fix: stop sync retry loops and preserve newer edits

.github/workflows/sync-compat.yml

@@ -59,7 +59,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           repository: elkimek/getbased-relay
-          ref: 2e7979ea5c72d0e6e0652b241d845c3b77762a24
+          ref: 4f44ebb32d8c44d29503cb075d57ce48a7519b28
           path: .ci/getbased-relay
           persist-credentials: false
 

.github/workflows/test.yml

@@ -15,7 +15,7 @@ on:
         type: choice
         required: false
         default: 'off'
-        options: ['off', 'webkit-lens-wearable', 'webkit-pwa-routstr']
+        options: ['off', 'webkit-lens-wearable', 'webkit-pwa-routstr', 'webkit-evolu-runtime']
   workflow_call:
     inputs:
       full_suite:
@@ -25,14 +25,14 @@ on:
 permissions:
   contents: read
 concurrency:
-  group: tests-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}-${{ inputs.full_suite == true && 'full' || 'scoped' }}${{ github.event_name == 'workflow_dispatch' && inputs.diagnostic == 'webkit-lens-wearable' && '-webkit-diagnostic' || '' }}${{ github.event_name == 'workflow_dispatch' && inputs.diagnostic == 'webkit-pwa-routstr' && '-webkit-pwa-routstr-diagnostic' || '' }}
+  group: tests-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}-${{ inputs.full_suite == true && 'full' || 'scoped' }}${{ github.event_name == 'workflow_dispatch' && inputs.diagnostic == 'webkit-lens-wearable' && '-webkit-diagnostic' || '' }}${{ github.event_name == 'workflow_dispatch' && inputs.diagnostic == 'webkit-pwa-routstr' && '-webkit-pwa-routstr-diagnostic' || '' }}${{ github.event_name == 'workflow_dispatch' && inputs.diagnostic == 'webkit-evolu-runtime' && '-webkit-evolu-diagnostic' || '' }}
   cancel-in-progress: ${{ (github.event_name == 'pull_request' || github.event_name == 'push') && inputs.full_suite != true }}
 env:
   GETBASED_KIT_ARTIFACT: ${{ github.workspace }}/dist
   CI_TEST_PLAN: .local-notes/ci/plan.json
 jobs:
   prepare:
-    if: github.event_name != 'workflow_dispatch' || (inputs.diagnostic != 'webkit-lens-wearable' && inputs.diagnostic != 'webkit-pwa-routstr')
+    if: github.event_name != 'workflow_dispatch' || (inputs.diagnostic != 'webkit-lens-wearable' && inputs.diagnostic != 'webkit-pwa-routstr' && inputs.diagnostic != 'webkit-evolu-runtime')
     runs-on: ubuntu-latest
     timeout-minutes: 30
     outputs:
@@ -168,7 +168,9 @@ jobs:
       - name: Full unit coverage and unchanged critical behavior floors
         if: needs.prepare.outputs.full == 'true'
         run: |
-          node node_modules/vitest/vitest.mjs run --coverage
+          # Leave room for native TypeScript and nested producer subprocesses.
+          # Keep the complete suite, coverage denominator and deadlines intact.
+          node node_modules/vitest/vitest.mjs run --coverage --maxWorkers=2
           node node_modules/vitest/vitest.mjs run --config vitest.critical.config.js
       - name: Affected unit tests and mandatory changed-source checks
         if: needs.prepare.outputs.full != 'true'
@@ -516,9 +518,9 @@ jobs:
           if-no-files-found: error
           retention-days: 14
   test:
-    name: ${{ github.event_name == 'workflow_dispatch' && (inputs.diagnostic == 'webkit-lens-wearable' || inputs.diagnostic == 'webkit-pwa-routstr') && 'DIAGNOSTIC normal gate omitted' || 'test' }}
+    name: ${{ github.event_name == 'workflow_dispatch' && (inputs.diagnostic == 'webkit-lens-wearable' || inputs.diagnostic == 'webkit-pwa-routstr' || inputs.diagnostic == 'webkit-evolu-runtime') && 'DIAGNOSTIC normal gate omitted' || 'test' }}
     needs: [prepare, unit, native, kit, performance, coverage]
-    if: always() && (github.event_name != 'workflow_dispatch' || (inputs.diagnostic != 'webkit-lens-wearable' && inputs.diagnostic != 'webkit-pwa-routstr'))
