Repository navigation
Merge app/v3 into workstreams/main - #2292
Merged
Merged
Conversation
…d the job bound work there (#2039) * processgroup: read macOS process groups and job subtrees without cgo Members lists a group through kern.proc.pgrp with a bounded retry, and Group.Usage walks the recorded leader's descendants through the kernel's proc_info interface, converting task time with hw.tbfrequency. The new darwinproc package owns the raw trap, the SDK layouts and the argv and listening-socket readers the executor uses next. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * executor: name and port left-running services on macOS cmdline reads kern.procargs2 and the ports come from each member's TCP listeners. describe reads each member's sockets once for both the naming member and the port set. The two service tests run on Linux and macOS, and the listening-service test polls the record until the backgrounded shell has exec'd its server. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: the job subtree bound, and that macOS now applies it Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * processgroup, darwinproc: bound the macOS walk and keep strangers out Review fixes: - A queued parent is re-read after its children are listed and its start time compared, so a pid handed to another process cannot bring that process's children into the job's reading. - A child listing that fills the largest buffer, and a walk that reaches 1024 processes, count as lower bounds; any unexpected listing failure makes the reading unknown instead of partial. - kern.procargs2 is parsed at the kernel's eight-byte boundary after the executable path, so an empty argv[0] can never shift an environment string into argv (checked for path lengths 1-40 on arm64 and under Rosetta). - The listening-service test's shell now waits for the server's port before it exits, so the record the call returns is asserted directly; the membersOf helpers it no longer needs are gone. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * processgroup, session: a partial CPU sum yields no rate Review fix: a reading that left part of the tree out (the walk limit, a truncated child listing, a process that could not be read) still counts processes as a lower bound, but its CPU sum is marked partial. The job bound takes no rate from it and does not use it as the next baseline, so a process missing from one reading and present in the next cannot read as a burst of its whole lifetime's CPU and invent a strike. Linux readings are always complete, so nothing changes there. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * processgroup: a parent that cannot be re-read makes the sum partial Review fix: when a queued parent read once but its re-read after the child listing fails for a reason other than having exited, its children are left out of this reading only, so the CPU sum is marked partial and no rate is taken from it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: number the change entry for #2039 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * processgroup: a child counts only while its parent is still the same Review fix: the macOS walk now reads a parent's listed children first and re-reads the parent after them. A pid is never handed on while its process lives, so a parent with the same start time after its children were read was their parent while they were read; a parent and child whose pids both changed hands just after the parent's own re-read can no longer bring a stranger's busy child into the job's reading. The partial-sum regression now starts from one complete, quiet reading, so it also fails if a partial reading ever keeps that earlier baseline. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* test: specify marking a job pull request ready Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: mark job pull requests ready through the app Reuse the GitHub ready mutation with the caller credential and persist its confirmed draft state before returning. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: cover GitHub ready conflicts and permission refusals Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: preserve definite ready-for-review refusals Keep automatic publication idempotent while explicit ready requests conflict on an already ready PR and preserve GitHub permission refusals. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: pr-ready is a server-owned verb in the client contract Its own serve tests cover it against the real store. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: a draft's merge block now names what readiness waits for Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Take the gated copy of the union merged docs --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…ls (factory.effort_models) (#2148) * factory: a cheap step runs on the small work model, a strong one on the checks model A step's effort word now goes with its conversation, and with no model of the step's or the job's the step opens on the model its effort runs on: models.tiers.low for cheap, models.tiers.high for strong. One model for every task keeps its one model. The app announces factory.effort_models. * changes: name PR 2148 * factory: effort tiers keyed by the one list of effort words * factory: live check of a cheap step on the small work model * factory: a step's effort word comes before the factory's default model Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…b_protected) (#2145) * factory: a Backlog job says which protected paths it names The queue judges every Backlog job against the rules it would start under, read once per repository and show-only, and carries the protected paths its issue, comments, plan or files name. Absent is not judged. The app announces factory.job_protected. * changes: name PR 2145 * factory: live check of the protected key against a real repository * changes: name PR 2145 in the entry * factory: a cheap step runs on the small work model, a strong one on the checks model A step's effort word now goes with its conversation, and with no model of the step's or the job's the step opens on the model its effort runs on: models.tiers.low for cheap, models.tiers.high for strong. One model for every task keeps its one model. The app announces factory.effort_models. * changes: name PR 2148 * factory: judge protected paths only for jobs the canvas shows in Backlog * factory: effort tiers keyed by the one list of effort words * factory: live check of a cheap step on the small work model * factory: a step's effort word comes before the factory's default model Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
… can't succeed doesn't spend (#2256) * factory: a raised budget resumes an Auto job its runner parked at the cap A worker's runner parks at the budget through its ask, and its report puts that question on the desk copy as Asking. raise_budget resumed only when Asking was nil, so for a held job it never resumed. Its Yes on the budget signal was a second answer path that the gate never reached. The raise now treats the open ask as the cap question when QKind is cap and any Asking is that same question. When the new cap clears the spend on an Auto job, the raise answers "continue" through the answer door a person's answer uses (continueCap, taken out of the answer handler). The ask comes down, the ledger keeps budget_changed then answered, and the timeline says the budget was raised. The budget signal now carries only the cap and goes first, so the runner never doubles the old cap. An unheld cap continue had the same gap: KeepAnswer cleared Asking but left the job needing you. AnswerUnheld now queues it through run.ReleaseCap, which the answer handler's own fallback uses as well. Manual jobs, any other open ask, and a raise to the spend or lower stay parked. The new worker tests run against the rig's worker-backed desk. The old test ran on a Manual job through a second handler. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * factory: say the raise resumed only once the continue is answered Review of the raise found two problems. First, the timeline said "carrying on" in the same write as the cap, before the answer door ran. A refused answer then left the job parked with a timeline that said otherwise. The note is now written after the continue is accepted. Second, the answer door's fallback for a cap no runner waits on queued the job whatever it waited on at that moment. A job that moved on to another question between the read and the release lost that question. The release now takes down only a cap question. This commit also adds the change entry and removes a stray test comment. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changes: the raised budget entry carries its PR number Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * factory: a person's continue at the cap queues an unheld job again (test) Pins the second half of the fix: on an unheld Auto job whose copy still carries the cap question as an open ask, a person's continue takes the ask down and queues the job. On the base (39cec14) the job was left needing you with its question; on this branch it is queued. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(factory): preserve ordered budget answers and spending stops Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(factory): a Manual budget raise reaches the next approval Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(factory): a budget raise answers Manual's cap question The Auto-only resume predicate stranded Manual jobs after a raise above spend. Keep Take over and other decisions parked while allowing Manual to reach its next step approval. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: reproduce no-change feedback report escaping correction Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: correct no-change feedback reports in the same conversation Tracked feedback requires a structured current-head assessment. Return omissions at the reporting door while the model can correct them, retaining the clean published-head verifier. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: use the required change entry schema Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: refuse unchanged no-change feedback retries before spending Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: refuse unchanged feedback verification retries before spending Bind the no-change verification refusal to its PR observations in the saved result. Answer and rerun paths retain the question and budget until those facts change; Stop and fresh feedback remain available. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: exercise no-change feedback with a live factory model Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: preserve unpaid retry when a refused checkout is restored Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: recheck refused checkout state before another model call A PR snapshot alone cannot tell whether a rejected checkout was restored. Preserve its content receipt and validate it on the worker without spending; changed contents permit a fresh assessment. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: retain current-head feedback review fences Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: preserve the running state in the live feedback fixture Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* test: require explicit Model Pool opt-in Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep Model Pool off until explicitly enabled Default the shared resolver to off, including CI, while preserving saved choices and environment overrides. Align settings and manual copy and opt pool fixtures in explicitly. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: exercise pool default through production app boot Use the production app opener so the provider and record assertions cover the real pool startup sweep without one-model mode masking it. Explicitly enable the two pool push fixtures. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: explicitly enable pool for exec pending records The restart-sweep fixture intentionally tests pool records; opt it in now that untouched profiles stay off. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * config: Model Pool off says only what the switch does Off stops pool judging and sharing. It does not hold task roles to the chat model: in Auto the router still picks from the allowed models. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…at 1 s ticker (#2255) * knowledge: capture wakes on the chat's own journal writes After #2042 an idle chat's capture tick opened no database, but it still woke every second and opened, read and closed the chat's journal. It was the largest per-chat timer left in an idle engine. The journal writer's hook now wakes capture after each line reaches the file (an in-process signal; no file watch). Each write is followed by one trailing look a second later, a look that moves the cursor is followed by another, so a backlog still moves one batch a second, and a five-second safety tick covers lines another process writes to the same journal and consent changed elsewhere. A look a write woke uses a consent answer at most a second old (CaptureConsentWithin), so a turn written just after consent changed elsewhere is captured on the trailing look. An idle chat now runs one five-second tick and nothing else. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: change entry for #2048 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * knowledge: a new capture scanner always takes one trailing look Review found that a rebind could leave a write without its trailing look: the retired scanner may consume the wake and answer from a consent view under a second old, and the replacement's first look moved nothing, so it armed no trailing look and capture waited for the safety tick. Every scanner now looks once when it starts and once more a second later with fresh consent. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…for branch publication (#2032) Rebased onto app/v3, where #2178 and #2183 already cover most of this branch: the engine-backed fixtures and the hosted take-back's resumed-hold proof. What is left: - the hosted move rig and the drive rig's default daemon keep their homes under /tmp on Unix, because macOS's temporary folder leaves a workspace socket only a few bytes under the address limit; - the L12 death-branches test waits for A's branch row to hold its three orphan turns before it reads them. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
) * remote: an app chat's streamed text is folded before it is framed Every streamed delta of an in-process app chat crossed the remote framing, the in-memory pipe and about eight goroutine handoffs on its own. At 40 tok/s the deltas are 25 ms apart, so the app outbox's 16 ms window never folded anything. Engine.DeltaWindow (opt-in, set by the app's in-process and lent conversations to DefaultDeltaWindow, 33 ms) lets each stream's pump send the first chunk at once and fold the text that follows until the window ends or 4 KiB. Every non-text event sends the held text first and goes out at once; the channel closing flushes before "closed". Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * remote: the delta window's tests cover swap, a real reconnect and a steady stream A swap while text is held lets none of the old conversation through; a real client cut mid-burst and resumed sees each character once; with the production window a quiet tail arrives and a steady producer is never starved. The 4 KiB value is documented as the flush threshold it is, and the latency check keeps its median bound without a per-sample maximum that scheduler pauses could break. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: change entry for #2043 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * remote: the delta window's swap and steady-stream tests stand on their own The swap test drives its own pump and joins only that one, so it no longer depends on the fake agent opening no other lanes. The steady-producer test bounds frames by the time the producer actually took and checks that text reaches the surface before the producer finishes, keeping the largest gap as a diagnostic. The change entry names the conversations it applies to: the ones the desktop's engine holds in process. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* factory: a write step that changed nothing is not done A write round that reported done while the job's checkout had no change from the run's base counted as done, so test and review ran on an untouched tree and only publishing found nothing to commit. The runner now reads the checkout after a write round; with no change, the round does not pass, says "the checkout has no change from where the run began", and goes round again or asks. Other steps may still finish with no change, and an unreadable checkout never holds a round back. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: changelog entry for #2158 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: cover factory write retries against the job base Exercise committed earlier work on rerun, retry after failure and resume after Stop, and retain the refusal for an empty first attempt and rerun. Include the waiting question when the retry fixture misses its failed check. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: keep write retry checks at the Test approval gate Include the following test step so the manual approval is reached, and stop the current step so its recorded attempt can be resumed. Check the retained commit and change through the job reply. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: distinguish stopped writes before and after reporting Compare immediate Stop with Stop after the first running receipt, using the same committed change and wire actions. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: retain the factory write base across stopped attempts Stop can revoke a lease before its first report carries ChangeBase. Keep the original pin on the job branch before edits so its replacement counts earlier committed work instead of comparing against the edited HEAD. Make the three retry fixtures perform their promised write. