Give the built-in fake provider an explicit non-destructive stop operation and preserve its recorded identity through generic stop intent and restart recovery. Keep plugin capability enforcement unchanged.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Persist generic stop intent before provider dispatch, use the exact pinned StopLease capability for release and restart recovery, and retain saved allocations when capability or stop confirmation is unavailable.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Keep an active composer isolated while sending, then restore the shared draft on a later visit once no recovered work remains. Re-establish the mapping for new text, attachments, or pending intent. Scope the storage-failure test to sessionStorage on every platform.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Keep local recovery text and receipts in tab-scoped storage without acquiring a foreign submission or overwriting the shared draft. Fence only the retired shared key and restore recovered keys on task navigation.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Version new plugin-pinned intents and recover v1 from the exact lease recorded plugin without driver-key fallback or accepting mismatched explicit pins.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Refuse a duplicate driver key or unavailable original plugin during stop-only recovery; preserve the pending intent and fence later provider rebinding.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Hard uninstall removes plugin bindings but preserves the managed agent and its instruction history. Revalidate the registered stable-key declaration and refresh provenance atomically when relinking, so explicit reset can use its canonical revision authority.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
An explicit stock reset now compares the observed configured entry and target revision, preserves earlier entry history, and restores the declared canonical entry atomically. Retained historical entries do not masquerade as stock drift.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Record explicit managed-agent instruction resets through the canonical revision CAS path under exact plugin ownership and capability checks. Preserve prior content and plugin audit identity without synthetic user authority.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Use the committed database snapshot for native instruction bundles when disk projection is stale. Restage completed stopped working copies from the current head, while preserving live warm owners and original CAS fences for uncollected edits. Cover native stale projection, repeated stopped retries, resolved candidates, and no silent rebasing.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Register canonical instruction read, update, history, and restore operations in the reference-file group. Regenerate the catalog document while distinguishing live service and E2E evidence from legacy mock scenarios.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Restore the exact published SQL hashes so cloud preflight accepts upgrades from the already deployed instruction feature. Cover immutable SQL and journal hashes plus repeated migrator runs preserving revisions, pending edits, receipts, and company constraints.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Exercise a 190 MiB journal made of individually bounded event frames and document off-thread proof quotas, retained evidence, and nonblocking file admission.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Project ordinary semantic outputs and unused event headers away while preserving completion, process, and warm-transition authority. Account retained JSON bytes rather than discarded parser work, and open proof inputs without blocking on special files.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Exercise both scan and projection through a warmed real worker. Verify a writer-less FIFO is rejected and close completes, with a controlled finally writer release so the pre-fix blocking-open regression cannot strand CI.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Use one off-thread proof reader with a bounded queue, monotonic deadlines, heap limits and joined termination. Preserve raw hashes and canonical base64 fingerprints, and prove event-loop responsiveness on a 190 MiB journal.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Bound every listing to 64 MiB and 250,000 lines before extraction while preserving incremental validation of supported large workspaces. Cover exact boundaries, final lines, blank-line floods, and repeated concurrent attempts with child-reap witnesses.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Stream proof reads through a fixed buffer, retain only authority evidence, and preserve full-file digests and warm-transition fingerprints. Fail closed when essential evidence exceeds the bounded projection budget.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Record collection failure separately on the completed result before workspace restoration. Keep the provider exit, session, usage, and output when both cleanup steps fail, while keeping raw collector errors out of logs.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Collect in the execution boundary before the separate restoration callback. A collection rejection still restores and cleans up, but retains its own error instead of requesting workspace recovery.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Keep bridge and workspace cleanup in finally after the verified-stop collector. ACP records a bounded collection failure without exposing raw filesystem paths or preventing its normal teardown.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Preserve terminal unsafe-archive repairs and future retry delays when an earlier reconciler snapshot enters after the live owner releases copyback.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
