ui-server: remove selected binary attachments with retained recovery and stale-safe Undo #2012

Context

Part of #1779. Follow-on implementation from #1782, whose S1=A, S2=A, S3=A, S4=B and complete-design approval are settled. Read docs/decisions/design-kit/storage.md (introduced by the #1782 design-finalization PR), docs/plans/storage-accounting.md, docs/plans/storage-lifecycle.md, docs/decisions/native-brain-storage.md, and ROADMAP.md's binding decisions. No implementation slice may publicly register an interim read-only Storage pane; first pane delivery includes safe binary removal and the complete journey.

Source checked at 04ef3552190d8f56eab09dd6c3580101b6385ba4:

The privileged application accepts only ordinary Markdown: validatePath, packages/ui-server/src/brain/application.ts:34-45. Existing user recovery is createTurnReverts, packages/ui-server/src/brain/turn-revert.ts:19-177, with createWriterGate, packages/ui-server/src/brain/writer-gate.ts:67-118. createJournalObjects, packages/ui-server/src/brain/journal-objects.ts:34, and createNativeJournalCapture, packages/ui-server/src/brain/native-journal-capture.ts:9, own charged retention/native capture; do not restore the superseded whole-tree copy design.

Out of scope

No unjournaled deletion, policy/credential/executable removal, symlink/hard-link or nested-mount mutation, recursive workspace purge, sidecar cascade, reference rewriting, Git-history erasure, implicit commit/push, new retention policy or broad shell delete. No loosening the Markdown route to accept PDFs.

Scope

Implement the exact selected canonical binary attachment application and durable review/removal/result/Undo lifecycle required by S4=B. Reuse current human-principal authorization, native journal ownership and writer coordination; keep core deterministic semantics independent of the UI DB.

Acceptance criteria

• Review binds exact roots/parents/regular single-link files, current raw bytes/hash and consequences to an authenticated principal and operation identity. Report tracked/untracked/ignored/reference status independently of recoverability; protected/live/unknown-ownership or uncovered versions are ineligible.
• Under exclusive applicable writer coordination and descriptor-rooted no-follow checks, revalidate authority/revocation, selected versions, topology, mode/link count, protected paths, live ownership and consequence changes immediately before effects. Never widen selection or silently retry a conflict.
• Verified retained before-version and durable intent exist before unlink. Charge temporary/CAS/native capacity through existing owners; refusal, quota/ENOSPC or incomplete coverage leaves the source intact. No hidden expansion of journal exclusions/retention.
• Bound request items/bytes/time, cancellation, hashing/copying and queued execution. Existing gate semantics keep nested maintenance able to finish; active writers and multi-process races cannot replace the target between validation and removal.
• Durable per-item receipts distinguish removed, changed, protected, failed, not-started and unresolved reconciliation. Lost response/restart reads the same identity; crashes before/after unlink/ack cannot delete a replacement or fabricate success.
• Undo is a fresh version-checked operation using the retained original, refuses overwriting a newer file, obeys current authority/retention and survives restart. Retained detail expiry removes the Undo promise visibly.
• Mixed batches keep successes without rollback or unrequested effects. Report index refresh, local deletion, commit/sync state, retained journal/Git/backup bytes and fresh per-volume observations separately.
• Advertise capability only when the complete operation/recovery is available. Additive schemas and user documentation describe unsupported hosts, exact limits and limitations; no production Storage pane ships before this proof.

Verification

Real temporary Odysseus binaries and references, actual writer gate/native journal and CAS, cross-process writers, selected-version changes, protected pins/live staging, hard-link/symlink/mount refusal, independent original-byte Undo controls, SIGKILL/reopen at each durable boundary, mixed failures and constrained-volume ENOSPC. Record failing-first/restored mutations for stale-file, retained-before-version, authority and stale-Undo guards. Run check:pr plus complete selected hosted runtime/contract proof.

Contract impact

Additive binary application/review/receipt/capability surface. Update integration-contract components in the same CONTRACT: commits with minor changesets and API reports where applicable. No breaking change to existing Markdown application, journal retention or auth semantics.

