CONTRACT: feat(storage): deliver owner inventory, recovery and capacity guidance

[schlessera]

Refs #2409

Refs #1513, #2010, #2011, #2012, #2013, #2058, #2059, #2195, #2196, #2201, #2204, #2205, #2315. Refs #2334 for bounded observations; its historical termination remains unexplained.

What changed

Implements the complete Storage journey approved in #1782 and the guidance approved in #2014. Human owners can inspect bounded Brain/App inventories and capacity, filter PDFs larger than 5 MB, review exact file versions, remove eligible attachments with retained originals, read durable outcomes, and perform stale-safe Undo. The three approved maintenance operations run through their existing owners. Unknown allocation, references, recovery and volume effects remain explicit.

Adds 64 six-hour, 90 daily and 32 weekly actual history endpoints across at most four capacities, within 186 records and 256 KiB, without extra scans. Qualified 7-day and 30-day capacity scenarios supplement observed rates. Independent capacity, forecast and owner-refusal causes drive hysteretic warnings, the persistent app indicator and opt-in Critical push episodes. Delivery preserves quiet hours, durable deduplication, bounded known-failure retries and terminal unknown outcomes.

Why this shape

Follows the approved Storage design, lifecycle and guidance decisions. Current authority, exact-version review, retained originals, durable intent and exclusive writer coordination govern effects. Each operational store keeps its existing owner; unknown effects are never replayed automatically.

This ordinary PR targets main and includes review layers #2113, #2061, #2138, #2139, #2151 and #2165. Their smaller diffs remain available until combined delivery is verified. Supporting fixture corrections retain their behavioral assertions and original diagnostic evidence.

Current qualification

Candidate 9c4419b2df85c9ef69fd91c768369d713954e743, tree b54c9b8554b331853247268224317652cd40b5ab, contains the clean integration of main ea4c76c15eee2e23701910b7c2395bdd479b99c6 and the diagnosed #2409 test-fixture correction. #2299 changes worker XDG initialization on the launcher/sandbox path used by Storage; #2388 supplies independent generated-proof fixtures; #2407 corrects cancellation-fixture temporary-root placement.

The first integrated head 065d408b passed 91 focused tests and failed one generated-theme positive. Its frozen caller still preceded Storage's already-reviewed binding. The correction gives that caller its own committed fixture while shared producer inputs retain their frozen main owner. Production hashes, refusal guards and product source are unchanged by this two-file correction. All 20 generated-input tests pass with 88 assertions; restoring the old caller fails the same positive assertion (19 pass / one fail), and restoration passes 20 / 88. The real offline compiler and drift controls remain exercised. Lint passes. The failed integration receipt remains failed.

Local qualification of this integrated head is pending.

Focused worker import-order, native placement, SDK relay, Storage authority, cancellation and proof-fixture checks run before strict types and mandatory local preflight. If these succeed with unchanged source and PR feedback, an explicit full CI run will be requested on this branch while the PR remains draft. This does not establish automatic ready-PR behavior. The #2334 and #2380 causal evidence gaps remain open; neither readiness nor merge follows from successful controls alone.

Prior candidate qualification — cb193ad

Current candidate cb193add13f65dc7f160204d43fdcf9b5801094f, tree bce25c03febbb76d175a212b35f4f2791885ad87, integrates main 68e12f27eb249c9fe7262a498a0397c04bbda8f4 into prior Storage 3c0e884a4d6b43c494469c9fdaf6ce0cb919ef6e. The merge is clean and matches the precomputed tree. The complete intervening diff only changes tests, proof helpers and capture metadata; product source is unchanged. This incorporates the delivered native deadline corrections #2315/#2382 via #2384 and the literal-/tmp fixture correction #2387 via #2389.

The previous candidate's mandatory preflight finishes with exit 1: 956 fast tests / 6,331 assertions pass; broad feedback reports 7,189 pass / four skips / one fail, 48,812 assertions across 545 files in 5,778.62 seconds. All four skips are the inverse empty test.if(!vecAvailable) placeholders, with substantive vector cases passing. The sole failed test is the native runtime-placement sentinel now corrected by #2389. The failed receipt remains unchanged.

