[AbirAbbas]

What this is

This lands app/v3 (the desktop engine line) on dev, so dev becomes the one trunk. app/v3 retires afterwards. The plan's G0 gate is this branch: app/v3 (a687c92) with dev's twelve newer commits merged in (0fa1b5d).

• Size: 876 commits ahead of dev, 0 behind.
• Merge method: a merge commit, not a squash. The 876 reviewed commits stay bisectable, and one revert undoes all of it.

Draft until the hand gates pass. The plan's G1 (this PR's checks), G2 (ci-full.yml on this sha), G3–G4 (race and end-to-end), G5 (data both ways, including rollback), G6 (the desk on the merged engine) and G7 (the WorkAF loop live) all run before this leaves draft. It lands after Friday 13 Nov's staging cutoff, so it gets a full week on dev before reaching staging.

How the 28 conflicts were resolved

Every behaviour from both sides is kept, and both sides' tests pass unchanged except where noted below. Decisions a reviewer should check:

• The same fix, twice: An effort set right after a conversation opens is no longer overwritten by the opening stamp #2556 (app/v3) and An effort, place or working copy recorded right after a message is no longer overwritten by its stamp #2557 (dev) fix the same stamp-overwrite race. One implementation is kept, in internal/session/placemeta.go.
• Git auto-maintenance, where codeaf's own git commands start no automatic maintenance #2400 and Make dev's full suite pass every time: five intermittent failures fixed at the cause #2548 disagreed: dev's rule wins.
  • Maintenance is suppressed only in owned copies, never on a person's own repository, as Make dev's full suite pass every time: five intermittent failures fixed at the cause #2548's TestTaskCommitSuppressesMaintenanceOnlyInOwnedCopies asserts.
  • codeaf's own git commands start no automatic maintenance #2400's finishing-commit tests still pass, since they run in owned copies.
  • craft keeps codeaf's own git commands start no automatic maintenance #2400's attached maintenance, and one flag list lives in internal/gitpolicy.
• A device's own directory record keeps app/v3's read-first write. That is what preserves waiting messages (Outbox, Took) and skips an unchanged record.
  • dev's TestLiveDriveRefusedStartupRetriesAndUploads asserted exactly one relay call per refused startup, and a read-first write makes it two.
  • The test now asserts its real law: no relay call beyond one startup attempt per wait, with the cost of an attempt measured from the first one.
  • An automated first pass made each process's first write blind instead, which would drop waiting messages on every restart. That was rejected.
• Names: dev's per-drive driveNotices keeps its name, and app/v3's desktop callbacks become appDriveNotices.
• The desktop's local publication loop now starts dev's storage refresh while hosted storage is off, as engine.go and syncsetup/state.go already do. It adds no requests once storage is open.
• Closing chats stop following ownership and checking their lease once they are displaced or stopped, so a closing chat never reads /cells/ after /release.
• Smaller fixes:
  • The two syncsetup TestMain functions are now one.
  • A duplicate import is removed.
  • Two manual headings gained the asker's own words, because merging both corpora moved their retrieval.

Later dev merges, and the rules they settled

dev moved four times after the first merge. Each move came in as its own merge commit.

• 8511037 merges dev b0dfe97 (Fix what the pre-release hand test of dev found #2567).

  • Knowledge compilation keeps app/v3's retry policy: backoff from 5 to 120 s, and a stored cap of 3 attempts that survives reopening. A new build or a new source resets the cap. Only the owner retries owned work.
  • dev's stored 30-second retry pause becomes an in-memory, per-vault repeat guard of 2 s.
  • Each paid answer is billed once, through one path, and a usable answer updates its receipt.
  • The build's cap key is each ordinary source's id and content hash. The old key reset whenever a source was revisited.
  • The proofs are TestKnowledgeOrdinaryBuildCapsEveryBilledAnswer, TestKnowledgeOrdinaryBuildRetryCapSurvivesRepeatedHandovers, TestKnowledgeDailyLimitBlocksEveryRetry and TestKnowledgeMixedPaidAnswersMatchCallLogLedgerAndReceipts.

• 6ed333e merges dev ace7888 (Fix what the second pre-release hand test of dev found #2577), and leaves one rule for recognising a paid call already in the spending ledger. session.UsageCallID decides everywhere, and ChargeID delegates to it:

  1. An explicit id wins: CallID, remote:+RemoteEvent, or the row ID. Two different explicit ids are two calls, even when everything else about them matches (A take no longer loses or double-counts cost #2332's take law).
  2. Otherwise, the eight-field fingerprint decides: At (UTC, RFC3339Nano), Session, Model, Role, Calls, Input, Output and USD.
  3. A line with neither is still counted against its session's uncovered rows. It is never booked again on every reopen; an unparseable journal timestamp, for example, must not re-bill. "No identity, no dedupe" applies to rows: a row with no identity is never another call's duplicate.
  • A chat with no receipts: its transcript's usage lines are per-turn aggregates, stamped when the turn is sealed, so they can never fingerprint-match the per-call ledger rows. Those lines are covered by the session's row count, which is dev's rule. A chat with receipts keeps A take no longer loses or double-counts cost #2332's strict matching.
  • This fixes the double bill on reopening a chat with no receipts. That bug was on app/v3 alone and on this branch's earlier merge. The proofs are TestReopeningFoldedTaskSpendNeverRebillsWorkerCalls (all four variants) and the seven contract tests in internal/cellindex/usage_remerge_contract_test.go.