Blocked by #2010

Blocked by #2011

2026-10-16: design prerequisite #1782 is complete via #2015; removed its obsolete blocker declaration. The remaining implementation dependencies above still apply.

2026-10-16 implementation dependency: reuse #2011's bounded credential-free execution and current-authority guards for the removal review/read work; do not duplicate those boundaries. The original source anchors above remain valid on inspection. This adds sequencing within the already requested implementation chain, without changing the removal or retention policy.

Current delivery candidate and remaining verification

PR #2172 now contains candidate 3c0e884a4d6b43c494469c9fdaf6ce0cb919ef6e, integrated main 498270fbdc4ef2788fdd3babb259b647d77f6c77, tree 7ae925358c6b9da18e28959cb57cc9ff07c26c1b.

Main #2361's native preparation is integrated with Storage's bounds and publication rules. A real revocation control exposed an authorization gap across the new asynchronous preparation. Current authority and command entry are now checked immediately before the requested command. Removing that check makes the worker write the forbidden temporary marker; restoration prevents the write and passes its authorized control. The integrated runtime/citation batch passes 100 tests / 402 assertions; the final owner suite passes 5 / 38 and lint passes. The integration receipt preserves the actual source and mutation evidence.

Strict types with the repository's 4 GB Node setting pass on this frozen candidate, as do 956 fast tests / 6,331 assertions. Required broad affected-test feedback is still running but has already failed the native runtime-placement sentinel assertion. #2387 reproduces it on unchanged main: a relocated runner TMPDIR put the supposed inside-/tmp sentinel outside the actual private mount. The isolated literal-mount fixture correction preserves every launcher mode/assertion; corrected default/relocated runs pass 4 tests / 253 assertions, a broad-retention mutation fails the named sentinel assertion, and restoration passes. PR #2389 carries the independent correction. Its required local preflight passes on clean 2c3913504382ab54e97586f1fbfc26f87a442aff in 21.40 seconds, including all four affected native tests / 253 assertions with relocated TMPDIR. The original Storage receipt remains failed; this focused control does not replace complete candidate qualification. The current candidate's external-speech target passes: bundle PID 2539396 exits 0 with no signal, both output channels complete with zero bytes, and the two real browser/audio tests pass with 13 assertions. Its isolated wrapper passes in 107.45 seconds. This current-source control does not establish the historical silent exit's cause or resolve #2334. The superseded f197ab1fb preflight is stopped after the relevant base change and correction: 956 fast checks / 6,331 assertions passed, affected feedback remained unfinished, and no assertion failure was reported before shutdown. Affected-child exit 143 / check:pr exit 1 and zero surviving owned processes are retained as incomplete proof.

The independent original-source #2334 replay has ended at the unchanged 180-second package-build hook, before browser bundling. No bundle process observation was reached, and the stopped diagnostic leaves zero survivors among eight owned processes. The completed diagnostic receipt preserves the distinct setup failure and does not establish the original silent exit's cause. Independent #1513 qualification is now blocked by fresh discovery failure #2380; its passing controls do not replace the failed preflight. Independent native deadline corrections #2315 and #2382 are delivered in #2384, squash 775eb17aab740fa759c2182f306c38fc17acbcbe. All 16 selected ready CI jobs pass, their actual checkout identities are verified, and the squash parent/tree and presence on remote main are verified. The delivery receipt keeps the tested base distinct from the independently assessed diagram-test advancement. Automatic main-push confirmation is complete in the recorded #2384 and #2389 delivery receipts. That delivery does not qualify or merge this Storage candidate.

Independently delivered #2195, #2196, #2201, #2204 and #2205 are closed after verified complete automatic main proof. Their original qualification remains separate from this feature candidate. Complete selected hosted confirmation, actual-main verification and release reconciliation remain pending for #2172. #2334 remains needs: repro. The #2202/#1946 rulings are unchanged and #2307 is not a Storage prerequisite. Claim storage-recheck-20261017-e8f2 continues.

