Repository navigation
ui-server: retain layered Storage history and deliver qualified capacity guidance #2058
Description
Context
Part of #1779, implementation follow-on from #2014. The maintainer approved the reconciled bundle. Read docs/decisions/storage-guidance.md and docs/plans/storage-growth.md as delivered by the design-finalization PR, alongside docs/decisions/design-kit/storage.md, docs/decisions/native-brain-storage.md and ROADMAP.md's binding decisions.
Source rechecked on #2165 (6c5c3a0b6): collectStorageInventory, packages/core/src/lib/storage-inventory.ts:149, supplies bounded metadata; #2010 supplies the owner-authorized shared server inventory coordinator and capacities. createPushSender, packages/ui-server/src/activity/push-sender.ts:79, owns the concrete Web Push transport. createActionNotifier, packages/ui-server/src/inbox/notify.ts:271, and reportDeviceZone, the same file:483, provide existing timezone/authenticated-destination machinery; Action cadence is not Storage policy.
Out of scope
No public Storage pane registration, new transport/provider seam, content-index history, per-file history, remote quotas, automatic cleanup, new retention defaults, forecast promises, recurring notification reminders or actual notifications during tests.
Scope
Persist bounded aggregate history and per-capacity warning state in the UI operational DB, reusing #2010 collection. Expose versioned owner-only history/guidance evidence, and deliver the explicitly approved opt-in Critical Web Push behavior using existing transport and subscription ownership.
Acceptance criteria
- Retain 64 six-hour, 90 daily and 32 Monday-based weekly actual endpoints globally, at most four capacity scopes, with no extra scans for tiers. Enforce 186 slots, 1,152 bytes/sample and 40,960 combined dictionary/singleton bytes including framing within 256 KiB; bound descriptor churn and pause honestly on overflow. Account separately for SQLite/WAL and delivery receipts; do not add serialized payload to measured DB allocation.
- Scheduled six-hour collection coalesces with Refresh/operations, never catches up missed buckets or scans on startup/hot paths, and persists at most once/minute. Use a cross-process lease, bounded pending state, cancellation/reaping, and shutdown/restart proof. Preserve last valid evidence when writes fail.
- Keep actual timestamps, sticky gaps, age/slot expiry, scope/basis/total changes and clock reversal semantics. No invented endpoints or daily/weekly interpolation. Cap/garbage-collect descriptor references atomically with samples.
- Implement the design's observed rates and short/long available-capacity scenarios with minimum evidence, direction/burst guards and distinct unavailable/non-depleting states. No App-growth substitution or numeric infinity. Exact thresholds use unrounded values; ranges are labelled scenarios, not confidence intervals.
- Persist independent capacity/forecast/refusal causes, 10%/5% and 30-day/7-day entries, 12%/7% and 45-day/10-day recovery, two fresh observations at least 60 seconds apart, every active cause recovered before downgrade, and matching owner-success evidence for refusal. Unknown/stale/missing evidence never clears pressure.
- Use current human-owner authorization for reading history/state and every scheduled delivery; delegated/revoked principals get no operational information. Stable opaque capacity identity persists across restart while authorization, root epochs and scope changes remain isolated.
- One successful Critical transport submission per episode/subscription, no reminders. Unique durable intents, bounded known-failure retries and terminal ambiguous outcomes survive crashes/restarts. Recheck ownership, subscription, fresh active severity and strict local 22:00–08:00 quiet hours at every attempt. Unknown timezone defers; recovery suppresses; no backlog replay or delivery-only scans. Generic payload contains no paths/amounts/capacity IDs. Receipt retention is bounded by existing subscription count and active/latest-resolved episodes.
- Migration/export/restore maintains operational ownership and invalidates stale delivery authority; restoring data cannot replay accepted or uncertain notices. New SDK/HTTP/config surfaces document limits, capability negotiation, unknown/stale states and minor consumer changesets in a CONTRACT commit.
