Make placement and Later scheduling durable #8

New issue

Closed

opened 2026-08-28 19:24:40 +00:00 by dikka · 1 comment

dikka commented

2026-08-28 19:24:40 +00:00

Owner

What to build

Move Active, Later, Parked, and Archived from browser-local overlays into shared durable workspace metadata. Placement is organization only. Continue, Stop, disconnect, reconnect, process exit, and runtime failure never mutate it. Remove automatic disconnect parking and 24-hour archiving.

Use stable newest-created-first navigator ordering; activity and opening a session do not reorder it. Archived is a dedicated grouped destination. Remove synthetic process or tmux location labels from normal session identity. Ignore old browser placement keys and leave old catalog files untouched; no migration code is required.

Later stores an absolute deadline. The common action uses a user-facing default duration stored in a small Settings destination. Later for… accepts positive decimal hours for one action and never changes the default. Return to Active cancels the deadline.

Acceptance criteria

Placement persists across browser and hub restart and is visible consistently to connected browser pages.
Active, Later, Parked, and Archived actions never start, stop, resume, adopt, or signal a process.
Disconnect, reconnect, exit, failure, Stop, and Continue leave placement unchanged.
No automatic parking or archiving occurs from runtime state.
Navigator order is stable newest-created-first and does not change from activity or selection.
Archived is a dedicated grouped destination; synthetic pi:N or tmux location labels are absent.
Later uses an absolute deadline, configured default, and one-off positive decimal-hour input; Return to Active cancels it.
Deadline expiry is hub-owned and deterministic after restart.
Old browser placement state is ignored rather than migrated.
Catalog, timer, HTTP/SSE, browser navigation, and runtime/placement matrix tests pass.

Blocked by

#4 — Persist terminal-observed sessions as workspace records
#5 — Manage the complete browser-session lifecycle

Human checkpoint note: Do not request routine per-ticket approval. The implementing agent may make the internal architecture, refactoring, testing, and UI-detail decisions needed to satisfy the acceptance criteria. Pause only if implementation requires a material product or ownership change, a destructive or hard-to-reverse action, excluded security or deployment scope, credentials or spending, or a real-browser design fork with no safe default. Forgejo completion updates may be batched with the rest of the completed frontier. The user performs final hub and Pi restart steps. Agents must not start, restart, replace, or stop the user-run Pilcrow development server.

## What to build Move Active, Later, Parked, and Archived from browser-local overlays into shared durable workspace metadata. Placement is organization only. Continue, Stop, disconnect, reconnect, process exit, and runtime failure never mutate it. Remove automatic disconnect parking and 24-hour archiving. Use stable newest-created-first navigator ordering; activity and opening a session do not reorder it. Archived is a dedicated grouped destination. Remove synthetic process or tmux location labels from normal session identity. Ignore old browser placement keys and leave old catalog files untouched; no migration code is required. Later stores an absolute deadline. The common action uses a user-facing default duration stored in a small Settings destination. Later for… accepts positive decimal hours for one action and never changes the default. Return to Active cancels the deadline. ## Acceptance criteria - [ ] Placement persists across browser and hub restart and is visible consistently to connected browser pages. - [ ] Active, Later, Parked, and Archived actions never start, stop, resume, adopt, or signal a process. - [ ] Disconnect, reconnect, exit, failure, Stop, and Continue leave placement unchanged. - [ ] No automatic parking or archiving occurs from runtime state. - [ ] Navigator order is stable newest-created-first and does not change from activity or selection. - [ ] Archived is a dedicated grouped destination; synthetic pi:N or tmux location labels are absent. - [ ] Later uses an absolute deadline, configured default, and one-off positive decimal-hour input; Return to Active cancels it. - [ ] Deadline expiry is hub-owned and deterministic after restart. - [ ] Old browser placement state is ignored rather than migrated. - [ ] Catalog, timer, HTTP/SSE, browser navigation, and runtime/placement matrix tests pass. ## Blocked by - #4 — Persist terminal-observed sessions as workspace records - #5 — Manage the complete browser-session lifecycle > **Human checkpoint note:** Do not request routine per-ticket approval. The implementing agent may make the internal architecture, refactoring, testing, and UI-detail decisions needed to satisfy the acceptance criteria. Pause only if implementation requires a material product or ownership change, a destructive or hard-to-reverse action, excluded security or deployment scope, credentials or spending, or a real-browser design fork with no safe default. Forgejo completion updates may be batched with the rest of the completed frontier. The user performs final hub and Pi restart steps. Agents must not start, restart, replace, or stop the user-run Pilcrow development server.