2026-10-18 correction: recorded completed diagnostics and current verification, preserving the frozen candidate and original failed evidence.

Resolved proof dependency: #2387 (delivered in #2389).

Current qualification

Candidate 9c4419b2df85c9ef69fd91c768369d713954e743, tree b54c9b8554b331853247268224317652cd40b5ab, contains the clean integration of main ea4c76c15eee2e23701910b7c2395bdd479b99c6 and the diagnosed #2409 test-fixture correction. #2299 changes worker XDG initialization on the launcher/sandbox path used by Storage; #2388 supplies independent generated-proof fixtures; #2407 corrects cancellation-fixture temporary-root placement.

The first integrated head 065d408b passed 91 focused tests and failed one generated-theme positive. Its frozen caller still preceded Storage's already-reviewed binding. The correction gives that caller its own committed fixture while shared producer inputs retain their frozen main owner. Production hashes, refusal guards and product source are unchanged by this two-file correction. All 20 generated-input tests pass with 88 assertions; restoring the old caller fails the same positive assertion (19 pass / one fail), and restoration passes 20 / 88. The real offline compiler and drift controls remain exercised. Lint passes. The failed integration receipt remains failed.

Local qualification of this integrated head is pending.

Focused worker import-order, native placement, SDK relay, Storage authority, cancellation and proof-fixture checks run before strict types and mandatory local preflight. If these succeed with unchanged source and PR feedback, an explicit full CI run will be requested on this branch while the PR remains draft. This does not establish automatic ready-PR behavior. The #2334 and #2380 causal evidence gaps remain open; neither readiness nor merge follows from successful controls alone.

Prior candidate qualification — cb193ad

Current candidate cb193add13f65dc7f160204d43fdcf9b5801094f, tree bce25c03febbb76d175a212b35f4f2791885ad87, integrates main 68e12f27eb249c9fe7262a498a0397c04bbda8f4 into prior Storage 3c0e884a4d6b43c494469c9fdaf6ce0cb919ef6e. The merge is clean and matches the precomputed tree. The complete intervening diff only changes tests, proof helpers and capture metadata; product source is unchanged. This incorporates the delivered native deadline corrections #2315/#2382 via #2384 and the literal-/tmp fixture correction #2387 via #2389.

The previous candidate's mandatory preflight finishes with exit 1: 956 fast tests / 6,331 assertions pass; broad feedback reports 7,189 pass / four skips / one fail, 48,812 assertions across 545 files in 5,778.62 seconds. All four skips are the inverse empty test.if(!vecAvailable) placeholders, with substantive vector cases passing. The sole failed test is the native runtime-placement sentinel now corrected by #2389. The failed receipt remains unchanged.

The frozen cb193add13f65dc7f160204d43fdcf9b5801094f qualification completed successfully: 56 focused checks / 424 assertions, strict types in 54.99 seconds, and required bun run check:pr --base origin/main with exit 0 in 4,962.10 seconds. Fast checks pass 956 / 6,331 assertions. Broad affected feedback passes 7,184 tests, with four inverse empty vector placeholders skipped, zero failures and 48,836 assertions across all 544 selected files. The substantive vector cases and formerly failing native placement control execute and pass.

The post-run wrapper stopped on its stale expectation of at least 7,190 passing tests. The audit accounts for the exact six-case difference: packages/ui-backend-claude/tests/sdk-host-relay.test.ts is the sole file removed from the previous affected selection. #2384 delivered its exact already-present blob 08a6293a6aacf45a6f5420b3e4e12e006b71b393 onto main, so it is no longer changed relative to the new base. Every other observed test-file header remains. The required command itself passed; the wrapper stop is preserved separately and does not justify an unchanged rerun. This receipt belongs to cb193add, before the relevant main integration described above.

Historical #2334 and #2380 cause attribution remains unresolved. The passing current speech control does not explain the old silent bundle termination, and prior successful discovery controls do not repair the old watchdog failure. This prepared verification step does not close either investigation or authorize merging Storage while its stated prerequisites remain open.