fix(editor): preserve saved content and verify browser coverage

[chaxus]

Reloading after a completed save could reopen older recovery/original bytes, copied editor pages could invalidate each other's source, and valid Gemini artifact revisions or cached mirror selections could fail. Preserve the saved source and its ownership across these operations, and make deployment/browser verification identify the exact version and complete test set.

Merge Verdict

[APPROVE]

Independent scoped reviews and a fresh whole-branch review approved the final implementation after storage ordering, provenance, bounded retention and key-only read findings were fixed.

Summary

• Persist current saved bytes before clearing dirty; preserve later snapshots, row incarnations after quota eviction, subsequent typing, disk-write ordering and cross-document ownership. Repeated saves update one runtime-owned slot; copied/reopened pages receive independent slots without deleting inherited sources.
• Preserve encoded remote document URLs; accept Gemini's normal JSON/SSE STOP for artifact revisions while rejecting tools/abnormal endings; use full cached model source identity for selection, persisted settings, provider reuse, active state and deletion.
• Stamp actual builds with source revision and served-tree digest, fail bounded production polling on stale/missing deployments, and verify deployed PR-head identity before preview smoke. Split nightly ordinary WebKit/Firefox tests into three measured LPT shards per engine, retaining exclusive serial execution, reports and aggregate failure propagation.

Risk Analysis

Risk	Level	Mitigation
Save/source ordering and recovery precedence	Medium	Real save-stream/IndexedDB races, deletion/quota/expiry/provenance regressions and real editor save/reload/copy tests
Same-ID model destinations	Medium	Real settings/catalog/panel integration; loaded source captured separately from editable controls
Deployment identity on different hosts	Low	Actual tree generator/HTTP polling tests, no-store rules, worker bypass and real preview identity gate
Browser partition completeness	Low	Actual CLI union/disjointness per engine, serial isolation, 16 aggregate-result combinations and distinct artifacts

Design Decisions

• Keep existing history/source stores, expiry periods, embed shapes, dirty/savepoint protection, read-only behavior and disk-write serialization. A saved source's revision boundary is paired with the history row's creation identity and follows the actual recovered File rather than stale copied sessionStorage metadata.
• A loaded runtime owns its mutable save slot. Copied pages detach into their own slots; inherited records remain under the existing 24-hour expiry/explicit deletion policy. A dormant inherited pointer may see the latest saved bytes of that same document before opening. No reference-counting store is introduced.
• Prepare replacement bytes before atomic writes, preserve old recovery on failed storage, and use key-only existence/deletion checks so repeated saves do not clone old payloads. Validate the SDK point before source retention and again before clearing dirty; later typing keeps saved bytes while leaving dirty set.
• Compare source SHA exactly for deployment. The digest records the host's actual served tree; SW timestamps and Docker WASM encodings intentionally differ across builds. Git archives without revision metadata get an explicit content identity, not a guessed commit.
• Preserve workers, retry counts, L0 policy, corpus cadence/defaults and aggregate check names. Only ordinary browser suites are sharded; serial cases run once per engine on separate runners even after ordinary failures. Manual browser validation excludes the unrelated weekly corpus matrix.
• Provider regressions exercise deterministic HTTP fixtures and real parsing/UI boundaries; paid live-provider and hardware model downloads are outside this verification.

Code Concerns

No unresolved findings remain from independent code review. Final-head main CI, preview and nightly workflows all passed. One existing WebKit composer scroll assertion remains flaky and passed its configured first retry; its trace/report is retained and the observation is disclosed below. Both heads passed their first workflow attempts; a fresh complete validation was run after the main synchronization, with no increased timeouts, workers or retry budgets.

Verification

• Before main synchronization, full local unit coverage: 253 files / 6813 tests passed, with two local workers; statements 87.63%, branches 83.72%, functions 88.52%, lines 90.18%; all configured thresholds passed.
• An earlier unbounded local run was interrupted after unrelated test timeouts during severe shared-host contention. The full bounded rerun passed; no test timeouts or CI retries were increased.
• Production build, formatting (including 1511 immutable evaluation artifacts), lint/TypeScript and Compose validation passed. Actual build identity matched the current implementation revision, and the served marker returned Cache-Control: no-store.
• Real production-build browser regressions: 17 passed / 1 existing WebKit writable-OPFS capability skip, no retries: save followed by immediate reload with/no old snapshot, copied-page recovery, exact file/src HTTP request paths and delayed recovery export overlapping manual save.
• AI/model scope: 319 focused tests passed, including actual Gemini JSON/SSE transports and real cache settings/catalog/panel behavior.
• Storage review regressions: 192 focused tests passed; the final key-only optimization then passed 68 tests across three affected files, including deletion during replacement and absent/expired slots.
• CI/deploy scope: 210 focused tests passed, including actual HTTP stale/missing/malformed/error/hanging markers, real CLI partition selection and all 16 ordinary/serial aggregate verdict combinations. New files receive a measured-engine median fallback.
• RED/GREEN evidence is recorded in the exploration document: URL request corruption, Gemini completion, mirror source loss, saved recovery rollback, copied references, row eviction/recreation, source retention growth, stale pointer provenance and prior-payload reads.

