nixpkgs' WebKit (WPEWebProcess) aborts on its first page inside the
self-hosted runner VMs, though not on the host with the same sandbox;
its OPFS specs skip on a runtime probe anyway. Re-add --project=webkit
once the abort is understood.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Every CI build is now a derivation in nix/ci.nix, so the self-hosted
runners substitute it from titan's harmonia cache instead of rebuilding:
- checks.clippy, checks.test (with the --check-evidence gate, which
needs the compiled tests), checks.wasm-check (per crate, no feature
unification), checks.harness-lint (opfs-contract fmt + clippy)
- packages.web: harness/build.sh unchanged -> the three wasm bundles
and harness/serve; packages.site re-assembles with the commit as the
cache-bust token
- packages.ci-deps: the crane dependency builds, for titan's cache
timer to keep rooted
Dependencies are separate buildDepsOnly derivations keyed on the lock,
so a PR that leaves Cargo.lock alone rebuilds only the workspace. The
script-only checks (node, kb, checkers, comment/CI-graph gates, fmt)
stay dev-shell steps: they compile nothing, and their enforced
`#!/usr/bin/env bash` cannot run in the build sandbox.
ci.yml's build, test, wasm and harness-lint jobs now run `nix build` on
these; rust-cache and the PATH workaround for it are gone. Job names
and the deploy graph are unchanged.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
refused_here (from #286) ran before commit() consulted the capture and,
for the commit keys, judged the cell under the cursor. After a reframe
left the cursor on an aggregate, a captured editor's Enter was declined
on every retry. The commit-key guard now applies only to an editor that
captured nothing.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze
#274's capture read the cell through the cursor's offsets and stuck, so a
scrolling Enter captured the old window's cell even with every reply
delivered (improvise-7mro's horizontal wrap: Jan/Revenue for Feb/Revenue).
#286's cell_at_cursor reads through projected_at, so the capture waits
until the host projects the cell. Taken by merge, not by port: the matrix
test's held cases need #282/#277's waits too.
Resolutions: committable_cell_key takes #286's uneditable(); the two unit
CellId::Coordinate patterns become struct patterns; evidence is appended
on both sides.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze
An awaited seed waits for a cell the host projected (id present), never the
blank a relabel leaves between a frame and its cells. The advance's reopen
keeps #282's shape: on this base the welded clear-buffer empties it anyway.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze
improvise-dndu, from #245's review and Codex. Resolving the ci.yml
conflict with `git checkout --theirs` took #228's whole file, not the
conflicting hunk, so #245's `test`-job step running
`check-harness-lock.sh --allow-network` against the real harness lock
went with it. `git diff 1bec7c0ff41a946b -- ci.yml` was empty: CI kept
only the kb row's self-test, which never reads the real lock. The merge
message's "the --allow-network step is unchanged" was wrong; this
supersedes it.
The four lines are restored after the fmt step, where #245 had them.
The evidence note records that the self-test and the network step are
two different checks, and how to verify a conflict resolution against
each parent.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze
cell_at_cursor and seed_at read through projected_at, and cell_at (the
cursor-offset read) is gone. A cell of the grid outside the window the
cache holds is unprojected: i and an advance open an editor awaiting its
seed, which the fold settles once the host projects the cell, and a
commit, x, yy or p on it waits out loud rather than composing anything.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze
Recomposes #245 onto #228's CI table. The kb job's checker step no
longer lists suites by hand: it runs `checkers.sh --ci kb`, and
check-ci-graph.py holds the ci_suites table to `checkers.sh --list`.
So check-harness-lock joins the table's kb row, with the one-line
reason that the old ci.yml comment carried. The conflict in ci.yml is
resolved to #228's step. The --allow-network step is unchanged.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze
Carries #268 onto #258's new head, which now sits on #247's re-merge
(12f206fb) and so on #239's spanned_values and &Expansion signatures.
Code auto-merged: GridLayout::evaluator / GridEval stays the only public
path to a FoldMemo, and prune_empty still shares one memo. The one
conflict was benches/grid_projection.rs's main(): both new sections kept,
the pruned block kept directly after the folded chain it calls "the same".
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze
Carries #258 onto #247's re-merged head, which now has #239's
spanned_values/spanned_positions and the &Expansion fold signatures.