Verification
Offline synthetic Odysseus fixtures anchored to 2026-07-12. Exercise actual SQLite migrations/transactions, restart/crash, cross-process coalescing, quota/write failure, descriptor churn, timezone/DST/reversal, stale/revoked delivery and bounded process cleanup. Transport doubles replace the lowest existing send method; no network/provider keys. Mutations must break sample/dictionary caps, comparability, cause recovery, authorization and durable deduplication and fail the named assertions. Record actual DB/WAL growth at 186 full samples. Run check:pr and every selected hosted category.
Contract impact
Additive owner-authorized history/guidance SDK and HTTP/config contracts and consumer minor changesets. Core remains independent of the operational DB. No new extension seam.
Delivered dependency: #2010 (included in verified #2172 delivery).
2026-10-16: design prerequisite #2014 is complete through #2060 at fec9a379da878c59d2e7577c6c940dc6ee5d4a03; the implementation dependencies are now included in the verified combined delivery.
Delivered dependency: #2012 (included in verified #2172 delivery).
2026-10-16: #2165 supplies the server implementation. The existing retained-removal and maintenance owners now report real refusal/success evidence, so #2012 is an implementation dependency in addition to #2010. Selected hosted proof passed on the actual delivery candidate, as recorded below.
Verified delivery — 2026-10-19
Delivered through #2172 as squash caae12da2e678dd4720bf112e93ef21812cfdc18, tree 0d0965b8c72bbe14644da018558ffc90ae2950fa, parent 0b46b9db7925ce2e52c85a56c6200a4e2f330bd7. The actual squash matches the inspected combined candidate exactly and is present on remote main. Release milestone: 0.44.0.
Bounded layered history, qualified capacity scenarios, independent hysteretic pressure causes and opt-in Critical delivery are implemented. Endpoint/dictionary budgets, ownership, scheduling, crash/restart, quiet hours, durable deduplication and ambiguous delivery outcomes retain their guards and evidence.
Ready-PR confirmation 39299288116, attempt 1 passed all 17 selected jobs on actual checkout ad44bb6228c13770b54797039233319fd58f6e44. All checkout logs and 13 resource receipts agree on the verified head/base/tree; no domains were retained. Local preflight passed 959 fast and 7,198 affected tests with four expected inverse empty vector placeholders, zero failures, across all 548 selected files. All 77 Storage browser/story cases passed. Prior failing-first and restored mutation receipts retain their original identities.
The original #2172 automatic main run 39302987919, attempt 1 remains failed: 15 jobs passed, unit (1) encountered the #2405 vanishing maintenance.lock fixture-copy failure, and aggregate proof failed. All 77 Storage browser/story cases passed there. Its actual checkout was caae12da2e678dd4720bf112e93ef21812cfdc18; no failed receipt was rerun or relabelled.
The separate test-fixture correction #2448 merged as cea53611ddea4916ac323060bfef42ec18118fea, parent caae12da2e678dd4720bf112e93ef21812cfdc18, tree 4a826e90467b5874be85ff71d04e9ede01577486. Its automatic main-push run 39312029459, attempt 1 passed all 17 selected jobs. Every actual checkout log and all 13 resource receipts agree on that squash identity; integrated-cadence aggregate passed with an empty retention ledger. All 77 Storage browser/story cases and all eight Git-policy regressions passed freshly on corrected main. The correction changes only the test preload, its regression tests and testing documentation; Storage product source is unchanged. Both squash commits are present on remote main.
Separate follow-ups remain open: #2334 needs reproduction; #2380 and #2279 await maintainer decisions following their newer contention reproductions. This delivery does not change their scope or claim to explain the exact historical failures.
2026-10-19 correction: replaced superseded candidate/verification status with the verified delivery and resolved implementation dependencies. Historical failed receipts and their stated limits remain preserved in the issue/PR discussion.