+    if: always() && (github.event_name != 'workflow_dispatch' || (inputs.diagnostic != 'webkit-lens-wearable' && inputs.diagnostic != 'webkit-pwa-routstr' && inputs.diagnostic != 'webkit-evolu-runtime'))
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
@@ -782,3 +784,75 @@ jobs:
           include-hidden-files: true
           if-no-files-found: warn
           retention-days: 7
+
+  webkit_evolu_diagnostics:
+    name: DIAGNOSTIC Cocoa Evolu restart (${{ matrix.project }}; not a release gate)
+    if: github.event_name == 'workflow_dispatch' && inputs.diagnostic == 'webkit-evolu-runtime'
+    runs-on: macos-15
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        project: [kit-webkit, kit-mobile-webkit]
+    env:
+      GETBASED_KIT_ACCEPTANCE_GUARD: '1'
+      GETBASED_KIT_GUARD_REPORT: .local-notes/ci/evolu-diagnostic/guard.json
+      PLAYWRIGHT_KIT_OUTPUT_DIR: .local-notes/ci/evolu-diagnostic/results
+      GETBASED_KIT_CASE_SCOPE: all
+      GETBASED_KIT_PROJECT: ${{ matrix.project }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: 24
+          cache: npm
+      - run: node scripts/fetch-catalog.mts
+      - run: npm ci
+      - run: npx --no-install playwright install --with-deps webkit
+      - name: Build and verify the actual diagnostic artifact
+        run: |
+          set -euo pipefail
+          node scripts/build-sveltekit.mjs --output dist
+          node scripts/ci-artifact.mjs seal --artifact dist --transport .local-notes/ci/evolu-diagnostic/transport
+          node scripts/ci-artifact.mjs verify --artifact dist --transport .local-notes/ci/evolu-diagnostic/transport --github-env
+      - name: Run the canonical Evolu offline restart case without retries
+        id: diagnostic_case
+        env:
+          PROJECT: ${{ matrix.project }}
+        run: node node_modules/@playwright/test/cli.js test --config=playwright.sveltekit.config.js --project="$PROJECT" --workers=1 --retries=0 tests/pwa/sveltekit-evolu-runtime.spec.ts
+      - name: Require the exact successful diagnostic scope
+        if: always() && steps.diagnostic_case.outcome != 'skipped'
+        env:
+          PROJECT: ${{ matrix.project }}
+        run: |
+          node --input-type=module <<'NODE'
+          import assert from 'node:assert/strict';
+          import fs from 'node:fs';
+          const report = JSON.parse(fs.readFileSync(process.env.GETBASED_KIT_GUARD_REPORT, 'utf8'));
+          assert.equal(report.execution, true);
+          assert.equal(report.status, 'passed');
+          assert.deepEqual(report.issues, []);
+          assert.equal(report.tests.length, 1);
+          const test = report.tests[0];
+          assert.equal(test.file, 'tests/pwa/sveltekit-evolu-runtime.spec.ts');
+          assert.equal(test.project, process.env.PROJECT);
+          assert.equal(test.attemptCount, 1);
+          assert.equal(test.status, 'passed');
+          assert.equal(test.expectedStatus, 'passed');
+          assert.equal(test.declaredExpectedStatus, 'passed');
+          assert.equal(test.outcome, 'expected');
+          for (const annotations of [test.annotations, test.declaredAnnotations]) assert.equal(annotations.some(value => ['skip', 'fixme'].includes(value.type)), false);
+          NODE
+      - name: Label the focused evidence
+        if: always()
+        run: echo 'Focused Cocoa Evolu diagnostics only; the normal release matrix is still required.' >> "$GITHUB_STEP_SUMMARY"
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        if: always()
+        with:
+          name: diagnostic-evolu-${{ matrix.project }}-${{ github.run_id }}
+          path: .local-notes/ci/evolu-diagnostic
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 7

