| 1 | # Session draft repair validation |
| 2 | |
| 3 | This report covers the local draft repair on top of `8e2e6ef0`. The checkout also |
| 4 | contains the preceding draft implementation; no commit, PR, CI run, or release |
| 5 | was created by this task. [中文](SESSION_DRAFT_REPAIR_VALIDATION.zh-CN.md) |
| 6 | |
| 7 | ## Repairs |
| 8 | |
| 9 | | Defect | Ownership change | Regression evidence | |
| 10 | | --- | --- | --- | |
| 11 | | Retry changed only displayed settings | Prepare or replace the actual Controller under runtime and turn barriers; compare identity and effective profile before admission. Candidate failure preserves the previous runtime and Session. | `draft_runtime_test.go`: real permission change, canonical model/effort/MCP replacement, failed candidate preservation. | |
| 12 | | Editing raced submission capture | Synchronous preparation ID locks content and settings before any await. Flush checks the captured snapshot, and Begin checks its digest. | `session-draft-ownership.test.tsx`, `session-draft-store-races.test.tsx`, Composer regressions. | |
| 13 | | Discard or late completion retargeted navigation | Capture DraftID, generation, edit version, revision, and navigation intent; backend deletion uses CAS. | Target-bound confirmation and late discard tests; navigation fence tests. | |
| 14 | | Old-generation attachment work never settled | Global task settlement is independent of content write eligibility. Async field patches merge into the original owner. | Ownership tests cover conflict replacement and task settlement; native file drop crosses the preload boundary. | |
| 15 | | Restart lost operation identity | Read-only state includes the original operation; explicit resume uses its revision and transfers worker ownership without a lease gap. | Store request/resume tests, restart/no-replay tests, v3 frozen-snapshot regression. | |
| 16 | | Unknown dispatch stopped polling | Application-level polling continues for shell dispatch and unknown acceptance; operation revision prevents rollback. Receipt conversion is idempotent, including accepted cancellation. | Deferred shell polling and accepted-cancel tests; durable shell receipt/deduplication test. | |
| 17 | |
| 18 | Additional boundaries repaired: lost Begin response retries the same request ID |
| 19 | under a backend request lock; cancellation is serialized with runtime publication |
| 20 | and durable admission; a prior worker that is still unwinding cannot leave a new |
| 21 | operation silently stuck. Normal exit joins attachments, preparation, saved |
| 22 | versions, and restore writes. Terminal test cleanup waits for Controller-owned |
| 23 | stores to close before deleting their directory. |
| 24 | |
| 25 | ## Validation scope |
| 26 | |
| 27 | - Local frontend: application lifecycle, draft ownership and store races, |
| 28 | Composer/clipboard, remote, transcript, application/test typechecks, hooks, |
| 29 | layering checks, and production bundle checks. |
| 30 | - Local Go: Desktop is tested as its own module. Store and runtime ownership |
| 31 | have focused race checks; root tests cover shared Controller/session changes. |
| 32 | - Native Electron: 219 shell tests, isolated real-service opening, native PNG |
| 33 | clipboard storage and keyboard paste through Composer, native file drop, confirmed attachment recovery, immediate |
| 34 | close after a renderer edit, and Electron SIGKILL followed by service restart. |
| 35 | These tests make no model request. Clipboard fixture contents are temporary. |
| 36 | - Browser: project plus, top-level new, keyboard shortcut, project context menu, |
| 37 | and command palette all restore the same draft. Twenty repeated new actions preserve it |
| 38 | without adding session rows. Thirty samples start from a history page and end |
| 39 | when the correct draft is editable. Latest mock-browser p95: **28.9 ms**. |
| 40 | |
| 41 | ## Evidence limits |
| 42 | |
| 43 | Final local results: |
| 44 | |
| 45 | | Gate | Result | |
| 46 | | --- | --- | |
| 47 | | Root `go test ./...` | Passed; shared control package 367.7 s. | |
| 48 | | Desktop `go test -timeout=25m ./...` | Passed; Desktop main package 1054.4 s. Subsequent small recovery/store changes also passed focused checks. | |
| 49 | | Draft store and runtime `go test -race` | Passed, including final unknown-version byte-preservation check. | |
| 50 | | Generated host contract and desktop inventory | Passed freshness checks. | |
| 51 | | Frontend typechecks, hooks, layering, production build | Passed. | |
| 52 | | Draft, Composer, lifecycle, sidebar, remote, transcript regressions | Passed; Composer draft suite 118 checks and clipboard menu suite 15 checks. | |
| 53 | | Electron shell tests | 219 passed, zero failed or skipped. | |
| 54 | | Browser and native smoke | Passed within the scope above. | |
| 55 | | Live CI / Windows and Linux native qualification | Not executed. | |
| 56 | |
| 57 | The browser number is a local mock benchmark, not a production Electron latency |
| 58 | claim. Native multiwindow UI conflict interactions and the complete fault-injection matrix were not all |
| 59 | exercised end to end. Deterministic store and component tests cover selected |
| 60 | cross-window and asynchronous ordering cases, including an independent-process |
| 61 | worker lock check. Windows and Linux native clipboard/drop behavior was not |
| 62 | tested on this macOS host. Live CI was not run. |
| 63 | |
| 64 | The initial broad runs exposed stale generated files and a teardown cleanup |
| 65 | race; both were corrected. An initial root run also exceeded the existing |
| 66 | 60-second unlimited-Goal stress-test deadline under concurrent load; its isolated |
| 67 | run passed in 37.4 seconds. No deadline or product assertion was weakened. |
| 68 | |
| 69 | See [lifecycle and compatibility](SESSION_DRAFT_LIFECYCLE.md) for schema v4, |
| 70 | snapshot-version independence, rollback behavior, and recovery actions. |
| 71 |