The frozen cb193add13f65dc7f160204d43fdcf9b5801094f qualification completed successfully: 56 focused checks / 424 assertions, strict types in 54.99 seconds, and required bun run check:pr --base origin/main with exit 0 in 4,962.10 seconds. Fast checks pass 956 / 6,331 assertions. Broad affected feedback passes 7,184 tests, with four inverse empty vector placeholders skipped, zero failures and 48,836 assertions across all 544 selected files. The substantive vector cases and formerly failing native placement control execute and pass.

The post-run wrapper stopped on its stale expectation of at least 7,190 passing tests. The audit accounts for the exact six-case difference: packages/ui-backend-claude/tests/sdk-host-relay.test.ts is the sole file removed from the previous affected selection. #2384 delivered its exact already-present blob 08a6293a6aacf45a6f5420b3e4e12e006b71b393 onto main, so it is no longer changed relative to the new base. Every other observed test-file header remains. The required command itself passed; the wrapper stop is preserved separately and does not justify an unchanged rerun. This receipt belongs to cb193add, before the relevant main integration described above.

Historical #2334 and #2380 cause attribution remains unresolved. The passing current speech control does not explain the old silent bundle termination, and prior successful discovery controls do not repair the old watchdog failure. This prepared verification step does not close either investigation or authorize merging Storage while its stated prerequisites remain open.

Earlier candidate proof

Current head: 3c0e884a4d6b43c494469c9fdaf6ce0cb919ef6e; integrated main: 498270fbdc4ef2788fdd3babb259b647d77f6c77; tree: 7ae925358c6b9da18e28959cb57cc9ff07c26c1b.

Main #2361's native maintenance corrections are integrated. The new asynchronous preparation exposed a Storage authority gap: a real revoked-owner control entered its command before revalidation. The correction checks authority and records command entry after preparation, immediately before payload launch. Removing the check makes the real worker write the forbidden marker; restoration prevents that write and passes an authorized control. The integrated runtime/citation batch passes 100 tests / 402 assertions; the final owner suite passes 5 / 38 and lint passes. Strict types and 956 fast tests / 6,331 assertions pass on this exact frozen candidate. Required broad affected-test feedback is still running but has already failed the native runtime-placement sentinel assertion. #2387 reproduces it on unchanged main: a relocated runner TMPDIR put the supposed inside-/tmp sentinel outside the actual private mount. The isolated literal-mount fixture correction preserves every launcher mode/assertion; corrected default/relocated runs pass 4 tests / 253 assertions, a broad-retention mutation fails the named sentinel assertion, and restoration passes. PR #2389 carries the independent correction. Its required local preflight passes on clean 2c3913504382ab54e97586f1fbfc26f87a442aff in 21.40 seconds, including all four affected native tests / 253 assertions with relocated TMPDIR. The original Storage receipt remains failed; this focused control does not replace complete candidate qualification. Complete selected hosted confirmation has not started. Unmatched retention inputs require fresh execution under the existing rules.

Behavioral and mutation evidence retained with its actual source:

• Real retained-original removal, byte-exact Undo, stale versions, topology/link refusal, authority revocation, full-volume refusal, writer contention and crash/reopen scenarios. Removing the private-original reader fails STORAGE_PRIVATE_ORIGINAL_BEFORE_EFFECT; removing post-admission authority fails the writer-gate revocation assertion. Restored implementations pass.
• The approved 30-day forecast correction fails the named runtime guard and independent design trace before repair, then passes 62 history/pressure/citation tests with 213 assertions. Exact boundary and included/excluded endpoints are covered. Correction receipt.
• HTTP fixture lifetime entries and reviewed browser configuration bindings have failing/restored controls. The full fingerprint class audit identifies all three remaining stale pins; restored source passes 165 tests / 727 assertions without weakening rejection guards. Audit receipt.
• A real self-SIGTERM child fails the missing signal observation before correction; restored observation/citation proof passes 51 tests / 158 assertions. This changes diagnostics only.
• Earlier layer proof covers 66 Storage browser tests, 3,156 navigation cases, 20 both-theme stories, 188 focused server tests, and complete separate-UID/Btrfs execution with zero owned-resource residue. Inspected visuals cover 320/1280, dark/paper/grey, keyboard/touch and 200% zoom. These remain earlier-source receipts, not fresh executions on this head.
• ci: attribute the separate-UID SDK relay child deadline failure #2315 retains the causal outer-deadline control and passing restored native proof. Its full SDK profile allowance composes four existing bounded turns; per-turn and cancellation limits remain unchanged.