ARCHITECTURE.md

@@ -47,6 +47,19 @@ checks use the fixed inventory in
 
 ## Presentation and lifecycle contract
 
+Foreground modals and the Sync popover cancel optional Dashboard Chat startup,
+including a request still awaiting module or presentation loading; explicit Chat
+actions retain their normal behavior.
+Optional empty-Dashboard Chat startup owns its reservation by render generation
+and profile. Failed loads or a narrower viewport release it; completion from a
+retired render cannot clear a newer reservation.
+Lazy Chat open/toggle requests retain their initiating profile through module
+loading. Panel opening checks that profile and its open intent after each
+asynchronous load, so a deleted profile's pending request cannot initialize a
+conversation on its temporary sync fallback or another selected profile.
+An interrupted visible opening closes only while it still owns the latest open
+intent, leaving a newer opening intact.
+
 `body-measurement-model.ts` owns method-specific waist/hip/SAD field identities
 and validated portable-mirror projection. `wearables-manual.ts` owns their paired
 numeric writes and deletion clocks through the existing encrypted manual-reading
@@ -88,7 +101,9 @@ before dispatch, publication and persistence. Retired controls cannot start new
 or update replacement views. Accepted domain writes can finish for their original
 owner after closure; they must not publish into a new owner's UI or adopt unrelated
 unsaved fields. Domain transactions, locks and explicit field baselines decide
-commit/rollback, not component mount lifetime.
+commit/rollback, not component mount lifetime. A save adopting into a replacement
+object for the same profile uses that object's own read baseline, so stale loaded
+values cannot undo the committed edit and newer unsaved fields remain intact.
 
 Keep credentials and private metadata in dedicated live-field/service ports,
 not general display snapshots or action attributes. Existing explicit Sync recovery
@@ -352,6 +367,14 @@ downgrade is not a database rollback: previous web runtimes cannot open every
 new-format database. The v7 recovery path always retains its separate runtime and
 database identity.
 
+Overlapping forced pushes retain per-profile generations. A newer push supersedes
+older asynchronous planning and completion; a newer saved edit invalidates an
+older plan before its SDK write. Superseded snapshots cannot write stale deltas,
+acknowledge a newer dirty marker or release another push's in-flight guard. A
+superseded plan settles its status before releasing ownership and cannot hide
+another profile's pending send. Manual sync retries the current snapshot within
+its existing deadline.
+
 V3 profile snapshots retain scalar values with per-field edit clocks, so an
 unrelated save cannot give an unchanged scalar a newer clock. Full snapshots
 protect peers whose profile and item-row query updates arrive separately.
@@ -363,13 +386,45 @@ insert contract. Never-configured absent fields do not create clear rows.
 Legacy envelopes retain their profile-clock fallback. Explicit recovery also
 re-emits scalar rows, including clears. Planning or row-mutation failures keep
 local dirty markers queued and stop success confirmation.
+
+Backup recovery acknowledges each committed profile independently before relay
+tombstones can apply. Its journal stays readable by older tabs; generation,
+owner and dirty-token checks prevent an old completion from acknowledging a
+newer restore. Demo and explicitly deleted profiles are not republished.
+Explicit local delete intent acknowledges recovery even after the profile leaves
+the saved list; absence alone never discards a recovery entry.
+Unavailable profiles retain their recovery protection without re-uploading
+completed profiles. A failed progress write retains an in-memory commit receipt;
+automatic failed publishes have a bounded retry budget, reset by an explicit
+Sync now/resume or a newer local edit.
+Identity rotation confirms a durable local recovery journal before changing the
+owner. Failed writes/readback retain the original identity and saved Sync state.
+If the SDK rejects a reset while its actual owner is unchanged, restore the exact
+prior journal only while this operation still owns the staged generation. A
+newer journal or an identity changed before startup failed retains its recovery.
+The staged journal also binds to a domain-separated SHA-256 fingerprint of the
+intended mnemonic; recovery words are never stored in the journal. Every
+acknowledgement preserves that binding. A second tab with an older identity
+defers recovery even while the originating tab is awaiting SDK reset.
+Publishing stays suspended in the retiring runtime until replacement; the
+reloaded owner publishes complete recovery. The old owner/query cache cannot
+acknowledge the new owner's recovery. A deliberate join retargets existing
+pending recovery before SDK reset, with the same owned rollback on failure.
+Startup reconciliation may bypass the in-flight guard but retains the canonical
+payload no-op check; an unchanged startup must not append relay history.
+AI-setting retries stop after a successful unchanged receipt; unavailable
+dirty-marker storage must not silently discard the requested check.
 Profile metadata carries its own item row and durable edit clock; unrelated data rebroadcasts
 retain it. Legacy metadata uses the envelope clock, and equal-clock metadata
 conflicts resolve deterministically. Pulls defer pending local metadata edits
 and ignore exact cached versions replaced by successful local pushes. Successful
 recovery durably advances the local metadata clock; metadata edited while the
 push is pending stays queued with a clock beyond that recovery.
 
+Sync status emits only changed fields. An open status popover updates its
+information in place, retaining action-button identity and keyboard focus so
+replication activity cannot interrupt hover or a click in progress.
+
 The static assembler externalizes Kit's classic bootstrap to satisfy the existing
 CSP without permitting inline executable scripts. It copies only declared public
 assets, retains `/`, `/index.html`, `/app` and `/app/`, and uses the existing