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: synchronize stopped write reports and refuse an unpinned base Hold periodic reporting on the real lease worker until Stop, then run the replacement with normal reporting. Verify a locked repository config prevents Write from editing before its comparison base is preserved. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: stop a factory round when its base cannot be preserved A repository config lock must not let edits start without their durable comparison pin. Surface the save error before calling the executor. Keep the deterministic replacement worker on the same fixture machine. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: assert the factory preparation failure receipt A failure to preserve the base is an execution preparation error, so read its failed-step detail rather than an out-of-rounds result. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: keep read-only factory checks independent of Git metadata Exercise the exported runner with a real command in a directory without Git metadata, matching the leased-worker fixtures. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: discard failed Git reads before preserving a factory base Git errors include stderr as output. Do not mistake that text for a branch or commit and try to persist it. Keep the existing behavior when Git metadata is unavailable, while refusing an actual base save failure. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Take the gated copy of the union merged docs --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* test: pin one next budget for cap questions and answers Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: give cap questions and answers one allowed next budget Select the smallest allowed cap above recorded spend instead of doubling the old cap. Share budget choices with the runner, job reads and budget edits, and refuse a continue when no higher budget remains. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: keep budget continuation available above thirty dollars Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: offer matching budget continuation beyond thirty dollars The fixed budget ladder returned zero after thirty dollars, trapping jobs. Derive the next cap from the job and accept that exact amount at the factory budget door. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: align cap metadata expectations with the next budget rule The whole-package run found two expectations left on the former doubling and zero-limit rules. Expect the next standard five dollar cap at both public seams. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* test: force task notes to arrive before the final answer ends Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: hold the worker request rather than its helper Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep task directions queued until a worker request reads them Turn cleanup recorded late directions and emptied the queue before the runner checked it. The task could finish with saved notes that no worker request had read. Keep those directions queued for the runner to take another turn and stamp the keyed reads. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: clarify the final-answer note regression fixture Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: distinguish a missing note receipt from lost words Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* test: expose later person requests to the job brief Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: judge job briefs against later person requests Carry gate answers and saved notes into the writer input so requested work is judged against the person’s current request. Preserve bounded requests through input cuts and include them in freshness checks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: prepare paired live brief request probe Compare the same scripted work with and without person requests using the pinned live model. Print checked verdicts and blocks, and reject the false-fault vocabulary seen in the report. The probe is opt-in and left for the caller to run. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: log why a live brief reply ended Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: a live brief names the request in its text The verdict is at most fourteen words and may refer to the request by name. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * manual: say Brief, not the writer's word for its headline Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…#2264) * test: force action reads while a light crew owner opens Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: wait for crew readiness before requiring live process actions Reads deliberately answer saved history while a light owner is opening. Check that nonblocking answer during a forced open, then require live actions after agent.changed instead of depending on scheduler timing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: reproduce preview refusal digits in a factory identity Pin the fixture identity to include 820 so the whole-error wording check fails consistently despite a clean displayed message. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: prove the preview wording guard catches a displayed numeric leak Check only the displayed message and deliberately inject 820 there for the negative control. The following commit removes this test-only mutation after the remote guard verdict. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: keep preview refusal wording checks on the displayed message Remove the negative-control message injection after confirming that the guard rejects 820 in displayed words. Factory identity digits remain deterministic and typed refusal details are still checked separately. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* factory: a write step that changed nothing is not done A write round that reported done while the job's checkout had no change from the run's base counted as done, so test and review ran on an untouched tree and only publishing found nothing to commit. The runner now reads the checkout after a write round; with no change, the round does not pass, says "the checkout has no change from where the run began", and goes round again or asks. Other steps may still finish with no change, and an unreadable checkout never holds a round back. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: changelog entry for #2158 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: reproduce missing memory spend through the vault interface Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: bank memory receipts and bind job compilation to finished turns The compiler used the provider transport without a ledger consumer, while the process worker owned its lifetime independently of jobs. Bank decoded receipts before validation and keep job sources out of independent compilation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: isolate memory snapshots and verify cancellation during compilation Keep compilation boundaries per owner, drain finished-turn journals, and classify older factory conversations from persisted memberships. Preserve projection upgrades and reject a structural bypass that discards the billed context. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: cover retained job sources and large memory snapshots Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: refuse memory admission on paused and published jobs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: drain owned memory snapshots and fence unchanged failed input Reclassify retained job events independently of journal cursors, check stored pause and publication state at admission, and finish every extraction batch in the turn snapshot. New source input or an explicit Build is required to retry failed background compilation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: reject repeated refinement of unchanged memory input Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: require new evidence or explicit build for further memory refinement Record the Build request consumed by each publication so forced flushes on unchanged sources stay idle. Preserve recovery when extraction produced new unpublished evidence, and let an explicit Build advance retained guide work. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: old job ownership excludes background memory Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: retain old factory ownership in memory inventory Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: compile delegated reports with their owning turn Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: use the persisted place layout for delegated memory Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: compile delegated evidence on the owning job turn Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: measure live job memory cost and stage tail delays Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: memory cannot turn successful work into a cap stop Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: preserve successful stage results after deferred spending Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: bound stage memory waits and retain cancelled charges Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: enforce memory cap only at the next unfinished step Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: record completed phases before checking the next budget Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: distinguish memory delay and stop timed-out live jobs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: bound stage memory waits to the owning job lifetime Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: retain skipped stage evidence across job memory handoff Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: recover skipped stage evidence in the next owned memory pass Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: measure late memory receipts after job completion Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep an empty owned source selection empty Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: count overlapping memory waits as wall time Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: attribute memory tail wait to its initiating stage Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: verify live memory starts stay inside the job lifetime Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: stop live measurements with a fresh job version Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: count measured memory calls independently of late prices Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: read measured job spending through the app wire Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: settle cancelled live calls before checking measured spend Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: open live factory brief chats through the in-process app Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: deliver late memory receipts through the real factory worker Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: observe the public ready flag and bound worker fixture cleanup Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Keep job reporting alive for late memory receipts Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Test late memory pricing after stopping a factory job Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Observe finished steps before settling final prices and pin live helpers Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Reconcile paid memory after a stopped job loses its lease Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Keep one accounting anchor per run and retry final settlement Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Test final memory settlement preserves previously counted job spend Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Measure stage answers separately from automatic brief calls Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Report per-job memory dollars and bound delays by the next step start Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Test paid memory survives reopening a finished stage Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Preserve paid usage in a closed stage journal Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Test leased memory receipts during actual factory quit Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Allow bounded accounting settlement after worker cancellation Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Reproduce the memory tail fixture accounting observation race Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Wait for both memory ledger and job accounting in lifecycle fixture The ledger is published before the independent job meter update. Poll both observable totals and name standalone session closure accurately. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Test quitting while final worker accounting is already settling Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Keep bounded accounting alive when quit interrupts settlement Detach the existing settlement context from execution immediately, then cancel it five seconds after quit. This also covers cancellation arriving during the existing receipt wait. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Recognize late journal usage in the append funnel guard The journal is a separate store from artifact indexes. Account for both journal append owners while retaining the guard against unknown append paths. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Reproduce stage budget exemptions and unowned batch draining Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Distinguish memory cap crossings and restore bounded ordinary Flush Keep memory in total job spend while excluding only newly charged memory from completed-round cap checks. Preserve model and tool stops, and retain finite draining only for owned turns. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: reproduce duplicate factory brief charges through the app wire Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 8f8015c20a5e74cd8c73ec68d8fe22b4feb5118e) * fix: charge factory brief calls only at the session billing boundary The session already books each provider receipt to the job and ledger. Keeping a brief charged the job again, including rejected drafts. Preserve session booking so failed saves retain their cost and worker spending remains additive. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit c2938deaf4b3e6ec8eb9c865a58c229663def4ac) * test: audit manager and title charges beside factory briefs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit bb52801b802fd29a1b6889d55461eeeb69e66f87) * test: exercise title billing on an unnamed job-owned conversation Factory managers have a saved title and correctly skip model naming. Use an unnamed stage for the separate title receipt audit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit eee242d5899dd62c6d89e3186a1f83d853a67cda) * test: align the factory keep contract with receipt-based billing Keeping a brief preserves its cost metadata without charging the already billed call again. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 3af433d90bf6809c42152de9b480be3ab3b9e99a) * test: reserve the leased brief fixture for its simulated worker The local factory starts a worker too. Pin the fixture to the remote machine so a local runner cannot win its queued lease when the surrounding suite supplies a runnable configuration. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 4ff25c49ffc450b770045ee8a861156447001cd4) * Declare local memory provenance at the reader boundary Check late memory receipts retain their classified share as well as their total charge. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Use the existing lane import alias for memory accounting Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: check live brief charges against the job header Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: one entry for the brief charge fix Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: the call log's served field names the provider, not the model The recorder already checks the model that answered each call. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: memory crossing the cap does not hide a daily refusal Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * factory: a daily refusal is never read as a memory charge Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: cover factory write retries against the job base Exercise committed earlier work on rerun, retry after failure and resume after Stop, and retain the refusal for an empty first attempt and rerun. Include the waiting question when the retry fixture misses its failed check. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: keep write retry checks at the Test approval gate Include the following test step so the manual approval is reached, and stop the current step so its recorded attempt can be resumed. Check the retained commit and change through the job reply. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: distinguish stopped writes before and after reporting Compare immediate Stop with Stop after the first running receipt, using the same committed change and wire actions. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: retain the factory write base across stopped attempts Stop can revoke a lease before its first report carries ChangeBase. Keep the original pin on the job branch before edits so its replacement counts earlier committed work instead of comparing against the edited HEAD. Make the three retry fixtures perform their promised write. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: synchronize stopped write reports and refuse an unpinned base Hold periodic reporting on the real lease worker until Stop, then run the replacement with normal reporting. Verify a locked repository config prevents Write from editing before its comparison base is preserved. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: stop a factory round when its base cannot be preserved A repository config lock must not let edits start without their durable comparison pin. Surface the save error before calling the executor. Keep the deterministic replacement worker on the same fixture machine. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: assert the factory preparation failure receipt A failure to preserve the base is an execution preparation error, so read its failed-step detail rather than an out-of-rounds result. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: keep read-only factory checks independent of Git metadata Exercise the exported runner with a real command in a directory without Git metadata, matching the leased-worker fixtures. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: discard failed Git reads before preserving a factory base Git errors include stderr as output. Do not mistake that text for a branch or commit and try to persist it. Keep the existing behavior when Git metadata is unavailable, while refusing an actual base save failure. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: reproduce pause after a memory stage tail detaches Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: pin one next budget for cap questions and answers Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: check memory admission when Pause returns Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: complete the paid memory response with valid JSON Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: give cap questions and answers one allowed next budget Select the smallest allowed cap above recorded spend instead of doubling the old cap. Share budget choices with the runner, job reads and budget edits, and refuse a continue when no higher budget remains. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: retain paused memory for a later resumed turn Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: measure live Pause memory and provider receipt totals Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: keep budget continuation available above thirty dollars Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: check settled provider sums and detached memory lifecycle Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: pause live memory after a provider generation starts Document paused memory admission, normal resume, and process-owned shutdown. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: admit local job memory against the owning factory state A worker mirror can still say running after Pause returns. Read the owning local factory for memory admission and cancellation while retaining mirror-based receipt settlement. The job conversation checks that owner before worker mirrors too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: cap resumed memory at one normal scripted pass Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: offer matching budget continuation beyond thirty dollars The fixed budget ladder returned zero after thirty dollars, trapping jobs. Derive the next cap from the job and accept that exact amount at the factory budget door. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: measure only stages that started before Pause A paused job correctly has no conversation identity for its unstarted stages. Skip those stages when measuring memory rather than requiring identities from future work. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: align cap metadata expectations with the next budget rule The whole-package run found two expectations left on the former doubling and zero-limit rules. Expect the next standard five dollar cap at both public seams. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: count a finished memory generation and its receipt once A response can finish at the same time cancellation queues its receipt. Both observations describe the same provider charge, so share the existing once-only charge counter. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: retain unfinished memory after a completed extraction Pending counts unextracted source events. When the already-paid extraction finishes at Pause, those events can be consumed while NeedsUpdate retains the remaining compilation work. Keep the stricter source assertion for interrupted calls. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * memory: name its call tag for the replay law and pass the new scan argument Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: memory fixtures use a step that isn't held for an unchanged checkout A job's write step with no change now waits for a person. These tests are about memory, so their step is plain work. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Take the gated copy of the union merged docs --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* factory: a write step that changed nothing is not done A write round that reported done while the job's checkout had no change from the run's base counted as done, so test and review ran on an untouched tree and only publishing found nothing to commit. The runner now reads the checkout after a write round; with no change, the round does not pass, says "the checkout has no change from where the run began", and goes round again or asks. Other steps may still finish with no change, and an unreadable checkout never holds a round back. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: changelog entry for #2158 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: reproduce missing memory spend through the vault interface Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: bank memory receipts and bind job compilation to finished turns The compiler used the provider transport without a ledger consumer, while the process worker owned its lifetime independently of jobs. Bank decoded receipts before validation and keep job sources out of independent compilation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: isolate memory snapshots and verify cancellation during compilation Keep compilation boundaries per owner, drain finished-turn journals, and classify older factory conversations from persisted memberships. Preserve projection upgrades and reject a structural bypass that discards the billed context. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: cover retained job sources and large memory snapshots Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: refuse memory admission on paused and published jobs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: drain owned memory snapshots and fence unchanged failed input Reclassify retained job events independently of journal cursors, check stored pause and publication state at admission, and finish every extraction batch in the turn snapshot. New source input or an explicit Build is required to retry failed background compilation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: reject repeated refinement of unchanged memory input Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: require new evidence or explicit build for further memory refinement Record the Build request consumed by each publication so forced flushes on unchanged sources stay idle. Preserve recovery when extraction produced new unpublished evidence, and let an explicit Build advance retained guide work. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: old job ownership excludes background memory Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: retain old factory ownership in memory inventory Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: compile delegated reports with their owning turn Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: use the persisted place layout for delegated memory Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: compile delegated evidence on the owning job turn Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: measure live job memory cost and stage tail delays Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: memory cannot turn successful work into a cap stop Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: preserve successful stage results after deferred spending Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: bound stage memory waits and retain cancelled charges Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: enforce memory cap only at the next unfinished step Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: record completed phases before checking the next budget Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: distinguish memory delay and stop timed-out live jobs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: bound stage memory waits to the owning job lifetime Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: retain skipped stage evidence across job memory handoff Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: recover skipped stage evidence in the next owned memory pass Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: measure late memory receipts after job completion Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep an empty owned source selection empty Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: count overlapping memory waits as wall time Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: attribute memory tail wait to its initiating stage Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: verify live memory starts stay inside the job lifetime Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: stop live measurements with a fresh job version Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: count measured memory calls independently of late prices Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: read measured job spending through the app wire Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: settle cancelled live calls before checking measured spend Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: open live factory brief chats through the in-process app Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: deliver late memory receipts through the real factory worker Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: observe the public ready flag and bound worker fixture cleanup Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Keep job reporting alive for late memory receipts Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Test late memory pricing after stopping a factory job Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Observe finished steps before settling final prices and pin live helpers Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Reconcile paid memory after a stopped job loses its lease Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Keep one accounting anchor per run and retry final settlement Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Test final memory settlement preserves previously counted job spend Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Measure stage answers separately from automatic brief calls Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Report per-job memory dollars and bound delays by the next step start Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Test paid memory survives reopening a finished stage Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Preserve paid usage in a closed stage journal Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Test leased memory receipts during actual factory quit Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Allow bounded accounting settlement after worker cancellation Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Reproduce the memory tail fixture accounting observation race Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Wait for both memory ledger and job accounting in lifecycle fixture The ledger is published before the independent job meter update. Poll both observable totals and name standalone session closure accurately. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Test quitting while final worker accounting is already settling Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Keep bounded accounting alive when quit interrupts settlement Detach the existing settlement context from execution immediately, then cancel it five seconds after quit. This also covers cancellation arriving during the existing receipt wait. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Recognize late journal usage in the append funnel guard The journal is a separate store from artifact indexes. Account for both journal append owners while retaining the guard against unknown append paths. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Reproduce stage budget exemptions and unowned batch draining Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Distinguish memory cap crossings and restore bounded ordinary Flush Keep memory in total job spend while excluding only newly charged memory from completed-round cap checks. Preserve model and tool stops, and retain finite draining only for owned turns. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: reproduce duplicate factory brief charges through the app wire Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 8f8015c20a5e74cd8c73ec68d8fe22b4feb5118e) * fix: charge factory brief calls only at the session billing boundary The session already books each provider receipt to the job and ledger. Keeping a brief charged the job again, including rejected drafts. Preserve session booking so failed saves retain their cost and worker spending remains additive. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit c2938deaf4b3e6ec8eb9c865a58c229663def4ac) * test: audit manager and title charges beside factory briefs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit bb52801b802fd29a1b6889d55461eeeb69e66f87) * test: exercise title billing on an unnamed job-owned conversation Factory managers have a saved title and correctly skip model naming. Use an unnamed stage for the separate title receipt audit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit eee242d5899dd62c6d89e3186a1f83d853a67cda) * test: align the factory keep contract with receipt-based billing Keeping a brief preserves its cost metadata without charging the already billed call again. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 3af433d90bf6809c42152de9b480be3ab3b9e99a) * test: reserve the leased brief fixture for its simulated worker The local factory starts a worker too. Pin the fixture to the remote machine so a local runner cannot win its queued lease when the surrounding suite supplies a runnable configuration. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 4ff25c49ffc450b770045ee8a861156447001cd4) * Declare local memory provenance at the reader boundary Check late memory receipts retain their classified share as well as their total charge. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Use the existing lane import alias for memory accounting Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: check live brief charges against the job header Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: one entry for the brief charge fix Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: the call log's served field names the provider, not the model The recorder already checks the model that answered each call. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: memory crossing the cap does not hide a daily refusal Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * factory: a daily refusal is never read as a memory charge Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: cover factory write retries against the job base Exercise committed earlier work on rerun, retry after failure and resume after Stop, and retain the refusal for an empty first attempt and rerun. Include the waiting question when the retry fixture misses its failed check. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: keep write retry checks at the Test approval gate Include the following test step so the manual approval is reached, and stop the current step so its recorded attempt can be resumed. Check the retained commit and change through the job reply. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: distinguish stopped writes before and after reporting Compare immediate Stop with Stop after the first running receipt, using the same committed change and wire actions. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: retain the factory write base across stopped attempts Stop can revoke a lease before its first report carries ChangeBase. Keep the original pin on the job branch before edits so its replacement counts earlier committed work instead of comparing against the edited HEAD. Make the three retry fixtures perform their promised write. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: synchronize stopped write reports and refuse an unpinned base Hold periodic reporting on the real lease worker until Stop, then run the replacement with normal reporting. Verify a locked repository config prevents Write from editing before its comparison base is preserved. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: stop a factory round when its base cannot be preserved A repository config lock must not let edits start without their durable comparison pin. Surface the save error before calling the executor. Keep the deterministic replacement worker on the same fixture machine. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: assert the factory preparation failure receipt A failure to preserve the base is an execution preparation error, so read its failed-step detail rather than an out-of-rounds result. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: keep read-only factory checks independent of Git metadata Exercise the exported runner with a real command in a directory without Git metadata, matching the leased-worker fixtures. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: discard failed Git reads before preserving a factory base Git errors include stderr as output. Do not mistake that text for a branch or commit and try to persist it. Keep the existing behavior when Git metadata is unavailable, while refusing an actual base save failure. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: reproduce pause after a memory stage tail detaches Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: pin one next budget for cap questions and answers Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: check memory admission when Pause returns Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: complete the paid memory response with valid JSON Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: give cap questions and answers one allowed next budget Select the smallest allowed cap above recorded spend instead of doubling the old cap. Share budget choices with the runner, job reads and budget edits, and refuse a continue when no higher budget remains. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: retain paused memory for a later resumed turn Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: measure live Pause memory and provider receipt totals Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: keep budget continuation available above thirty dollars Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: check settled provider sums and detached memory lifecycle Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: pause live memory after a provider generation starts Document paused memory admission, normal resume, and process-owned shutdown. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: admit local job memory against the owning factory state A worker mirror can still say running after Pause returns. Read the owning local factory for memory admission and cancellation while retaining mirror-based receipt settlement. The job conversation checks that owner before worker mirrors too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: cap resumed memory at one normal scripted pass Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: offer matching budget continuation beyond thirty dollars The fixed budget ladder returned zero after thirty dollars, trapping jobs. Derive the next cap from the job and accept that exact amount at the factory budget door. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: measure only stages that started before Pause A paused job correctly has no conversation identity for its unstarted stages. Skip those stages when measuring memory rather than requiring identities from future work. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: align cap metadata expectations with the next budget rule The whole-package run found two expectations left on the former doubling and zero-limit rules. Expect the next standard five dollar cap at both public seams. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: count a finished memory generation and its receipt once A response can finish at the same time cancellation queues its receipt. Both observations describe the same provider charge, so share the existing once-only charge counter. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: retain unfinished memory after a completed extraction Pending counts unextracted source events. When the already-paid extraction finishes at Pause, those events can be consumed while NeedsUpdate retains the remaining compilation work. Keep the stricter source assertion for interrupted calls. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: require explicit memory consent through settings Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: require explicit consent for automatic memory Use memory.enabled for both noticing and knowledge compilation. Empty history no longer grants consent; saved choices remain live across open chats and jobs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: cover fresh app memory calls through job and chat Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: stop memory requests while keeping saved knowledge available Gate compiler requests and noticing retries on the live setting. Keep saved pages readable while off and retain pending builds across a switch. Prepare explicit-on billing fixtures and a capped live off test. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: require zero new memory requests after switching off Align remaining manual references with the shared learning switch and count request starts exactly. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: verify fresh app leaves knowledge consent unset Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * memory: cost words say it varies, and the manual names the job's switch Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * memory: name its call tag for the replay law and pass the new scan argument Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: memory fixtures use a step that isn't held for an unchanged checkout A job's write step with no change now waits for a person. These tests are about memory, so their step is plain work. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: the live memory measure waits for the last brief before reading the header Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: fixtures that exercise automatic memory turn it on Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: the switch test reads the one cost note, and its job step is plain work Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * memory: a store that can't open says why, not that memory is off The switch makes off a real state, so this refusal must not read as the person's choice. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: a first start with memory off must still be able to join Red: the off pass records its job as unbuilt, and the join check only knows waiting. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * identity: a memory-off first start counts as a first start A person who starts fresh with memory off could not join an organization, because the home read as holding work. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * settings: memory's detail says again that nothing saved is deleted Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* test: reproduce tombstone lookup panic on vault read failure Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: return vault read errors before checking tombstones Deleted dereferenced a nil document when a valid vault handle failed to read its backing file. Return the read error so sync can retry instead of terminating its worker. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: clarify previous and current vault read failure behavior Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * manual: name the vault read failure section by what it covers Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* test: two engines on one home must not both start Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * app: one engine on a home; a second waits for the first to end Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: a waiting engine starts nothing, and a child doesn't hold the home Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* factory: a write step that changed nothing is not done A write round that reported done while the job's checkout had no change from the run's base counted as done, so test and review ran on an untouched tree and only publishing found nothing to commit. The runner now reads the checkout after a write round; with no change, the round does not pass, says "the checkout has no change from where the run began", and goes round again or asks. Other steps may still finish with no change, and an unreadable checkout never holds a round back. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: changelog entry for #2158 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: reproduce missing memory spend through the vault interface Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: bank memory receipts and bind job compilation to finished turns The compiler used the provider transport without a ledger consumer, while the process worker owned its lifetime independently of jobs. Bank decoded receipts before validation and keep job sources out of independent compilation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: isolate memory snapshots and verify cancellation during compilation Keep compilation boundaries per owner, drain finished-turn journals, and classify older factory conversations from persisted memberships. Preserve projection upgrades and reject a structural bypass that discards the billed context. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: cover retained job sources and large memory snapshots Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: refuse memory admission on paused and published jobs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: drain owned memory snapshots and fence unchanged failed input Reclassify retained job events independently of journal cursors, check stored pause and publication state at admission, and finish every extraction batch in the turn snapshot. New source input or an explicit Build is required to retry failed background compilation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: reject repeated refinement of unchanged memory input Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: require new evidence or explicit build for further memory refinement Record the Build request consumed by each publication so forced flushes on unchanged sources stay idle. Preserve recovery when extraction produced new unpublished evidence, and let an explicit Build advance retained guide work. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: old job ownership excludes background memory Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: retain old factory ownership in memory inventory Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: compile delegated reports with their owning turn Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: use the persisted place layout for delegated memory Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: compile delegated evidence on the owning job turn Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: measure live job memory cost and stage tail delays Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: memory cannot turn successful work into a cap stop Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: preserve successful stage results after deferred spending Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: bound stage memory waits and retain cancelled charges Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: enforce memory cap only at the next unfinished step Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: record completed phases before checking the next budget Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: distinguish memory delay and stop timed-out live jobs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: bound stage memory waits to the owning job lifetime Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: retain skipped stage evidence across job memory handoff Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: recover skipped stage evidence in the next owned memory pass Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: measure late memory receipts after job completion Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep an empty owned source selection empty Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: count overlapping memory waits as wall time Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: attribute memory tail wait to its initiating stage Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: verify live memory starts stay inside the job lifetime Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: stop live measurements with a fresh job version Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: count measured memory calls independently of late prices Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: read measured job spending through the app wire Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: settle cancelled live calls before checking measured spend Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: open live factory brief chats through the in-process app Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: deliver late memory receipts through the real factory worker Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: observe the public ready flag and bound worker fixture cleanup Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Keep job reporting alive for late memory receipts Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Test late memory pricing after stopping a factory job Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Observe finished steps before settling final prices and pin live helpers Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Reconcile paid memory after a stopped job loses its lease Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Keep one accounting anchor per run and retry final settlement Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Test final memory settlement preserves previously counted job spend Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Measure stage answers separately from automatic brief calls Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Report per-job memory dollars and bound delays by the next step start Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Test paid memory survives reopening a finished stage Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Preserve paid usage in a closed stage journal Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Test leased memory receipts during actual factory quit Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Allow bounded accounting settlement after worker cancellation Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Reproduce the memory tail fixture accounting observation race Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Wait for both memory ledger and job accounting in lifecycle fixture The ledger is published before the independent job meter update. Poll both observable totals and name standalone session closure accurately. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Test quitting while final worker accounting is already settling Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Keep bounded accounting alive when quit interrupts settlement Detach the existing settlement context from execution immediately, then cancel it five seconds after quit. This also covers cancellation arriving during the existing receipt wait. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Recognize late journal usage in the append funnel guard The journal is a separate store from artifact indexes. Account for both journal append owners while retaining the guard against unknown append paths. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Reproduce stage budget exemptions and unowned batch draining Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Distinguish memory cap crossings and restore bounded ordinary Flush Keep memory in total job spend while excluding only newly charged memory from completed-round cap checks. Preserve model and tool stops, and retain finite draining only for owned turns. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: reproduce duplicate factory brief charges through the app wire Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 8f8015c20a5e74cd8c73ec68d8fe22b4feb5118e) * fix: charge factory brief calls only at the session billing boundary The session already books each provider receipt to the job and ledger. Keeping a brief charged the job again, including rejected drafts. Preserve session booking so failed saves retain their cost and worker spending remains additive. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit c2938deaf4b3e6ec8eb9c865a58c229663def4ac) * test: audit manager and title charges beside factory briefs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit bb52801b802fd29a1b6889d55461eeeb69e66f87) * test: exercise title billing on an unnamed job-owned conversation Factory managers have a saved title and correctly skip model naming. Use an unnamed stage for the separate title receipt audit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit eee242d5899dd62c6d89e3186a1f83d853a67cda) * test: align the factory keep contract with receipt-based billing Keeping a brief preserves its cost metadata without charging the already billed call again. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 3af433d90bf6809c42152de9b480be3ab3b9e99a) * test: reserve the leased brief fixture for its simulated worker The local factory starts a worker too. Pin the fixture to the remote machine so a local runner cannot win its queued lease when the surrounding suite supplies a runnable configuration. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 4ff25c49ffc450b770045ee8a861156447001cd4) * Declare local memory provenance at the reader boundary Check late memory receipts retain their classified share as well as their total charge. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Use the existing lane import alias for memory accounting Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: check live brief charges against the job header Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: one entry for the brief charge fix Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: the call log's served field names the provider, not the model The recorder already checks the model that answered each call. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: memory crossing the cap does not hide a daily refusal Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * factory: a daily refusal is never read as a memory charge Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: cover factory write retries against the job base Exercise committed earlier work on rerun, retry after failure and resume after Stop, and retain the refusal for an empty first attempt and rerun. Include the waiting question when the retry fixture misses its failed check. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: keep write retry checks at the Test approval gate Include the following test step so the manual approval is reached, and stop the current step so its recorded attempt can be resumed. Check the retained commit and change through the job reply. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: distinguish stopped writes before and after reporting Compare immediate Stop with Stop after the first running receipt, using the same committed change and wire actions. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: retain the factory write base across stopped attempts Stop can revoke a lease before its first report carries ChangeBase. Keep the original pin on the job branch before edits so its replacement counts earlier committed work instead of comparing against the edited HEAD. Make the three retry fixtures perform their promised write. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: synchronize stopped write reports and refuse an unpinned base Hold periodic reporting on the real lease worker until Stop, then run the replacement with normal reporting. Verify a locked repository config prevents Write from editing before its comparison base is preserved. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: stop a factory round when its base cannot be preserved A repository config lock must not let edits start without their durable comparison pin. Surface the save error before calling the executor. Keep the deterministic replacement worker on the same fixture machine. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: assert the factory preparation failure receipt A failure to preserve the base is an execution preparation error, so read its failed-step detail rather than an out-of-rounds result. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: keep read-only factory checks independent of Git metadata Exercise the exported runner with a real command in a directory without Git metadata, matching the leased-worker fixtures. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: discard failed Git reads before preserving a factory base Git errors include stderr as output. Do not mistake that text for a branch or commit and try to persist it. Keep the existing behavior when Git metadata is unavailable, while refusing an actual base save failure. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: reproduce pause after a memory stage tail detaches Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: pin one next budget for cap questions and answers Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: check memory admission when Pause returns Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: complete the paid memory response with valid JSON Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: give cap questions and answers one allowed next budget Select the smallest allowed cap above recorded spend instead of doubling the old cap. Share budget choices with the runner, job reads and budget edits, and refuse a continue when no higher budget remains. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: retain paused memory for a later resumed turn Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: measure live Pause memory and provider receipt totals Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: keep budget continuation available above thirty dollars Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: check settled provider sums and detached memory lifecycle Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: pause live memory after a provider generation starts Document paused memory admission, normal resume, and process-owned shutdown. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: admit local job memory against the owning factory state A worker mirror can still say running after Pause returns. Read the owning local factory for memory admission and cancellation while retaining mirror-based receipt settlement. The job conversation checks that owner before worker mirrors too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: cap resumed memory at one normal scripted pass Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: offer matching budget continuation beyond thirty dollars The fixed budget ladder returned zero after thirty dollars, trapping jobs. Derive the next cap from the job and accept that exact amount at the factory budget door. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: measure only stages that started before Pause A paused job correctly has no conversation identity for its unstarted stages. Skip those stages when measuring memory rather than requiring identities from future work. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: align cap metadata expectations with the next budget rule The whole-package run found two expectations left on the former doubling and zero-limit rules. Expect the next standard five dollar cap at both public seams. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: count a finished memory generation and its receipt once A response can finish at the same time cancellation queues its receipt. Both observations describe the same provider charge, so share the existing once-only charge counter. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: retain unfinished memory after a completed extraction Pending counts unextracted source events. When the already-paid extraction finishes at Pause, those events can be consumed while NeedsUpdate retains the remaining compilation work. Keep the stricter source assertion for interrupted calls. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: reproduce missing factory charge settlement Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: settle factory charges from final provider receipts Interim stream usage suppressed reconciliation even when no session billing sink could consume it. Factory calls now recover the final receipt and retain unknown-price ownership. Write through ledger overflow without holding a turn indefinitely. Memory keeps its existing billing path. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: snapshot pending overflow writes across ledger flushes Capture completion barriers without racing WaitGroup reuse. A full queue cannot certify a successful flush; it reports false under the existing deadline instead. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: keep unpriced factory receipts visibly unknown Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep factory token-only receipts unbilled A receipt with token counts but no provider price cannot establish a dollar charge. Final-price consumers now retain the existing unknown-price marker instead of treating those counts as a settled bill. Other receipt consumers remain unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * memory: name its call tag for the replay law and pass the new scan argument Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: memory fixtures use a step that isn't held for an unchanged checkout A job's write step with no change now waits for a person. These tests are about memory, so their step is plain work. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * spend: a full usage queue never makes a turn wait The 100 ms per overflow row added up on a stalled disk and broke the ledger's turn law. One background writer takes overflow rows instead. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * spend: the ledger's one writer takes overflow rows, in order Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * spend: format the ledger writer Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * spend: a full queue's flush waits for the kept rows instead of reporting false Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * spend: wake the ledger writer when a row is kept after it emptied the queue Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * spend: an answer with no usage doesn't hold the job's next step for its receipt Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Take the gated copy of the union merged docs --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
#2275) * factory: a write step that changed nothing is not done A write round that reported done while the job's checkout had no change from the run's base counted as done, so test and review ran on an untouched tree and only publishing found nothing to commit. The runner now reads the checkout after a write round; with no change, the round does not pass, says "the checkout has no change from where the run began", and goes round again or asks. Other steps may still finish with no change, and an unreadable checkout never holds a round back. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: changelog entry for #2158 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: reproduce missing memory spend through the vault interface Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: bank memory receipts and bind job compilation to finished turns The compiler used the provider transport without a ledger consumer, while the process worker owned its lifetime independently of jobs. Bank decoded receipts before validation and keep job sources out of independent compilation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: isolate memory snapshots and verify cancellation during compilation Keep compilation boundaries per owner, drain finished-turn journals, and classify older factory conversations from persisted memberships. Preserve projection upgrades and reject a structural bypass that discards the billed context. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: cover retained job sources and large memory snapshots Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: refuse memory admission on paused and published jobs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: drain owned memory snapshots and fence unchanged failed input Reclassify retained job events independently of journal cursors, check stored pause and publication state at admission, and finish every extraction batch in the turn snapshot. New source input or an explicit Build is required to retry failed background compilation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: reject repeated refinement of unchanged memory input Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: require new evidence or explicit build for further memory refinement Record the Build request consumed by each publication so forced flushes on unchanged sources stay idle. Preserve recovery when extraction produced new unpublished evidence, and let an explicit Build advance retained guide work. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: old job ownership excludes background memory Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: retain old factory ownership in memory inventory Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: compile delegated reports with their owning turn Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: use the persisted place layout for delegated memory Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: compile delegated evidence on the owning job turn Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: measure live job memory cost and stage tail delays Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: memory cannot turn successful work into a cap stop Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: preserve successful stage results after deferred spending Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: bound stage memory waits and retain cancelled charges Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: enforce memory cap only at the next unfinished step Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: record completed phases before checking the next budget Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: distinguish memory delay and stop timed-out live jobs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: bound stage memory waits to the owning job lifetime Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: retain skipped stage evidence across job memory handoff Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: recover skipped stage evidence in the next owned memory pass Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: measure late memory receipts after job completion Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep an empty owned source selection empty Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: count overlapping memory waits as wall time Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: attribute memory tail wait to its initiating stage Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: verify live memory starts stay inside the job lifetime Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: stop live measurements with a fresh job version Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: count measured memory calls independently of late prices Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: read measured job spending through the app wire Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: settle cancelled live calls before checking measured spend Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: open live factory brief chats through the in-process app Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: deliver late memory receipts through the real factory worker Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: observe the public ready flag and bound worker fixture cleanup Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Keep job reporting alive for late memory receipts Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Test late memory pricing after stopping a factory job Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Observe finished steps before settling final prices and pin live helpers Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Reconcile paid memory after a stopped job loses its lease Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Keep one accounting anchor per run and retry final settlement Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Test final memory settlement preserves previously counted job spend Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Measure stage answers separately from automatic brief calls Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Report per-job memory dollars and bound delays by the next step start Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Test paid memory survives reopening a finished stage Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Preserve paid usage in a closed stage journal Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Test leased memory receipts during actual factory quit Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Allow bounded accounting settlement after worker cancellation Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Reproduce the memory tail fixture accounting observation race Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Wait for both memory ledger and job accounting in lifecycle fixture The ledger is published before the independent job meter update. Poll both observable totals and name standalone session closure accurately. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Test quitting while final worker accounting is already settling Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Keep bounded accounting alive when quit interrupts settlement Detach the existing settlement context from execution immediately, then cancel it five seconds after quit. This also covers cancellation arriving during the existing receipt wait. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Recognize late journal usage in the append funnel guard The journal is a separate store from artifact indexes. Account for both journal append owners while retaining the guard against unknown append paths. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Reproduce stage budget exemptions and unowned batch draining Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Distinguish memory cap crossings and restore bounded ordinary Flush Keep memory in total job spend while excluding only newly charged memory from completed-round cap checks. Preserve model and tool stops, and retain finite draining only for owned turns. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: reproduce duplicate factory brief charges through the app wire Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 8f8015c20a5e74cd8c73ec68d8fe22b4feb5118e) * fix: charge factory brief calls only at the session billing boundary The session already books each provider receipt to the job and ledger. Keeping a brief charged the job again, including rejected drafts. Preserve session booking so failed saves retain their cost and worker spending remains additive. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit c2938deaf4b3e6ec8eb9c865a58c229663def4ac) * test: audit manager and title charges beside factory briefs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit bb52801b802fd29a1b6889d55461eeeb69e66f87) * test: exercise title billing on an unnamed job-owned conversation Factory managers have a saved title and correctly skip model naming. Use an unnamed stage for the separate title receipt audit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit eee242d5899dd62c6d89e3186a1f83d853a67cda) * test: align the factory keep contract with receipt-based billing Keeping a brief preserves its cost metadata without charging the already billed call again. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 3af433d90bf6809c42152de9b480be3ab3b9e99a) * test: reserve the leased brief fixture for its simulated worker The local factory starts a worker too. Pin the fixture to the remote machine so a local runner cannot win its queued lease when the surrounding suite supplies a runnable configuration. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 4ff25c49ffc450b770045ee8a861156447001cd4) * Declare local memory provenance at the reader boundary Check late memory receipts retain their classified share as well as their total charge. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Use the existing lane import alias for memory accounting Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: check live brief charges against the job header Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: one entry for the brief charge fix Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: the call log's served field names the provider, not the model The recorder already checks the model that answered each call. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: memory crossing the cap does not hide a daily refusal Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * factory: a daily refusal is never read as a memory charge Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: cover factory write retries against the job base Exercise committed earlier work on rerun, retry after failure and resume after Stop, and retain the refusal for an empty first attempt and rerun. Include the waiting question when the retry fixture misses its failed check. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: keep write retry checks at the Test approval gate Include the following test step so the manual approval is reached, and stop the current step so its recorded attempt can be resumed. Check the retained commit and change through the job reply. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: distinguish stopped writes before and after reporting Compare immediate Stop with Stop after the first running receipt, using the same committed change and wire actions. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: retain the factory write base across stopped attempts Stop can revoke a lease before its first report carries ChangeBase. Keep the original pin on the job branch before edits so its replacement counts earlier committed work instead of comparing against the edited HEAD. Make the three retry fixtures perform their promised write. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: synchronize stopped write reports and refuse an unpinned base Hold periodic reporting on the real lease worker until Stop, then run the replacement with normal reporting. Verify a locked repository config prevents Write from editing before its comparison base is preserved. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: stop a factory round when its base cannot be preserved A repository config lock must not let edits start without their durable comparison pin. Surface the save error before calling the executor. Keep the deterministic replacement worker on the same fixture machine. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: assert the factory preparation failure receipt A failure to preserve the base is an execution preparation error, so read its failed-step detail rather than an out-of-rounds result. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: keep read-only factory checks independent of Git metadata Exercise the exported runner with a real command in a directory without Git metadata, matching the leased-worker fixtures. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: discard failed Git reads before preserving a factory base Git errors include stderr as output. Do not mistake that text for a branch or commit and try to persist it. Keep the existing behavior when Git metadata is unavailable, while refusing an actual base save failure. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: reproduce pause after a memory stage tail detaches Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: pin one next budget for cap questions and answers Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: check memory admission when Pause returns Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: complete the paid memory response with valid JSON Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: give cap questions and answers one allowed next budget Select the smallest allowed cap above recorded spend instead of doubling the old cap. Share budget choices with the runner, job reads and budget edits, and refuse a continue when no higher budget remains. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: retain paused memory for a later resumed turn Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: measure live Pause memory and provider receipt totals Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: keep budget continuation available above thirty dollars Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: check settled provider sums and detached memory lifecycle Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: pause live memory after a provider generation starts Document paused memory admission, normal resume, and process-owned shutdown. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: admit local job memory against the owning factory state A worker mirror can still say running after Pause returns. Read the owning local factory for memory admission and cancellation while retaining mirror-based receipt settlement. The job conversation checks that owner before worker mirrors too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: cap resumed memory at one normal scripted pass Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: offer matching budget continuation beyond thirty dollars The fixed budget ladder returned zero after thirty dollars, trapping jobs. Derive the next cap from the job and accept that exact amount at the factory budget door. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: measure only stages that started before Pause A paused job correctly has no conversation identity for its unstarted stages. Skip those stages when measuring memory rather than requiring identities from future work. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: align cap metadata expectations with the next budget rule The whole-package run found two expectations left on the former doubling and zero-limit rules. Expect the next standard five dollar cap at both public seams. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: count a finished memory generation and its receipt once A response can finish at the same time cancellation queues its receipt. Both observations describe the same provider charge, so share the existing once-only charge counter. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: retain unfinished memory after a completed extraction Pending counts unextracted source events. When the already-paid extraction finishes at Pause, those events can be consumed while NeedsUpdate retains the remaining compilation work. Keep the stricter source assertion for interrupted calls. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: reproduce missing factory charge settlement Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: settle factory charges from final provider receipts Interim stream usage suppressed reconciliation even when no session billing sink could consume it. Factory calls now recover the final receipt and retain unknown-price ownership. Write through ledger overflow without holding a turn indefinitely. Memory keeps its existing billing path. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: snapshot pending overflow writes across ledger flushes Capture completion barriers without racing WaitGroup reuse. A full queue cannot certify a successful flush; it reports false under the existing deadline instead. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: keep unpriced factory receipts visibly unknown Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep factory token-only receipts unbilled A receipt with token counts but no provider price cannot establish a dollar charge. Final-price consumers now retain the existing unknown-price marker instead of treating those counts as a settled bill. Other receipt consumers remain unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * memory: name its call tag for the replay law and pass the new scan argument Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: memory fixtures use a step that isn't held for an unchanged checkout A job's write step with no change now waits for a person. These tests are about memory, so their step is plain work. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: a ledger row with no turn must move today's figure Red: spend.changed fires only when a chat turn ends, so Factory triage, scouts and page AI never reach the page. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * spend: today's figure moves when any ledger row lands, not only when a turn ends Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * spend: a full usage queue never makes a turn wait The 100 ms per overflow row added up on a stalled disk and broke the ledger's turn law. One background writer takes overflow rows instead. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * spend: overflow rows move today's figure too Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * spend: the ledger's one writer takes overflow rows, in order Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * spend: finish the merge of the ledger writer Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * spend: format the ledger writer Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * spend: format the ledger writer Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * spend: drop the merge's duplicated writer loop Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * spend: a full queue's flush waits for the kept rows instead of reporting false Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * spend: spend.today names Factory AI, so triage, scouts and page AI aren't called chats Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name what changed Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * spend: wake the ledger writer when a row is kept after it emptied the queue Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * spend: an answer with no usage doesn't hold the job's next step for its receipt Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* factory: a write step that changed nothing is not done A write round that reported done while the job's checkout had no change from the run's base counted as done, so test and review ran on an untouched tree and only publishing found nothing to commit. The runner now reads the checkout after a write round; with no change, the round does not pass, says "the checkout has no change from where the run began", and goes round again or asks. Other steps may still finish with no change, and an unreadable checkout never holds a round back. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: changelog entry for #2158 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: reproduce missing memory spend through the vault interface Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: bank memory receipts and bind job compilation to finished turns The compiler used the provider transport without a ledger consumer, while the process worker owned its lifetime independently of jobs. Bank decoded receipts before validation and keep job sources out of independent compilation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: isolate memory snapshots and verify cancellation during compilation Keep compilation boundaries per owner, drain finished-turn journals, and classify older factory conversations from persisted memberships. Preserve projection upgrades and reject a structural bypass that discards the billed context. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: cover retained job sources and large memory snapshots Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: refuse memory admission on paused and published jobs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: drain owned memory snapshots and fence unchanged failed input Reclassify retained job events independently of journal cursors, check stored pause and publication state at admission, and finish every extraction batch in the turn snapshot. New source input or an explicit Build is required to retry failed background compilation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: reject repeated refinement of unchanged memory input Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: require new evidence or explicit build for further memory refinement Record the Build request consumed by each publication so forced flushes on unchanged sources stay idle. Preserve recovery when extraction produced new unpublished evidence, and let an explicit Build advance retained guide work. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: old job ownership excludes background memory Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: retain old factory ownership in memory inventory Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: compile delegated reports with their owning turn Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: use the persisted place layout for delegated memory Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: compile delegated evidence on the owning job turn Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: measure live job memory cost and stage tail delays Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: memory cannot turn successful work into a cap stop Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: preserve successful stage results after deferred spending Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: bound stage memory waits and retain cancelled charges Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: enforce memory cap only at the next unfinished step Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: record completed phases before checking the next budget Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: distinguish memory delay and stop timed-out live jobs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: bound stage memory waits to the owning job lifetime Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: retain skipped stage evidence across job memory handoff Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: recover skipped stage evidence in the next owned memory pass Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: measure late memory receipts after job completion Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep an empty owned source selection empty Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: count overlapping memory waits as wall time Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: attribute memory tail wait to its initiating stage Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: verify live memory starts stay inside the job lifetime Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: stop live measurements with a fresh job version Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: count measured memory calls independently of late prices Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: read measured job spending through the app wire Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: settle cancelled live calls before checking measured spend Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: open live factory brief chats through the in-process app Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: deliver late memory receipts through the real factory worker Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: observe the public ready flag and bound worker fixture cleanup Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Keep job reporting alive for late memory receipts Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Test late memory pricing after stopping a factory job Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Observe finished steps before settling final prices and pin live helpers Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Reconcile paid memory after a stopped job loses its lease Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Keep one accounting anchor per run and retry final settlement Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Test final memory settlement preserves previously counted job spend Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Measure stage answers separately from automatic brief calls Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Report per-job memory dollars and bound delays by the next step start Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Test paid memory survives reopening a finished stage Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Preserve paid usage in a closed stage journal Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Test leased memory receipts during actual factory quit Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Allow bounded accounting settlement after worker cancellation Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Reproduce the memory tail fixture accounting observation race Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Wait for both memory ledger and job accounting in lifecycle fixture The ledger is published before the independent job meter update. Poll both observable totals and name standalone session closure accurately. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Test quitting while final worker accounting is already settling Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Keep bounded accounting alive when quit interrupts settlement Detach the existing settlement context from execution immediately, then cancel it five seconds after quit. This also covers cancellation arriving during the existing receipt wait. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Recognize late journal usage in the append funnel guard The journal is a separate store from artifact indexes. Account for both journal append owners while retaining the guard against unknown append paths. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Reproduce stage budget exemptions and unowned batch draining Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Distinguish memory cap crossings and restore bounded ordinary Flush Keep memory in total job spend while excluding only newly charged memory from completed-round cap checks. Preserve model and tool stops, and retain finite draining only for owned turns. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: reproduce duplicate factory brief charges through the app wire Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 8f8015c20a5e74cd8c73ec68d8fe22b4feb5118e) * fix: charge factory brief calls only at the session billing boundary The session already books each provider receipt to the job and ledger. Keeping a brief charged the job again, including rejected drafts. Preserve session booking so failed saves retain their cost and worker spending remains additive. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit c2938deaf4b3e6ec8eb9c865a58c229663def4ac) * test: audit manager and title charges beside factory briefs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit bb52801b802fd29a1b6889d55461eeeb69e66f87) * test: exercise title billing on an unnamed job-owned conversation Factory managers have a saved title and correctly skip model naming. Use an unnamed stage for the separate title receipt audit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit eee242d5899dd62c6d89e3186a1f83d853a67cda) * test: align the factory keep contract with receipt-based billing Keeping a brief preserves its cost metadata without charging the already billed call again. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 3af433d90bf6809c42152de9b480be3ab3b9e99a) * test: reserve the leased brief fixture for its simulated worker The local factory starts a worker too. Pin the fixture to the remote machine so a local runner cannot win its queued lease when the surrounding suite supplies a runnable configuration. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 4ff25c49ffc450b770045ee8a861156447001cd4) * Declare local memory provenance at the reader boundary Check late memory receipts retain their classified share as well as their total charge. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Use the existing lane import alias for memory accounting Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: check live brief charges against the job header Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: one entry for the brief charge fix Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: the call log's served field names the provider, not the model The recorder already checks the model that answered each call. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: memory crossing the cap does not hide a daily refusal Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * factory: a daily refusal is never read as a memory charge Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: cover factory write retries against the job base Exercise committed earlier work on rerun, retry after failure and resume after Stop, and retain the refusal for an empty first attempt and rerun. Include the waiting question when the retry fixture misses its failed check. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: keep write retry checks at the Test approval gate Include the following test step so the manual approval is reached, and stop the current step so its recorded attempt can be resumed. Check the retained commit and change through the job reply. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: distinguish stopped writes before and after reporting Compare immediate Stop with Stop after the first running receipt, using the same committed change and wire actions. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: retain the factory write base across stopped attempts Stop can revoke a lease before its first report carries ChangeBase. Keep the original pin on the job branch before edits so its replacement counts earlier committed work instead of comparing against the edited HEAD. Make the three retry fixtures perform their promised write. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: synchronize stopped write reports and refuse an unpinned base Hold periodic reporting on the real lease worker until Stop, then run the replacement with normal reporting. Verify a locked repository config prevents Write from editing before its comparison base is preserved. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: stop a factory round when its base cannot be preserved A repository config lock must not let edits start without their durable comparison pin. Surface the save error before calling the executor. Keep the deterministic replacement worker on the same fixture machine. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: assert the factory preparation failure receipt A failure to preserve the base is an execution preparation error, so read its failed-step detail rather than an out-of-rounds result. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: keep read-only factory checks independent of Git metadata Exercise the exported runner with a real command in a directory without Git metadata, matching the leased-worker fixtures. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: discard failed Git reads before preserving a factory base Git errors include stderr as output. Do not mistake that text for a branch or commit and try to persist it. Keep the existing behavior when Git metadata is unavailable, while refusing an actual base save failure. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: reproduce pause after a memory stage tail detaches Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: pin one next budget for cap questions and answers Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: check memory admission when Pause returns Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: complete the paid memory response with valid JSON Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: give cap questions and answers one allowed next budget Select the smallest allowed cap above recorded spend instead of doubling the old cap. Share budget choices with the runner, job reads and budget edits, and refuse a continue when no higher budget remains. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: retain paused memory for a later resumed turn Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: measure live Pause memory and provider receipt totals Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: keep budget continuation available above thirty dollars Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: check settled provider sums and detached memory lifecycle Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: pause live memory after a provider generation starts Document paused memory admission, normal resume, and process-owned shutdown. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: admit local job memory against the owning factory state A worker mirror can still say running after Pause returns. Read the owning local factory for memory admission and cancellation while retaining mirror-based receipt settlement. The job conversation checks that owner before worker mirrors too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: cap resumed memory at one normal scripted pass Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: offer matching budget continuation beyond thirty dollars The fixed budget ladder returned zero after thirty dollars, trapping jobs. Derive the next cap from the job and accept that exact amount at the factory budget door. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: measure only stages that started before Pause A paused job correctly has no conversation identity for its unstarted stages. Skip those stages when measuring memory rather than requiring identities from future work. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: align cap metadata expectations with the next budget rule The whole-package run found two expectations left on the former doubling and zero-limit rules. Expect the next standard five dollar cap at both public seams. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: count a finished memory generation and its receipt once A response can finish at the same time cancellation queues its receipt. Both observations describe the same provider charge, so share the existing once-only charge counter. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: retain unfinished memory after a completed extraction Pending counts unextracted source events. When the already-paid extraction finishes at Pause, those events can be consumed while NeedsUpdate retains the remaining compilation work. Keep the stricter source assertion for interrupted calls. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: expose lost Factory page charges on failed generations Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: give Factory scout a real checkout in spending fixture Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: bank Factory page charges before handling failed generations Record provider billing events because failed generations may return no response. Use the returned response only when no event was banked, so success counts once. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: require an exact ledger-owner inventory for production model sends Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: inventory current ledger owners and explicit model-spend audit debt Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: preserve returned usage and include model sends in initializers Keep the returned response price-presence fact instead of synthesizing an explicit zero. Enumerate declaration initializers as well as named functions and prove package-scope mutations are rejected. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: a failed scout reply counts in its limit, and charges may arrive concurrently Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * memory: name its call tag for the replay law and pass the new scan argument Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: memory fixtures use a step that isn't held for an unchanged checkout A job's write step with no change now waits for a person. These tests are about memory, so their step is plain work. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
… PR and page AI (#2271) * factory: a write step that changed nothing is not done A write round that reported done while the job's checkout had no change from the run's base counted as done, so test and review ran on an untouched tree and only publishing found nothing to commit. The runner now reads the checkout after a write round; with no change, the round does not pass, says "the checkout has no change from where the run began", and goes round again or asks. Other steps may still finish with no change, and an unreadable checkout never holds a round back. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: changelog entry for #2158 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: reproduce missing memory spend through the vault interface Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: bank memory receipts and bind job compilation to finished turns The compiler used the provider transport without a ledger consumer, while the process worker owned its lifetime independently of jobs. Bank decoded receipts before validation and keep job sources out of independent compilation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: isolate memory snapshots and verify cancellation during compilation Keep compilation boundaries per owner, drain finished-turn journals, and classify older factory conversations from persisted memberships. Preserve projection upgrades and reject a structural bypass that discards the billed context. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: cover retained job sources and large memory snapshots Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: refuse memory admission on paused and published jobs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: drain owned memory snapshots and fence unchanged failed input Reclassify retained job events independently of journal cursors, check stored pause and publication state at admission, and finish every extraction batch in the turn snapshot. New source input or an explicit Build is required to retry failed background compilation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: reject repeated refinement of unchanged memory input Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: require new evidence or explicit build for further memory refinement Record the Build request consumed by each publication so forced flushes on unchanged sources stay idle. Preserve recovery when extraction produced new unpublished evidence, and let an explicit Build advance retained guide work. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: old job ownership excludes background memory Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: retain old factory ownership in memory inventory Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: compile delegated reports with their owning turn Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: use the persisted place layout for delegated memory Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: compile delegated evidence on the owning job turn Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: measure live job memory cost and stage tail delays Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: memory cannot turn successful work into a cap stop Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: preserve successful stage results after deferred spending Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: bound stage memory waits and retain cancelled charges Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: enforce memory cap only at the next unfinished step Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: record completed phases before checking the next budget Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: distinguish memory delay and stop timed-out live jobs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: bound stage memory waits to the owning job lifetime Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: retain skipped stage evidence across job memory handoff Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: recover skipped stage evidence in the next owned memory pass Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: measure late memory receipts after job completion Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep an empty owned source selection empty Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: count overlapping memory waits as wall time Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: attribute memory tail wait to its initiating stage Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: verify live memory starts stay inside the job lifetime Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: stop live measurements with a fresh job version Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: count measured memory calls independently of late prices Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: read measured job spending through the app wire Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: settle cancelled live calls before checking measured spend Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: open live factory brief chats through the in-process app Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: deliver late memory receipts through the real factory worker Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: observe the public ready flag and bound worker fixture cleanup Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Keep job reporting alive for late memory receipts Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Test late memory pricing after stopping a factory job Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Observe finished steps before settling final prices and pin live helpers Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Reconcile paid memory after a stopped job loses its lease Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Keep one accounting anchor per run and retry final settlement Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Test final memory settlement preserves previously counted job spend Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Measure stage answers separately from automatic brief calls Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Report per-job memory dollars and bound delays by the next step start Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Test paid memory survives reopening a finished stage Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Preserve paid usage in a closed stage journal Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Test leased memory receipts during actual factory quit Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Allow bounded accounting settlement after worker cancellation Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Reproduce the memory tail fixture accounting observation race Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Wait for both memory ledger and job accounting in lifecycle fixture The ledger is published before the independent job meter update. Poll both observable totals and name standalone session closure accurately. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Test quitting while final worker accounting is already settling Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Keep bounded accounting alive when quit interrupts settlement Detach the existing settlement context from execution immediately, then cancel it five seconds after quit. This also covers cancellation arriving during the existing receipt wait. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Recognize late journal usage in the append funnel guard The journal is a separate store from artifact indexes. Account for both journal append owners while retaining the guard against unknown append paths. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Reproduce stage budget exemptions and unowned batch draining Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Distinguish memory cap crossings and restore bounded ordinary Flush Keep memory in total job spend while excluding only newly charged memory from completed-round cap checks. Preserve model and tool stops, and retain finite draining only for owned turns. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: reproduce duplicate factory brief charges through the app wire Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 8f8015c20a5e74cd8c73ec68d8fe22b4feb5118e) * fix: charge factory brief calls only at the session billing boundary The session already books each provider receipt to the job and ledger. Keeping a brief charged the job again, including rejected drafts. Preserve session booking so failed saves retain their cost and worker spending remains additive. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit c2938deaf4b3e6ec8eb9c865a58c229663def4ac) * test: audit manager and title charges beside factory briefs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit bb52801b802fd29a1b6889d55461eeeb69e66f87) * test: exercise title billing on an unnamed job-owned conversation Factory managers have a saved title and correctly skip model naming. Use an unnamed stage for the separate title receipt audit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit eee242d5899dd62c6d89e3186a1f83d853a67cda) * test: align the factory keep contract with receipt-based billing Keeping a brief preserves its cost metadata without charging the already billed call again. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 3af433d90bf6809c42152de9b480be3ab3b9e99a) * test: reserve the leased brief fixture for its simulated worker The local factory starts a worker too. Pin the fixture to the remote machine so a local runner cannot win its queued lease when the surrounding suite supplies a runnable configuration. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 4ff25c49ffc450b770045ee8a861156447001cd4) * Declare local memory provenance at the reader boundary Check late memory receipts retain their classified share as well as their total charge. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Use the existing lane import alias for memory accounting Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: check live brief charges against the job header Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: one entry for the brief charge fix Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: the call log's served field names the provider, not the model The recorder already checks the model that answered each call. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: memory crossing the cap does not hide a daily refusal Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * factory: a daily refusal is never read as a memory charge Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: cover factory write retries against the job base Exercise committed earlier work on rerun, retry after failure and resume after Stop, and retain the refusal for an empty first attempt and rerun. Include the waiting question when the retry fixture misses its failed check. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: keep write retry checks at the Test approval gate Include the following test step so the manual approval is reached, and stop the current step so its recorded attempt can be resumed. Check the retained commit and change through the job reply. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: distinguish stopped writes before and after reporting Compare immediate Stop with Stop after the first running receipt, using the same committed change and wire actions. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: retain the factory write base across stopped attempts Stop can revoke a lease before its first report carries ChangeBase. Keep the original pin on the job branch before edits so its replacement counts earlier committed work instead of comparing against the edited HEAD. Make the three retry fixtures perform their promised write. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: synchronize stopped write reports and refuse an unpinned base Hold periodic reporting on the real lease worker until Stop, then run the replacement with normal reporting. Verify a locked repository config prevents Write from editing before its comparison base is preserved. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: stop a factory round when its base cannot be preserved A repository config lock must not let edits start without their durable comparison pin. Surface the save error before calling the executor. Keep the deterministic replacement worker on the same fixture machine. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: assert the factory preparation failure receipt A failure to preserve the base is an execution preparation error, so read its failed-step detail rather than an out-of-rounds result. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: keep read-only factory checks independent of Git metadata Exercise the exported runner with a real command in a directory without Git metadata, matching the leased-worker fixtures. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: discard failed Git reads before preserving a factory base Git errors include stderr as output. Do not mistake that text for a branch or commit and try to persist it. Keep the existing behavior when Git metadata is unavailable, while refusing an actual base save failure. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: reproduce pause after a memory stage tail detaches Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: pin one next budget for cap questions and answers Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: check memory admission when Pause returns Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: complete the paid memory response with valid JSON Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: give cap questions and answers one allowed next budget Select the smallest allowed cap above recorded spend instead of doubling the old cap. Share budget choices with the runner, job reads and budget edits, and refuse a continue when no higher budget remains. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: retain paused memory for a later resumed turn Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: measure live Pause memory and provider receipt totals Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: keep budget continuation available above thirty dollars Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: check settled provider sums and detached memory lifecycle Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: pause live memory after a provider generation starts Document paused memory admission, normal resume, and process-owned shutdown. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: admit local job memory against the owning factory state A worker mirror can still say running after Pause returns. Read the owning local factory for memory admission and cancellation while retaining mirror-based receipt settlement. The job conversation checks that owner before worker mirrors too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: cap resumed memory at one normal scripted pass Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: offer matching budget continuation beyond thirty dollars The fixed budget ladder returned zero after thirty dollars, trapping jobs. Derive the next cap from the job and accept that exact amount at the factory budget door. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: measure only stages that started before Pause A paused job correctly has no conversation identity for its unstarted stages. Skip those stages when measuring memory rather than requiring identities from future work. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: align cap metadata expectations with the next budget rule The whole-package run found two expectations left on the former doubling and zero-limit rules. Expect the next standard five dollar cap at both public seams. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: count a finished memory generation and its receipt once A response can finish at the same time cancellation queues its receipt. Both observations describe the same provider charge, so share the existing once-only charge counter. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: retain unfinished memory after a completed extraction Pending counts unextracted source events. When the already-paid extraction finishes at Pause, those events can be consumed while NeedsUpdate retains the remaining compilation work. Keep the stricter source assertion for interrupted calls. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: prove completed factory hedge arms are both charged Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: check factory helper and follow-up money through the app wire Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: isolate page AI sessions and await the published job turn Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: exercise the factory Stop action for final brief accounting Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: omit absent schema from priced errand requests Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: account for completed hedge losers before returning the winner Completed losing responses were left in the race result channel without reaching discarded-usage accounting. Drain the cancelled arms and forward their usage before the caller closes its accounting. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * memory: name its call tag for the replay law and pass the new scan argument Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: memory fixtures use a step that isn't held for an unchanged checkout A job's write step with no change now waits for a person. These tests are about memory, so their step is plain work. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: cancel hedge arms before collecting their final accounting Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: supply fixture admission and evidence for factory money proofs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: await page AI admission and run follow-up from a captured PR Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: explicitly hold the page AI agent through its public open door Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: match the page AI fixture transcript to its direct session opener Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: clear omitted errand reply fields before retrying admission Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* test: preserve personal approval across later gates Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: supply the scripted worker name Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: use the manual Test step gate Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: retain settled approvals while later gates wait Later questions deleted the saved plan decision before the job read synthesized an empty waiting approval. Keep the decision for display and use the existing current-question checks for fresh gate consent. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: reopen while the later approval gate waits Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * manual: approval heading doesn't take the restart question Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* memory: red test for the no-key words Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * memory: the no-key refusal names where to add a key Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* test(factory): prevent automatic spending on closed issues Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(factory): check GitHub before automatic issue spending Check standing before scouting, start-rule writes or paid arrival reads. Share closed answers for the process and keep unavailable GitHub reads permissive. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(factory): bound concurrent standing checks and compare persisted rows Share in-flight reads within the same deadline, retain only closed answers and include the repository owner in cache identity. Compare rows after their persistence round trip. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(factory): verify closed answers are shared across automatic paths Reuse the existing canonical GitHub item key for the shared cache. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * triage: a person's Read press still reads a closed issue Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * intake test and manual: the press isn't part of the shared check Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * manual: the automatic check, in the section about closed issues Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * intake test: unused row Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * factory: the automatic closed check lives below triage and intake Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * factory: the check's own package has no import of github Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * factory: a remembered closed answer lasts ten minutes, so a reopened issue is worked again Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: the closed answer's real length Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Take the gated copy of the union merged docs --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* spend: red test, repo notes and themes are Factory AI Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * spend: repo notes, themes, evals and briefs are Factory AI Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * manual: AI notes and themes are Factory AI Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…2283) * test: reproduce lost job ownership and duplicated call receipts Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: account for durable job ownership and journal call identity Competing manager opens remain owned after Talk selects another journal. Recognize the saved owner for live budget admission and spending. Match receipt rebuilds to the journal identity as well as the cell identity. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: cover factory identity collisions and seeded session names Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep factory budget ownership and seeded identities precise Validate durable ownership against the candidate store. A local worker mirror must share the owning floor manager path before taking an extra manager charge. Seed journal headers and titles from the session folder metadata in either layout. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: racing asks make one manager Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * factory: one manager per job, with a lock across create and join Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: one manager per job Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * changelog: name the pull request Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * factory: the mint lock wraps the work, so no closer is handed out Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: reproduce foreign manager charging a local budget Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: bind manager budget ownership to the issue and creation time Old ownership marks keep their root, job and repository matching. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: reproduce duplicate aliases hiding a new receipt Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: count saved calls once across ledger session aliases Match call facts across aliases, retaining repeated calls under a single alias and leaving historical rows untouched. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: reproduce unrelated mint blocked by recipe network read Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: reproduce remote Talk reusing an identical local row Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: read recipes before locking manager minting Keep the held-manager fast path and recheck after locking. Network reads no longer hold the floor-wide mint lock. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep remote Talk on the worker mirror GitHub issues supply Created (github/source.go issueItem); Store.Create preserves it and api transport carries it. Independent factories can therefore share ID, Repo, Num and Created. The remote door must use its mirror; owned runners still consult their floor. Remote manager deduplication remains unsupported. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: verify receipt refresh through the exported handoff seam Assert historical ledger bytes remain unchanged and repeated refresh imports no saved call twice. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: distinguish saved calls by time and row identity Exercise exported Refresh with separate equal-cost calls, microdollar rounding, and repeated ledger IDs. Normalize Go formatting. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: cover both owner identity fields and legacy marks Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: match saved calls against distinct ledger row identities Match each alias to saved calls in order, using receipt precision for cost and allowing live usage to precede its seal. Count repeated row IDs once and append only missing calls, preserving historical ledger bytes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: preserve legacy aggregate call identity and finish formatting Record the legacy prefix assumption for calls sharing a seal. Final review retains no blocking findings. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: a remote job's conversation works in the floor's folder Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * factory: a remote job's conversation keeps the floor's folder Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * cellindex: count a chat's held rows by its fuller id, so nothing is booked again Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: rows under both ids are one prefix, as the rebuild writes them Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Brings the integration branch up to app/v3 (28 commits: Factory spend and budget rows, one engine per home, memory off by default, the app delta window, process-group reads on macOS, and their tests). No conflicts; the three files both sides touched (cmd/codeaf/app.go, internal/appwire/server.go, docs/design/app-v3/PROTOCOL.md) merged line-disjoint. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Collaborator
Author
|
Landed by fast-forwarding Every red on this gate is also red on app/v3's own gate or full check (run at
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Brings the Workstreams integration branch up to
app/v3(28 commits behind). A merge, not a rebase: no commit on either side is rewritten.cmd/codeaf/app.go,internal/appwire/server.go,docs/design/app-v3/PROTOCOL.md) and merged line-disjoint: the workstreams store field and hello feature line sit beside app/v3's spend watcher, home hold and delta window.How it lands
This PR runs the gate only. It is not squash-merged: a squash would flatten app/v3's 28 commits into one and leave app/v3 out of the branch's history, so every later sync would replay them. Once the gate is green (or red only on known baseline failures),
workstreams/mainis fast-forwarded to this branch's merge commit and this PR closes as merged.Validation
🤖 Generated with Claude Code