Activity
schlessera commentedon Oct 16, 2026
Claiming the approved server history/guidance/delivery implementation as part of the authorized Storage chain. Claim token: storage-2058-20261016-k7n9. Intended branch: feat/2058-storage-guidance-k7n9. Implementation will use the existing Storage coordinator and notification transport; #2010 remains the delivery dependency. No scans or notifications will run outside offline fixtures during development.
schlessera commentedon Oct 16, 2026
2026-10-16 delivery update: the authorized Storage implementation and its prerequisite fixture repair are consolidated into ordinary main-based PR #2172. The earlier individual PRs remain open as smaller review diffs; they will be reconciled only after actual combined delivery. The previous dependency-by-dependency handoff instructions are superseded by this integrated candidate, not by a native stack or a CI waiver.
Current local candidate
aa51b7703includes mainff70ec1c2eda22e5e84593a5467fc85d0c385600and the reproduced verification blockers. Complete local confirmation is running; hosted confirmation and main verification remain. Earlier failed, stopped or stale-candidate runs retain their original results. No issue is complete or closed yet, and this invocation retains its implementation claims while finishing the combined delivery.schlessera commentedon Oct 16, 2026
Blocked handoff for the authorized Storage chain: draft #2172 at
26665d03apreserves the implementation, corrected health fixture and bounded composer failure diagnostics. Its proof section records exact heads/bases, failed broad preflight, corrected quota/health failures and the unresolved #2202 timeout. Six isolated subagent cases, the complete 46-case matrix and 50 fresh admission cycles pass but do not explain the original failure. No passing retry is presented as a fix or complete candidate qualification.Resume with #2202's recorded repro gap, then reconcile relevant live main and obtain required local, complete selected hosted and actual-main proof. Earlier independent fixture deliveries retain their own provenance; this combined handoff does not close remaining verification criteria. Releasing only this invocation's assignment. Resumable branches/PRs and all receipts remain preserved; no implementation PR is marked ready or merged by this handoff.
schlessera commentedon Oct 17, 2026
2026-10-17 scoped triage: applied the maintainer's non-blocking rulings for #2202 (unavailable Send) and #1946 (ActionCard animation). Diagnosis of either observation is not required before this work continues. #2202 retains needs: repro; #2307 remains a separate production-observation design. Preserved historical failures, implementation criteria, assignments and release attribution. Remaining declared prerequisites: Blocked by #2010; Blocked by #2012 The combined candidate remains subject to its other verification and delivery requirements.
schlessera commentedon Oct 17, 2026
Resuming the authorized Storage implementation chain in #2172 under claim
storage-resume-20261017-c0d4, using the existing candidate branchfeat/2059-storage-history-ui-m4p6. The maintainer's 2026-10-17 ruling makes the known unavailable-Send observation non-blocking; historical failed receipts remain preserved. #2262's health fixture correction is now delivered independently in #2282. Next: reconcile current main, run focused preflight and selected candidate confirmation, then deliver the combined chain when the remaining requirements are satisfied. No admission, authentication, assertions or deadlines will be weakened.schlessera commentedon Oct 17, 2026
Bounded handoff recorded in the updated body and #2172. Current candidate
fe5faafdahas passing native/type/focused proof; broad preflight finishes6,948 pass /4 skip /1 fail after949 fast tests pass. The distinct unresolved speech bundler exit is #2334; #2202 is non-blocking and its previously affected case passes. Preserve the draft implementation and original receipts. Reconcile later main and resume complete qualification after #2334 attribution. Releasing this invocation's owned claim; no merged delivery or complete hosted proof is claimed.schlessera commentedon Oct 17, 2026
Resuming the authorized Storage chain and bounded blocker diagnostics under claim