Failed and interrupted runs remain separately recorded. The original fe5faafda broad run fails only the silent speech bundle (#2334); four skips are inverse empty placeholders while substantive vector tests pass. Later 4440e0f9b passes its full preflight; dbeabf662 fails its stale fingerprint guard. Neither result is relabeled as current proof. The 95dc5e8bf hibernation failures and one unchanged-source recovery are recorded in the continuation receipt. The subsequent temporary-filesystem write error and isolated disk-backed recovery are recorded in the quota receipt.

The last turn interruption stops both the 0c06538fb preflight and original-source diagnostic with affected-test exit 143 and check:pr exit 1 before the diagnostic target. No test failure is reported before cancellation; complete supervisor exit receipts are unavailable. Those runs remain incomplete. The bounded original-source replay is now complete: the original 180-second package-build hook expires before browser bundling, so no bundle process sample exists. The observer stops its diagnostic after the target wrapper joins and confirms zero survivors among eight owned processes. The completed diagnostic records this distinct setup failure without attributing the historical silent exit.

The current candidate's external-speech target passes: bundle PID 2539396 exits 0 with no signal, both output channels complete with zero bytes, and the two real browser/audio tests pass with 13 assertions. Its isolated wrapper passes in 107.45 seconds. This current-source control does not establish the historical silent exit's cause. The investigation in #2334 remains open.

Checklist

• Current local preflight and every selected hosted category pass with actual checkout identities recorded.
• Approved Storage behavior, additive contracts, API reports, documentation and consumer minor changesets are included.
• Acceptance and release milestones are read back for every delivered issue before merge.
• Leakage, citation, offline, provider-history and behavioral guards remain intact.

Five independently delivered fixture issues (#2195, #2196, #2201, #2204, #2205) are now closed after verified complete main proof; their qualification receipt remains separate from this feature candidate.

Anything left open

Qualification of integrated 9c4419b2df85c9ef69fd91c768369d713954e743, explicit complete hosted proof, resolution of the stated causal prerequisites, automatic ready-PR confirmation and actual-main verification. The delivered #2315/#2382/#2387 fixture fixes are integrated. The distinct #2334 historical silent bundle termination and #2380 pre-publication discovery failure remain needs: repro; their passing controls are not causal repairs. Independent #1513 delivery in draft #2113 remains blocked by #2380. Keep these gaps explicit and resolve the stated prerequisites before merge. The #2202 ruling covers only its separate known unavailable-Send observation. #2307 is not a Storage prerequisite. No complete current hosted pass or Storage merge is claimed.

Volume deltas include other writers. Undo requires a retained original and absent target. Accepted push transport does not establish device display. The unrelated reduced-motion defect remains tracked in #2166; Storage history is static. No deployment, production cleanup or real notification is performed.

The superseded f197ab1fb preflight retains its 956 fast passes / 6,331 assertions and unfinished affected feedback. It was stopped after the relevant main integration and authorization correction, with affected-child exit 143, check:pr exit 1, and zero surviving owned processes. No complete pass is claimed for that run.

[schlessera]

2026-10-17 verification update: 4440e0f9b completed the normal local preflight successfully: 950 fast tests / 6,317 assertions and 6,992 affected tests / four inverse empty placeholders skipped / zero failures, 46,694 assertions across 526 files in 4,112.14 seconds. Both actual speech cases and the isolated wrapper pass; the exact desktop Subagent Deny case from #2202 also passes. This does not establish the original #2334 termination cause.

