve behavior remain supported. Owned transitions replace or clear the in-memory version evidence. Review fixes keep original version evidence through active/queued capture advancement, refuse heartbeat reset admission during V1 cleanup, and revalidate version before narrowing a persisted Stop. The separate absent-Stop heartbeat race remains guarded by the existing journal-generation CAS. Validation includes real two-backend stale/fresh automatic sends, held startup/cleanup, cross-instance restart, failed I/O, exact notification ownership, and rejected-batch rollback with foreign history preserved. Integrated validation on coder#4191 `df5972870696ef9b78c2854f8a4b9ddf3fd15769` and coder#4209 `86e3487151fde2273d8e7595504f3b87a2ea9d62`: 14 affected suites passed on each tree (A 1,271 tests / 6,521 assertions; B 1,352 tests / 7,006 assertions), with full TypeScript, canonical static, and final changed-file lint/format checks. Four deterministic peer Stop/Clear cases fail on the original A head and pass with the fence; unchanged-frontier controls pass. B production is unchanged. Risk: incorrect settlement ownership can resume stopped work or strand legitimate wakes. The phase keeps failure, supersession, durability, and receipt checks separate. This stack integrates main `0d31680932fe5b2cb33ce33ec43cb576c86ee0e6`, including coder#4225’s workspace-fork recovery fix. All prior review fixes remain; the shared automatic-publication fence belongs to coder#4191. This is one layer of the cancellation phase: coder#4214 → coder#4215 → coder#4219 → coder#4221 → coder#4182 → coder#4187 → coder#4191 → coder#4209. All eight PRs merge together after every member has current-head approval and passing CI. --- _Generated with `xum` • Model: `unavailable` • Thinking: `unavailable` • Cost: `$unavailable`_ <!-- mux-attribution: model=unavailable thinking=unavailable costs=unavailable -->
1 participant
Centralizes prepared history publication so manual triggers and their prefixes use one publication boundary. Origin remains independent of visibility and billing, and later runtime layers consume durable receipts and rollback facts instead of interpreting a successful send as acceptance.
This preparation layer exposes #4182's guarded publication without activating cancellation policy; that activation belongs to #4191/#4209 in the same phase. Both Result errors and unexpectedly rejected publication promises reach the existing rollback checkpoints. Only the publication service promise is normalized: acceptance receipts and subsequent callback failures retain their distinct semantics.
Real HistoryService tests inject both failure forms after each prepared prefix and assert rollback preserves concurrent foreign history. A CI-only goal fixture now waits for publication entry and settles its held promise before teardown; observing an atomic rename no longer substitutes for write completion. Production goal behavior is unchanged. Integrated validation on #4191
87badaf62f925e118c2292cf3e788fc92894dafcand #4209d83e1cb55f50676562e675398f76e0b5118053ababove main0d31680932fe5b2cb33ce33ec43cb576c86ee0e6: six affected suites passed on each integrated tree: A 549 tests / 3,337 assertions and B 602 tests / 3,649 assertions; full TypeScript and canonical static checks passed on both. The rebased A/B trees exactly match those validated trees.Risk: publication callbacks govern queue and budget accounting. The real-disk assertions protect against lost or duplicated input and incorrect refunds.
This stack integrates main
0d31680932fe5b2cb33ce33ec43cb576c86ee0e6, including #4225’s workspace-fork recovery fix. Each layer retains its previously reviewed diff and all addressed review fixes.This is one layer of the cancellation phase: #4214 → #4215 → #4219 → #4221 → #4182 → #4187 → #4191 → #4209. All eight PRs merge together after every member has current-head approval and passing CI.
Generated with
xum• Model:unavailable• Thinking:unavailable• Cost:$unavailable