Completed verification before main synchronization

The first nine commits were verified at b31cb213bc9c4fb269293ee8a324a09a9599d205. After CI completed, main advanced to 95c68f82, introducing a Service Worker conflict. A tenth synchronization commit preserves both the deployment marker bypass and the broader upstream API bypass. All original commits remain intact.

• Main CI: success, including 253 unit files / 6813 tests, the same coverage percentages above, all default-preview/Docker/Pages E2E shards and aggregates, and timing budgets.
• Real Cloudflare preview smoke: success, 41 tests passed. The deployed identity gate and an independent HTTP request both returned the then-current head, served-tree digest a459ba9be7f0b423156f026947bfb64ec892e9d2b1beb116466edff06b4bd9da, and Cache-Control: no-store from the deployed preview.
• Complete nightly browser and budget workflow: success. All six ordinary shards, both exclusive serial jobs and the existing aggregate passed. Browser totals: 642 passed, 3 flaky (passed on the configured first retry), 61 skipped; serial tests contributed 2 passes per engine. UI crawl 3 passed and throttled-network budget 1 passed. The unrelated weekly corpus matrix was explicitly skipped for this manual browser validation.
• All eight distinct browser artifacts were uploaded. ZIP integrity and the unique HTML entry paths were checked for one ordinary and the serial report of each engine; no collisions were found.
• Semantic PR validation: success. PR-body updates trigger a fresh semantic check, which is verified before handoff.

Retry observations before main synchronization

These are successful CI runs, not zero-retry runs. Each case below passed its configured first retry, with no workflow rerun or retry-budget change. Logs identify the failing observation; they do not establish a common root cause.

Run	First-attempt observation
Pages shard 2: existing boot-state open retry	Editor did not report load completion within its existing 120-second wait
Firefox shard 2: added copied-tab regression	Initial editor readiness timed out before the copy/reopen operation began
Firefox shard 1: strengthened save/recovery regression	Initial text insertion was not observed within the existing 5-second assertion, before the held-conversion fault was installed
WebKit shard 3: existing composer UX	Historical log scroll position changed after editing the next draft

All corresponding trace/report diagnostics are retained by the workflow where artifacts are configured; main CI uploads only on job failure, so the successful Pages job retains its log but has no uploaded failure artifact.

Final-head revalidation

Final head: 82268bfe5aecaf5e9837812c22efb5838cf15c22, containing main 95c68f82; 10 commits are pushed. The combined Service Worker, source UI and model settings regressions passed 118 tests across six files; lint/TypeScript, formatting and diff checks passed locally.

Final-head workflow	Result
Main CI	Success: 252 unit files / 6796 tests; coverage 87.79% statements / 83.94% branches / 88.77% functions / 90.25% lines, all thresholds passed. Default-preview 335, Docker 339, Pages 335 and timing budgets 2 passed; zero flaky/retry cases
Actual Cloudflare preview smoke	Success, 41 passed, zero retry cases; exact deployed head verified at the preview, digest 6086b8174659c766a8b7c7f23c9408a8c255cae47211fad48bc7ea39b9b94178, with independent HTTP Cache-Control: no-store verification
Complete nightly browsers and budgets	Success: all six ordinary shards, both serial jobs and aggregate passed; 644 passed / 1 flaky (configured first retry passed) / 61 skipped; serial 2 passed per engine, UI crawl 3 passed, throttled-network budget 1 passed
Semantic PR validation	Success on the final head; the check triggered by this final body update is also checked before handoff

The unit-count change follows upstream's connector removal; this branch retains its regression tests. The weekly corpus was explicitly excluded from this manual browser/budget validation. All eight final-head browser artifacts exist with distinct names; ZIP integrity and unique HTML paths were checked for one ordinary and the serial report per engine.

The one remaining final-head flaky observation is the existing WebKit agent-composer-ux.spec.ts historical-reading-position assertion after workspace navigation: expected scrollTop=0, observed 1449 (line 163). It passed the configured first retry. This is recorded as remaining browser-test flakiness; no timeout, retry, worker, skip or assertion policy was relaxed. The copied-tab and overlapping-save regressions that had setup flakes in the earlier cycle passed without retries on this final head.

[cloudflare-workers-and-pages]

Deploying document with    Cloudflare Pages

Latest commit:	82268bf
Status:	✅  Deploy successful!
Preview URL:	https://c9debbfd.document-7hm.pages.dev
Branch Preview URL:	https://codex-recovery-source-and-ni.document-7hm.pages.dev

View logs