Code auto-merged: FoldMemo::new(agg, covers) still owns both, and
fold_stored reads through spanned_values. The only conflicts were the
append-at-EOF evidence files (command.md, core.md); both sides kept.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze
The gate split on \n alone while YAML also breaks at U+0085, U+2028 and
U+2029, so an if: after one was invisible and the gate exited 0. Every line,
comments and block-scalar bodies included, is now checked for C0 (but tab),
DEL, C1 and U+2028/2029. CR is folded by the one read path, read_workflow, and
file-based controls pin that. Argument: context/code/tooling.md.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze
Answers the ChatGPT Codex P2 on ba3d2875. Grids looked the view up through
resolve_view, whose read-side fallback to the default accepted SetCell
{ view: "Nope" } wherever Default drew the record. The view is now looked
up strictly, and a stored record is gated too, so a missing view is
RecordGone at the basis check for every record.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze
Both PRs added ClientState::notify, so the merge failed with E0592. #266's
is kept: it queues the sentence through fold_outgoing, which runs
settle_status, so the owner is still recorded. #279's direct-write notify
is deleted.
#266's rebase() rebuilt the view without settle_status, so a relay that
moved the view off the editor left the message owned, and an equal
editor reopened afterwards took it back. rebase() now settles it, pinned
by a_rebase_off_the_editor_ends_the_message_standing (red before).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze
From PR #280's review.
improvise-s2gb: every_silent_binding_is_on_the_list walked Normal and
search mode only, so a black hole bound in FormulaPanel (the reviewer's
Z -> commit-export) passed the whole suite. The modes are now derived:
reachable_modes starts from both halves of Normal (the grid, not a key,
picks RecordsNormal, e5pf) and closes over the modes a pressed binding
lands in. Doors `declined` shuts (the three stranding prompts, the
import wizard, records editing, search now that `/` declines) fall out
with no list to maintain. A floor assertion names seven modes the walk
must reach, so it cannot pass by shrinking. furnished_to_type seeds the
mode's own minibuffer as well as the search query.
`heard` counts a SetStatus as a decline only when it says something: a
resolver answering SetStatus("") left the user seeing nothing and passed
this guard, caught only incidentally by the Ctrl-Q tests.
Merges #275's new head (improvise-4k1j) and fixes the fmt gate.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze
Enter or Tab on a typed-into editor over a fold or a formula's cell went
Upstream, which nothing answers. refused_here declines the step, which
takes the whole binding with it, exactly as the TUI's failed
committable_cell_key does: status said, buffer and mode kept.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze
A multi-line flow value (- name: [a, "b ... run: ... c: x"]) is one string to
go-yaml, PyYAML and Psych, but the gate counted the inner run:. Rather than
refuse one more construct, values are now an allowlist: empty, a block header,
a closed quote, a one-line flow with no quotes or nesting, or a plain scalar
not starting with an indicator. The real ci.yml needs nothing else.
Argument: context/code/tooling.md.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze
App::grids() memoises the named view's layout for as long as it borrows the
App: once for a whole frame check, once in model_effects. A frame of n writes
to another view's empty records now derives 1 + 2n grids instead of about 5n.
Empty-record ClearCell on 18k cells with a formula, M4 Max: 1.44s -> 0.66s.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze
declined_at indexed the cache with the cursor's offsets, which the
client's own outgoing frame moves before the host's projection arrives.
A wrapping Down read the old window's top row and closed an editor on
Revenue/Feb with Profit's refusal. projected_at reads against
AxisFrame::first, so a stale cache answers None instead.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze
renamed_away() is a Step::Declined, like still_waiting(), so the Enter
binding's welded clear-buffer no longer empties the editor the user must
Esc away from. Shared by the value and rename paths. Red first:
a_retry_whose_cell_is_gone_keeps_the_typed_text failed with Some("").
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze
improvise-4k1j, from PR #275's review. hidden_row_item refused on a fold
only when the NEAREST group header was collapsed. Under two row
categories that header can be the inner one's: with Region's Coast
collapsed and Product's Kit expanded, the client composed
HideItem{Region, "Coast"} and a twin host wrote a group name into the
document, where the host refuses.
The frame cannot answer this on gh/main: FrameGroup names no level and
an inner GroupEnd reads as an outer one. So FrameEntry::Item now carries
the layout's own DataItem::collapsed flag (a fold, or under one, at any
level) and AxisFrame::folds reads it, the same bit
GridLayout::row_folds_a_group reads. FrameEntry::item builds an
unfolded one, as AxisEntry::item does.
hiding_agrees_with_the_host_on_every_row_of_nested_groups presses H on
all 25 rows of four nested grouped grids, in two windows each. It was
red on the nearest-header check at rows 4 and 5, as the review found.