The subsequent combined-tree review found a separate browser-proof integration defect: Storage's command registration changed vitest.config.ts, but the reviewed configuration hash was stale. Five targeted binding tests fail on 4440e0f9b. Candidate dbeabf662339676c92e3e812d9d601090d86bc40 integrates main 33cc244ea9f4f92114201a29d0d27edf24f89ce1 and corrects that one pin after review. On the combined source, restoring only the old pin fails REVIEWED_DIAGRAM_DOCUMENT_BINDS; the corrected source passes 152 proof/API/citation tests (610 assertions) and 13 overlapping document/payload tests (64 assertions). The new main includes diagram, voice-permission and fixture-proof updates. Complete local preflight on this exact integrated candidate is running; complete selected hosted confirmation remains pending. No original failed receipt is erased and no failure is waived.

[schlessera]

2026-10-17: candidate dbeabf662 completed local preflight with 950 fast passes, then 7,164 affected passes / four inverse empty fallback skips / one failure, 48,777 assertions across 542 files. The sole failure is a stale browser-command configuration fingerprint; the speech bundle, both actual audio/drain/unmount cases and the exact #2202 desktop Deny case pass. This failed result remains preserved.

The class audit found three remaining stale fingerprints. On the same combined source all three corresponding controls fail before correction (18 pass / 3 fail); updating only the reviewed fingerprints passes 165 audit/input/build/citation tests with 727 assertions. Guard logic and behavioral assertions remain unchanged. Candidate 95dc5e8bfd33b2cb251c891c603b46ce6fee4df3 integrates main 8f9d2ceaa6df72e46a6feccec3f3a96292f18648, including its independently delivered build stamps. Full local preflight and strict types are running; full selected hosted confirmation remains pending. The original #2334 cause is still unknown, and its separate original-source broad replay remains prepared. No prior failure is relabelled as passing and no causal repair of #2334 is claimed.

[schlessera]

2026-10-17 continuation: the local interruption is now attributed to hibernation using independent journal and resource-clock records. The 95dc5e8bf run retains its three failures and incomplete status. A single unchanged-source recovery runs all 24 answer-delivery tests successfully (174 assertions, 58.31 seconds), including the two-tab case and both closed-browser followers. Scoped shutdown leaves zero of the 12 owned processes running.

Candidate 0c06538fb29a89d90e90581ba4157be52de0fcbd integrates reviewed main #2352 at 2a0b77f675da2f01c32adba3f4920650a5ee09fa. Strict types and 158 proof-audit/input/build-freshness/citation tests pass; the required preflight is running. #2352 restores ordinary builds and corrects UI fixture cleanup; no Storage policy change or explanation of #2334 is inferred. The prepared original-source #2334 diagnostic and complete selected hosted proof remain pending.

[schlessera]

The first local preflight on 0c06538fb was intentionally stopped after an observed EDQUOT error on the shared temporary filesystem also interrupted receipt/log writes. It exits 1 after the terminated affected-test child exits 143; all 11 owned processes stop. Its partial log is preserved and is not passing evidence. The historical replay's preparatory build also loses its final exit receipt to that write error, so no successful result is claimed for it.

The filesystem still reported available blocks; its mount enables user quotas. A later small write control succeeds, so the error is retained as a contemporaneous failure rather than a claim that the limit remains continuously exhausted. Session receipts now reside on disk, with separate command-scoped temporary directories for candidate verification and the historical replay. No other session's files, system quota, test limits or offline guard changed.

Required preflight has restarted once on unchanged 0c06538fb with the new temporary-storage location recorded. #2334's historical termination is not attributed to this later quota event. Its original-source replay will record its actual temporary-storage environment and still cannot establish a causal repair merely by passing.

[schlessera]

Resumed after the turn interruption. Both active runs stopped with affected-child exit 143 and check:pr exit 1, before the historical speech target; no test failure appeared before cancellation. Their incomplete logs remain preserved, and no supervisor completion is invented.

Candidate f197ab1fb401852c5c3bd38cb3eda79c682f99f5 cleanly integrates main 0d780605fe1ea9a281cce947b1f0074f3f3e7acc (#2293), retaining the reviewed Storage bindings. Eighty integrated binding/audit/citation tests pass with 284 assertions on tree fe4fb8a5196287aa5bf2575fd08bcaa832ea1bb8. Strict types and required local preflight are running. Unmatched browser retention inputs require ordinary fresh proof; no audit exception is selected.