dikka added the

ready-for-agent

label

2026-08-28 19:24:40 +00:00

dikka referenced this issue

2026-08-28 19:24:42 +00:00

Replace notification attention with Overview #12

dikka referenced this issue

2026-08-28 19:24:45 +00:00

Replace the old workspace shell #16

dikka added a new dependency

2026-08-28 19:24:46 +00:00

#4 Persist terminal-observed sessions as workspace records

dikka added a new dependency

2026-08-28 19:24:46 +00:00

#5 Manage the complete browser-session lifecycle

dikka added a new dependency

2026-08-28 19:24:46 +00:00

#12 Replace notification attention with Overview

dikka added a new dependency

2026-08-28 19:25:21 +00:00

#16 Replace the old workspace shell

dikka commented

2026-08-29 01:26:37 +00:00

Author

Owner

Implemented in jj revision 790b1263 (feat(workspace): persist session placement and Later settings in hub).

What changed:

Workspace catalog v3 now persists explicit active, later(deadline), parked, and archived placement. New/imported records start Active; runtime state, activity, selection, disconnect/reconnect, failure/quarantine, Stop, Continue, process exit, and hub restart never change placement.
Removed browser-local placement keys, cross-tab reconciliation, disconnect parking, and 24-hour auto-archive. Old browser keys and old catalog versions are ignored/rejected without migration.
Navigator order is durable newest-created-first with monotonic creation timestamps under equal/backward clocks, stable ties, and no reordering from activity or opening. Archived is a grouped destination and synthetic process/tmux locations are removed.
Later stores an absolute deadline. The hub schedules the nearest deadline with 30-second capped wall-clock rechecks, so forward/backward clock jumps reconcile. Overdue startup, reschedule/cancel, persistence failure retry, and shutdown are deterministic.
Placement writes are serialized/fenced per workspace and remain outside snapshots/SSE until durably committed. Concurrent runtime writes, Settings snapshots, and failed placement requests cannot expose or later persist optimistic state.
Added private atomic settings.json v1 with a 4-hour default and bounded positive decimal durations. Later-for is one-off and does not change the default; Return to Active removes the deadline.
Settings load uses O_NOFOLLOW and revalidates type, owner, private mode, nlink, dev/ino, size, mtime, and ctime before/after read.
Added same-origin bounded placement and Settings endpoints. Placement handlers contain no launcher/process path.
Browser Settings and placement controls consume authoritative hub state only. Strict decimal parsing rejects exponent/hex/whitespace/zero forms. Network loss is shown as indeterminate and retry is fenced until SSE reconciliation; dirty Settings drafts survive authoritative multi-page updates with explicit conflict and accessible validation.
README now documents catalog v3, settings.json, hub-owned placement/deadlines, and shared multi-page SSE.

Audit and regression coverage:

Fresh review found clock-jump lateness, optimistic persistence/SSE races, weak settings TOCTOU checks, incomplete runtime/HTTP/timer matrices, misleading failure UX, stale documentation, and unstable creation ordering. All findings were fixed before closure.
Added multiple-deadline/reschedule/cancel/clock-jump/overdue/retry/shutdown tests; 20-run placement concurrency stress; runtime/Stop/Continue/failure/quarantine/reconnect matrix; launcher spies; full Origin/content-type/body/numeric endpoint negatives; multi-page/reconnect SSE; settings safety/serialization/failure cleanup; ordering under activity/selection/retrograde clocks; and browser timeout/conflict/accessibility/navigation tests.