Also fixes the fmt gate the review found red: fmt-workspaces.sh is a
check, not a formatter, and its diff output was misread as success.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze
GIT_CONFIG_GLOBAL=/dev/null and GIT_CONFIG_NOSYSTEM=1 in run_git were
witnessed by a config excludesFile, which vwjj's -c
core.excludesFile=/dev/null outranks. So dropping either line passed
every test from vwjj onwards.
The hostile child's config, read as both GIT_CONFIG_GLOBAL and
GIT_CONFIG_SYSTEM, now also sets core.sharedRepository = nonsense.
Measured on git 2.55: git init and git add die on it, git ls-files
does not read it (so the walk, which does not null the user's config,
is unaffected), and run_git passes no -c for it. init.defaultObjectFormat
and init.defaultRefFormat were tried first; they only warn.
Dropping either env line is now red. Every other rival in the combined
test is unchanged, and there is still one child per test.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze
8phw: when A's Enter crossed B's HideItem, the LayoutMoved refusal replayed
the editor over South and settle_opened recaptured South/Cost, so the
retry wrote there. #251's Opened::Retry/Gone now covers values:
written_to() recognises SetCell/ClearCell as well as a rename, and Retry
and Gone carry the whole OpenedTarget, which the recapture must match.
A Gone value editor declines with RECORD_RENAMED_AWAY. seen stays
rename-only.
Codex P2 on #274: commit picked value/rename/create from the cell under
the cursor before it consulted the capture, so a reframe that left no
cell there sent a captured editor's Enter upstream. commit now
dispatches on opened.target(); only an uncaptured editor is dispatched by
the cursor. A records grid's measure cell is not captured as a value,
since the browser still declines it.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze
The two generator strategies re-parsed the grammar inside their
prop_map, once per generated case: the same defect improvise-8shu fixed
in improvise-io. A OnceLock takes the lib test binary from ~0.9s to
~0.06s on the same machine and load.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze
tests/shipped_documents_load.rs re-ran itself in 18 child processes, one
per hostile setting, and each child spawns several gits. So the binary
took 2.1-3.3s against design-principles 7's 2s-per-binary tripwire.
The six per-setting tests (53zz x2, vwjj, pr3i, a0i3 and 2iws/vav0) are
now one test, a_hostile_git_environment_changes_nothing. It has two
children: the gzip shape test and every_shipped_document_loads. Each
carries every setting at once:
- the template dir;
- the global and system config (with trace2 targets);
- XDG_CONFIG_HOME;
- GIT_DIR and GIT_INDEX_FILE;
- the five pathspec and attribute settings;
- the six trace variables.
Afterwards the test asserts the outer index is still empty.
Each setting breaks the walk on its own, so a rival that drops one
defence leaves that setting live, and the child fails. Every rival that
was red against the per-setting tests is red against the combined one.
The rivals that were green before are green now:
- ICASE;
- the trace2 names under the 0 override;
- the GIT_CONFIG_GLOBAL and NOSYSTEM nulls, whose excludes witness vwjj's
-c override masks. That last pair is filed as improvise-3j70.
Measured on an Apple M4 Max, three workspace runs each: this binary went
from 2.10-3.31s (load 37-39) to 0.57-0.91s (load 30-33). It is now
below the next-largest binary in every run.
The evidence sections keep their reasoning, under prose headings.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze
The tracker closed a multi-line quote on an escaped \" or a doubled '', so a
later quote reopened it over a job's real if:. Both styles exited 0 on the real
ci.yml. The opening line is refused instead; _opens_quote's escape handling
is now load-bearing and has a case per style. Argument: context/code/tooling.md.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze
`fold_frame` wrote the rejection sentence straight into `view.status_msg`,
so it was in neither `settled` nor `in_flight`, and the xd3q rebase erased
it whenever a relay queued behind a frame still in flight: an in-flight
frame's own `SetStatus` was replayed over it.
`ClientState::notify` queues the sentence as a view-only entry at the tail
of `in_flight`, where `fold_outgoing` puts a frame the host never answers.
Frames sent before it replay first, relays queue ahead of it, frames sent
after it may replace it, and it settles when everything ahead is answered.
Writing it into `settled` too was tried as a rival and fails the same way.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze
OpenedCoordinate becomes #274's OpenedCell, now carrying #251's seen
(filled for a rename only) inside Opened::Target. Retry/Gone keep #251's
rename-only semantics in this commit; the value-cell retry (improvise-8phw)
follows. #221's superseded "a retry after a refusal is a force" paragraph
is dropped in favour of #251's rule.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VdfEGXA7aJ6ftMsCc9PJze
Ed Langley