The original-source replay restarts with the same observation-only changes and 7,200-second bound. It uses its separate checkout and disk-backed temporary directory, concurrently with the current candidate. The observer stops it only after the actual speech wrapper joins and captures exact bundle PID/exit/signal/EOF/resource observations. A successful target cannot establish the original cause. #2334 and full hosted confirmation remain outstanding; claim storage-recheck-20261017-e8f2 continues.

[schlessera]

2026-10-18: independently reconciled and closed #2195, #2196, #2201, #2204 and #2205. Their fixes were already delivered in #2199/#2233. Automatic main CI 39068036318, attempt1, passes all16 selected jobs on actual main 0d780605fe1ea9a281cce947b1f0074f3f3e7acc, tree a7a9294d9ca0630164e7829892f6d71e00c81b67. Every actual job checkout agrees; all four unit artifact digests and ZIP CRCs verify. The affected files pass444 tests/4,224 assertions without failures or skips. Each outcome preserves original local/mutation receipts and release0.44.0. This qualifies those independent fixture fixes, not the separate Storage feature head.

The next turn handoff also interrupts the f197ab1fb local preflight and original-source affected-test replay with child143 before completion. Both remain incomplete. Bounded transient local jobs now retain their results across handoffs, using separate temporary directories and automatic process cleanup. The current typecheck uses the repository's existing NODE_OPTIONS=--max-old-space-size=4096; the preceding direct invocation omitted that setting and received SIGKILL with no compiler diagnostic. No journal or kernel-OOM evidence establishes its kill owner, and no compiler failure is invented.

The original full replay's earlier fast-invariant attempt separately fails its old15-second native Vitest discovery guard before starting affected feedback (948 pass/1fail,6,302 assertions). The exact original affected-test subprocess runs directly, with unchanged source except bounded bundle observations, assertions and limits. Its target is joined before diagnostic shutdown; no full-preflight success or causal #2334 repair is inferred. The current f197ab1fb feature proof remains pending and the PR stays draft.

[schlessera]

Current candidate 3c0e884a4d6b43c494469c9fdaf6ce0cb919ef6e integrates main #2361 at 498270fbdc4ef2788fdd3babb259b647d77f6c77, tree 7ae925358c6b9da18e28959cb57cc9ff07c26c1b. The two source conflicts preserve native input preparation, Storage output bounds, publication rules and current authority. Moved documentation citations are reconciled.

The integration exposed an actual authorization gap: the new asynchronous worker preparation happened after Storage's last pre-launch authority check and command-entry marker. The real fixture revokes authority when preparation completes. Its initial assertion fails with entry count 1 instead of 0. The correction invokes the existing host check and marker synchronously after preparation, immediately before the requested command. First-party preparation commands do not receive that callback.

The stronger native mutation removes that final invocation: STORAGE_REQUESTED_COMMAND_DID_NOT_RUN fails because the actual worker changes an owned temporary file from untouched to entered. Restoring the check prevents the write; the authorized control executes and changes the same marker. The integrated six-file runtime/citation batch passes 100 tests / 402 assertions. After an import-only fixture restoration adjustment required by lint, the entire owner suite passes 5 tests / 38 assertions and all lint gates pass on the final tree. Earlier receipts retain their source identities. The internal compatibility description and package patch changeset are included.

The superseded f197ab1fb preflight is intentionally stopped after this relevant base change and correction: 956 fast checks / 6,331 assertions passed, affected feedback remained unfinished, and no test assertion failure appeared before shutdown. The affected child exits 143 and check:pr exits 1; all 13 owned processes are gone. This is incomplete proof, not a passing run. The new frozen candidate now runs strict types with the repository's 4 GB Node setting, followed by required full preflight, in a bounded local job.

The original-source #2334 broad diagnostic continues unchanged in its separate checkout; its cause is still unresolved. No full selected hosted confirmation or merge is claimed. Claim storage-recheck-20261017-e8f2 continues.