Validation:

Supervisor focused verification passed: 4 files / 152 tests.
Full suite passed: 65 files / 517 tests.
TypeScript no-emit checks, hub build, production browser build, changed-file formatting, and git diff --check passed.
Fixture QA on the existing Vite server verified Settings validation accessibility, menu values, and absence of synthetic locations. The dev hub was unavailable, so live mutation QA was correctly not attempted.
Whole-tree vp check remains blocked only by the unchanged pre-existing formatting issue in .dev/agents/triage-labels.md.

Protocol remains v8. Placement remains organization only and no endpoint starts, stops, resumes, adopts, or signals a Pi runtime. No dev server was managed.

Implemented in jj revision `790b1263` (`feat(workspace): persist session placement and Later settings in hub`). What changed: - Workspace catalog v3 now persists explicit `active`, `later(deadline)`, `parked`, and `archived` placement. New/imported records start Active; runtime state, activity, selection, disconnect/reconnect, failure/quarantine, Stop, Continue, process exit, and hub restart never change placement. - Removed browser-local placement keys, cross-tab reconciliation, disconnect parking, and 24-hour auto-archive. Old browser keys and old catalog versions are ignored/rejected without migration. - Navigator order is durable newest-created-first with monotonic creation timestamps under equal/backward clocks, stable ties, and no reordering from activity or opening. Archived is a grouped destination and synthetic process/tmux locations are removed. - Later stores an absolute deadline. The hub schedules the nearest deadline with 30-second capped wall-clock rechecks, so forward/backward clock jumps reconcile. Overdue startup, reschedule/cancel, persistence failure retry, and shutdown are deterministic. - Placement writes are serialized/fenced per workspace and remain outside snapshots/SSE until durably committed. Concurrent runtime writes, Settings snapshots, and failed placement requests cannot expose or later persist optimistic state. - Added private atomic `settings.json` v1 with a 4-hour default and bounded positive decimal durations. Later-for is one-off and does not change the default; Return to Active removes the deadline. - Settings load uses O_NOFOLLOW and revalidates type, owner, private mode, nlink, dev/ino, size, mtime, and ctime before/after read. - Added same-origin bounded placement and Settings endpoints. Placement handlers contain no launcher/process path. - Browser Settings and placement controls consume authoritative hub state only. Strict decimal parsing rejects exponent/hex/whitespace/zero forms. Network loss is shown as indeterminate and retry is fenced until SSE reconciliation; dirty Settings drafts survive authoritative multi-page updates with explicit conflict and accessible validation. - README now documents catalog v3, settings.json, hub-owned placement/deadlines, and shared multi-page SSE. Audit and regression coverage: - Fresh review found clock-jump lateness, optimistic persistence/SSE races, weak settings TOCTOU checks, incomplete runtime/HTTP/timer matrices, misleading failure UX, stale documentation, and unstable creation ordering. All findings were fixed before closure. - Added multiple-deadline/reschedule/cancel/clock-jump/overdue/retry/shutdown tests; 20-run placement concurrency stress; runtime/Stop/Continue/failure/quarantine/reconnect matrix; launcher spies; full Origin/content-type/body/numeric endpoint negatives; multi-page/reconnect SSE; settings safety/serialization/failure cleanup; ordering under activity/selection/retrograde clocks; and browser timeout/conflict/accessibility/navigation tests. Validation: - Supervisor focused verification passed: 4 files / 152 tests. - Full suite passed: 65 files / 517 tests. - TypeScript no-emit checks, hub build, production browser build, changed-file formatting, and `git diff --check` passed. - Fixture QA on the existing Vite server verified Settings validation accessibility, menu values, and absence of synthetic locations. The dev hub was unavailable, so live mutation QA was correctly not attempted. - Whole-tree `vp check` remains blocked only by the unchanged pre-existing formatting issue in `.dev/agents/triage-labels.md`. Protocol remains v8. Placement remains organization only and no endpoint starts, stops, resumes, adopts, or signals a Pi runtime. No dev server was managed.

dikka closed this issue

2026-08-29 01:26:37 +00:00