storage-recheck-20261017-e8f2, using existing PR #2172 branchfeat/2059-storage-history-ui-m4p6. Reconcile current main, preserve the original #2334 failure, and obtain the missing browser-bundle child exit/signal/output observations before selecting any correction. No skipped test, weakened assertion or deadline change. The four historical SQLite skip labels are inverse empty placeholders; substantive vector cases passed, as verified against source and the retained log. Historical totals and the speech failure remain unchanged.schlessera commentedon Oct 17, 2026
The policy consistency audit found a concrete #2058 defect: the long scenario still capped observations at 28 days, although the compatible later maintainer ruling selects 7-day/30-day windows. PR #2172 now includes correction
4440e0f9b, aligning the implementation, design experiment, specification, durable decision and user documentation. Existing 64/90/32 retention, sample/byte limits, evidence minimums, sampling cost and warning/delivery policy are unchanged.Failing-first evidence:
STORAGE_LONG_SCENARIO_USES_30_DAY_POLICYdrops two eligible daily endpoints under the old limit. The independent design trace returns 47 days instead of 45.483870967741936 under the old limit. Both pass after the correction; 62 history/pressure/citation tests pass with 213 assertions. The regression checks included/excluded endpoint effects and the exact 30-day boundary. Lint and the complete pending changeset plan pass (all 19 packages minor).The earlier
4376cf9cdpreflight was intentionally interrupted before its speech-bundle stage because this correction changes the delivery candidate; its 950 passing fast checks are preserved without claiming a complete pass. All 10 owned processes exited without forced cleanup. Full preflight is now running on4440e0f9bagainst unchanged main85873db77, with the bundle observations intact. This is a policy correction, not a diagnosis or repair of #2334; its historical failed receipt remains.schlessera commentedon Oct 19, 2026
Delivered through #2172 as squash
caae12da2e678dd4720bf112e93ef21812cfdc18, tree0d0965b8c72bbe14644da018558ffc90ae2950fa, parent0b46b9db7925ce2e52c85a56c6200a4e2f330bd7. The actual squash matches the inspected combined candidate exactly and is present on remote main. Release milestone: 0.44.0.Bounded layered history, qualified capacity scenarios, independent hysteretic pressure causes and opt-in Critical delivery are implemented. Endpoint/dictionary budgets, ownership, scheduling, crash/restart, quiet hours, durable deduplication and ambiguous delivery outcomes retain their guards and evidence.
Ready-PR confirmation 39299288116, attempt 1 passed all 17 selected jobs on actual checkout
ad44bb6228c13770b54797039233319fd58f6e44. All checkout logs and 13 resource receipts agree on the verified head/base/tree; no domains were retained. Local preflight passed 959 fast and 7,198 affected tests with four expected inverse empty vector placeholders, zero failures, across all 548 selected files. All 77 Storage browser/story cases passed. Prior failing-first and restored mutation receipts retain their original identities.The original #2172 automatic main run 39302987919, attempt 1 remains failed: 15 jobs passed, unit (1) encountered the #2405 vanishing
maintenance.lockfixture-copy failure, and aggregate proof failed. All 77 Storage browser/story cases passed there. Its actual checkout wascaae12da2e678dd4720bf112e93ef21812cfdc18; no failed receipt was rerun or relabelled.The separate test-fixture correction #2448 merged as
cea53611ddea4916ac323060bfef42ec18118fea, parentcaae12da2e678dd4720bf112e93ef21812cfdc18, tree4a826e90467b5874be85ff71d04e9ede01577486. Its automatic main-push run 39312029459, attempt 1 passed all 17 selected jobs. Every actual checkout log and all 13 resource receipts agree on that squash identity; integrated-cadence aggregate passed with an empty retention ledger. All 77 Storage browser/story cases and all eight Git-policy regressions passed freshly on corrected main. The correction changes only the test preload, its regression tests and testing documentation; Storage product source is unchanged. Both squash commits are present on remote main.Separate follow-ups remain open: #2334 needs reproduction; #2380 and #2279 await maintainer decisions following their newer contention reproductions. This delivery does not change their scope or claim to explain the exact historical failures.