[schlessera]

2026-10-18: The current candidate's external-speech target passes: bundle PID 2539396 exits 0 with no signal, both output channels complete with zero bytes, and the two real browser/audio tests pass with 13 assertions. Its isolated wrapper passes in 107.45 seconds. This current-source control does not establish the historical silent exit's cause or resolve #2334.

The existing #2315 SDK correction and the subsequently reproduced application-parent deadline correction #2382 are ready in independent PR #2384 at 20028ce746ae7f0ac300a94d9731169498e1f79e. Complete native proof, strict types, citation audit and mandatory preflight pass there; complete selected hosted proof is requested. That independent result does not qualify or merge this Storage candidate. The Storage candidate continues its frozen broad preflight, with no assertion failure reported so far; no complete current Storage or hosted pass is claimed. The original-source diagnostic and #2380 failed preflight remain failed.

[schlessera]

Independent #2384 is merged as 775eb17a, closing #2315/#2382 after all selected ready CI jobs and actual checkout/squash verification. See the delivery receipt.

The frozen Storage 3c0e884a preflight is still running but has already failed one native runtime-placement assertion. #2387 reproduces the cause on clean main: the fixture uses configurable TMPDIR for a sentinel meant to be under literal /tmp. Its isolated correction passes 4 native tests / 253 assertions with default and relocated temporary storage; a real broad-retention mutation fails the same sentinel assertion and restoration passes. PR #2389 carries the independent correction. Required local preflight for that correction passes on clean 2c3913504382ab54e97586f1fbfc26f87a442aff in 21.40 seconds, including all four affected native tests / 253 assertions with relocated TMPDIR. The Storage run remains failed, and #2172 remains draft.

The current external-speech control passes as previously recorded. It still does not establish #2334's historical termination cause; #2380's separate discovery failure also remains unresolved.

[schlessera]

Qualification of Storage candidate cb193add13f65dc7f160204d43fdcf9b5801094f stopped at preflight-receipt-audit. The source/result receipts are retained for diagnosis; no passing preflight or readiness is claimed. No unchanged retry was requested, and the automatic qualification driver did not mark this PR ready. The existing #2334 and #2380 causal gaps remain open.

[schlessera]

2026-10-18 qualification correction: the required preflight on cb193add passed (7,184 broad passes, four expected inverse placeholders, zero failures; 956 fast passes and strict types also pass). The later wrapper audit used an obsolete 7,190-test threshold. Its exact six-case difference is the now-unchanged SDK relay test file delivered by #2384; the body records the matching source blobs and selection audit. No failed test was retried or relabeled.

Relevant main worker initialization and proof-fixture corrections are now integrated as 065d408b90ee48e733aa38d00faf67bfac913f1b. That new combined source receives focused checks, types and mandatory preflight. A successful result requests explicit full hosted proof while this PR remains draft. #2334 and #2380 still need causal evidence; the successful controls do not settle them.

[schlessera]

Qualification of integrated Storage candidate 065d408b90ee48e733aa38d00faf67bfac913f1b stopped at focused-integrated-proof. Each completed command retains its actual result; no successful result is discarded and no unchanged retry was requested. The PR remains draft, with #2334 and #2380 still open. The command and source receipts are retained for diagnosis.

[schlessera]

The diagnosed #2409 caller-fixture correction is committed as 9c4419b2df85c9ef69fd91c768369d713954e743. The original integrated run remains 91 pass / one fail. Corrected generated-input proof passes 20 tests / 88 assertions; an old-caller mutation fails the same named positive (19 pass / one fail), and restored proof passes 20 / 88. Production hashes and rejection guards are unchanged. All frozen-helper consumers were inspected; the other positives retain their existing independent producer owner. Lint passes.

The current combined candidate now receives focused integration, strict types and required local preflight. Successful local proof will request an explicit full CI run while the PR stays draft. #2334 and #2380 remain open.

[schlessera]

Qualification of integrated Storage candidate 9c4419b2df85c9ef69fd91c768369d713954e743 stopped at required-local-preflight. Each completed command retains its actual result; no successful result is discarded and no unchanged retry was requested. The PR remains draft, with #2334 and #2380 still open. The command and source receipts are retained for diagnosis.