[AbirAbbas]

Why

#2509 made hosted sync storage off until an account is approved. Testing it on two real computers (a Linux PC and a Mac) turned up the bugs below. Some come from #2509's storage-off roads, and some were already on dev. Each one has its own issue, with a replication anyone can run.

What changes

Storage-off chats

• Fixes A storage-off chat keeps running tools after another computer continues it #2526: tools stop when the chat moves elsewhere.
  • Before, a turn already running kept running tools after another computer continued the chat, because with storage off no drive existed to check.
  • The tool gate now checks who holds a shared storage-off chat, without starting an uploading writer or renewing a hold. It follows the directory feed, trusts a reading for at most 15 s with the feed and 2 s without it, and lets queued tools share one reading, even a slow failed one.
  • Another computer's hold refuses the call with the same chat-moved sentence as the storage-on road. The window then stops admitting new saved turns until the person continues the chat.
  • This computer's own hold (live or lapsed), a free chat, a never-shared chat and an unreachable directory all keep working. A never-shared chat makes no request.
• Fixes First /status after pairing misses the sync storage line on a non-hosted relay address #2528: pairing saves the storage answer at once, so an open window's first /status shows the sync storage line on a relay at a non-hosted address. The ask runs alongside the rest of pairing with its own budget of about 1.5 s. A timeout or a relay without the field changes nothing.

Closing a chat

• Fixes What the last save says when a chat closes never reaches the window #2527: closing sentences reach the window.
  • A sentence said by a closing chat's final save, such as a displacement the final publish found, used to be dropped on the engine road, because the engine stopped forwarding sentences before that save ran.
  • Those sentences now come back on the closing receipt, in an optional savingNotices field that older builds ignore.
  • Where they appear: one chat closing notes them, app quit prints them once after the screen is restored (including a slow close that finishes after quit), and /new and /resume on a shared connection deliver them too.
  • The notice pump's delivery wait is cancellable, so a second window that stopped reading can no longer hold up the engine's close. A sentence delivered live in the last moment before quit, but not yet shown, is printed after the screen is restored, once.
• Fixes Self-hosted relay answers 503 to an unauthenticated directory read after a chat is released #2532: no read after release, and a 401 for an unfinished sign-in. A closing drive no longer follows directory news after it has released its chat. The Go relay answers an authentication that cannot finish with 401, not 503 ("unreachable", which tells clients to retry). A real outage still answers 503.

Moving a chat

• Fixes Continuing a chat below a Git discovery boundary can lose its saved words #2534: a moved chat keeps its words. The native capture searched upwards for Git ignore rules without stopping at GIT_CEILING_DIRECTORIES. An enclosing checkout that ignored the chat's folder then emptied the capture, and continuing the chat on another computer failed on a missing .cell/meta.json. Capture now asks Git itself where the rules stop (git rev-parse --show-toplevel with the same environment), so it agrees with Git for a ceiling equal to the workspace, ancestor and intervening ceilings, several ceilings, trailing slashes and symlinked paths. A file the enclosing repository ignores never enters saved history. A workspace's own .furrowpolicy that turns on gitignore still uses the engine's own discovery; that is Explicit workspace gitignore policy discovers repositories above Git's ceiling furrow#27, and the manual says so.
• Fixes A continued chat with --no-host labels its project as codeaf #2535: the project label survives a move. A chat arriving with --no-host showed project: codeaf. It now shows <folder> (copy from another machine).

Local development

• Fixes Running the hosted relay locally on macOS fails: Node 22 is unstated and the build hook reads /proc/pressure/io #2529: the hosted relay builds on macOS. The relay's build hook waited on Linux-only /proc/pressure/io. The wait is now skipped where that file is missing, and is unchanged where it exists; a script test in make test-tooling pins the three cases. The README names Node 22.

Not fixed here: #2531. A local wrangler dev relay stops serving accounts after about two. The issue now carries measurements: the memory admission check works as written, and idle members do release their share and recover. The fix is a design choice for the hosted relay: an admission that waits, or a local layout that spreads accounts across isolates. Production's coordinator namespace recorded no exceptions in the last seven days.

Manual. The manual says what a storage-off chat does when another computer continues it, where closing sentences appear, the copy label, the Git boundary, and pairing's storage ask.

Validation

• Tests. Every fix has a regression test that fails with the previous production bytes swapped in and passes with the fix. They cross the real boundary:
  • a real seated turn through the tool gate;
  • the real remote client and server for closing receipts, including a blocked second window;
  • real pairing for the storage answer;
  • the real native engine and relay with two homes for the Git boundary;
  • the rendered frame for the label.
• Targeted suites: 213 existing tests on the touched code, the relay's own tests (262 of 262), its Raft actor tests, and the manual gates.
• Reproduction:
  • the empty-capture bug reproduced in 12 of 12 Linux trials (Go and hosted relays, with and without --no-host), and all 12 passed after the fix;
  • the macOS repros of Running the hosted relay locally on macOS fails: Node 22 is unstated and the build hook reads /proc/pressure/io #2529, A local copy of the hosted relay stops serving accounts after about two: raft member isolate capacity #2531 and Self-hosted relay answers 503 to an unauthenticated directory read after a chat is released #2532 were run on a real Mac.
• Three read-only reviews. Their findings are fixed in this branch, apart from the furrow one above.
• Hand checks of the real binary on the final head:
  • On a Mac, stopped partway on the owner's instruction. These passed before it stopped:
    • A storage-off chat keeps running tools after another computer continues it #2526: the second tool was refused 1 s after the other computer continued, no new saved turn followed, and continuing restored work;
    • First /status after pairing misses the sync storage line on a non-hosted relay address #2528, Running the hosted relay locally on macOS fails: Node 22 is unstated and the build hook reads /proc/pressure/io #2529 (the in-tree relay builds on macOS), Self-hosted relay answers 503 to an unauthenticated directory read after a chat is released #2532 and A continued chat with --no-host labels its project as codeaf #2535;
    • What the last save says when a chat closes never reaches the window #2527 printed once in a race and was otherwise shown live, as intended;
    • the regression items it reached.
  • On Linux: Continuing a chat below a Git discovery boundary can lose its saved words #2534 with an ancestor ceiling continues the chat with its words. With the ceiling equal to the workspace, Git still sees the enclosing repository and capture now agrees with it. That layout, and the same with no ceiling, then hits an older failure that is identical on dev, filed as A chat whose project folder is inside a Git-ignored directory cannot be saved or moved #2539. The confidential marker appeared nowhere on the receiving home.
• Found while testing, already on dev, not changed here:
  • A computer that opened codeaf once cannot join another: 'this computer has local work' with no chats #2538: a computer that opened codeaf once cannot join another;
  • A chat whose project folder is inside a Git-ignored directory cannot be saved or moved #2539: a chat whose project folder is inside a Git-ignored directory cannot be saved.
• make pr-ready: every package passed except cmd/codeaf, which hit its 15-minute ceiling only while another session loaded the laptop. CI ran that package green in under four minutes.

🤖 Generated with Claude Code