• 3cb458b: the take road files a moved chat's copy through dev's capped bucket name. The first merge had dropped the cap, so a chat moved back and forth failed with file name too long. The proof is TestThreeRoundTripsBetweenTwoHomesStillOpen.

• 528122a merges dev 15d40fd (The model pool's writers stop with their owner, and the tmux suite runs on the engine road #2583). It has one conflict, in cmd/codeaf/poolrecord.go. app/v3 stands the pool judge down while the pool is being handed over (poolJudgeStandsDown). dev stops the judge once its owner's context is cancelled. Both checks are kept, in the per-landing judge and in the sweep.

• 6e4d317 merges dev b8c5f26 (A settled task keeps its row in the conversation, and the pool's index pull stops at close #2588), with no conflicts.

Fixes #2579
Fixes #2585

Closing the desktop engine: what it waits for

On the landing head, the full suite went red in scattered, order-dependent ways. The cause was one family: work a test's backend, engine or factory had started kept running after that test returned. Through http.DefaultTransport it then reached the next test's fake. The fix makes each owner's Close stop what it started.

• 5499dbf: the factory's GitHub people, CODEOWNERS and pipeline readers get a bounded Close. A factory with no GitHub token starts no profile reads.

• 679544c: the app backend's Close joins:

  • the solo factory's poll and readers;
  • a brief write already past its debounce;
  • the provider-model warm-up;
  • the catalog warm-ups.

  A second Close waits for the first.

• 6992c46: tests only. Owners close before their fakes, and every pipe fleet and profile road a test opens is closed. No assertion is loosened.

• fd949df: every new wait has a named bound of a second or less. Tests show that a reader or writer that ignores cancellation cannot hold its Close past that bound.

• 392b2b0: every new critical section unlocks from a defer (the guard laws).

Worst case these changes add to a desktop quit: 2 s (briefStopWait + closeWait). That is reached only when a brief write or a GitHub read ignores cancellation; otherwise they add about nothing. The engine-stop and window-quit times, measured on app/v3 a687c92 and on this head, will be added here from the landing hand checks.

Wait on the quit path	Bound	Origin
briefDebounce.stop: cancels the write in flight, then waits	briefStopWait, 1 s	this branch
stopFactoryLoaders: people and pipeline loaders close concurrently	closeWait, 1 s in total	this branch
A second Close of the backend, the local factory or the factory host	ends when the first does; only a concurrent caller reaches it	this branch
Local runner and the local factory server's shutdown	appLocalStopWait, 10 s	app/v3
Factory host <-h.done and the read-loop join (THE READ LOOPS END BEFORE THE FLOOR IS LET GO)	unbounded join; cancels first; worst case is the forge client's 30 s timeout if a transport ignores cancellation	app/v3, unchanged
Pairing, chat list, devices, close watch, orders sweep, crews	unbounded joins, each after cancelling	app/v3, unchanged
Conversation release	appReleaseWait, 5 s, shared	app/v3
closeAll: knowledge, credits (10 s HTTP), catalogs (15 s fetch), place sweep	unbounded joins, each after cancelling	unchanged
closeAll: receipts	appQuitReceiptWait, 3 s	unchanged
closeAll: sync drives	driveCloseWithin, 2 s	unchanged
closeAll: usage ledger and the SQLite closes	ledger drain; 10 s busy bound	unchanged

The engine process still closes where RunApp has always closed it: after the wire has finished its calls in flight, and after CloseUsage.

• 679544c had moved that close, and the engine's pool-errand stop, into the backend's Close. The wire calls Close before it waits for calls in flight, so the engine's receipt wait ran ahead of a receipt that lands after the quit.
• 0343fde backs both out. The same commit also fixes a second Close that waited on a flag tests set without starting a teardown (a 15-minute hang in the PR gate), and gives solo() a refusal that does not mistake a serve-only host's cancelled context for a closing one.

TestUsageMillionRowLedgerFlush (#1749) is the other number this landing owes. Its first write took 3.1 s on one CI runner. It will be timed on this machine, three alternating runs each on a687c92 and on this head, before the merge.

Who it reaches

• The moment it lands: every dev-channel build and the dev relay.
• The desk switches its engine build from app/v3 to dev on landing day.
• Open PRs: the 23 against app/v3 are re-pointed to dev. Their diffs do not change. Superseded ones are closed.

🤖 Generated with Claude Code