Backups opened a second node:sqlite connection against the live fusion.db
and ran PRAGMA wal_checkpoint(TRUNCATE) before copying. A node:sqlite
SIGSEGV mid-checkpoint (the recurring pager_write crash noted in db.ts)
could leave the main DB file extended-but-zeroed, which is exactly the
failure mode that wiped a 1GB fusion.db tonight.
Replace the in-process checkpoint with a plain cp of the main DB plus any
sibling -wal/-shm files. SQLite replays the WAL on first open, so
uncheckpointed pages survive without us ever opening a second connection
against the live database.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The merge adds a post-completion defensive backstop that probes and removes stale same-task `activeSessionRegistry` entries on `done`/`archived` transitions, completing FN-5346 with a shared reconcile helper, a defensive ownership probe wired into paused cleanup, audit event alignment, and regressio
Fusion-Task-Id: FN-5346
Add room open performance diagnostics and warm cache hydration for room switches (FN-5388). The implementation adds a timing instrumentation utility, SWR cache constants, warm-room handoff logic in `useChatRooms`, and a documentation file covering the performance model, accompanied by regression tes
Fusion-Task-Id: FN-5388
FN-5407 adds paired central backup support to the Fusion task management system, with both the core backup engine and CLI commands updated to handle central database backup pairs. Documentation was updated to reflect the new capability, and two stabilization fixes were included to handle central bac
Fusion-Task-Id: FN-5407
FN-5389 adds dashboard resume event instrumentation: a `resumeInstrumentation` utility captures SSE resume signals, wired through `useChat`, `useChatRooms`, and `useTasks` hooks, with remount markers in `Board` and `ChatView`; diagnostics routes expose resume events for observability, documented in
Fusion-Task-Id: FN-5389
Preserve chat scroll state across view transitions in ChatView, with comprehensive test coverage. The feature adds scroll position persistence logic gated behind a debug trace flag, and a full test suite covering the scroll state behavior.
Fusion-Task-Id: FN-5380
Removes a title-length guard from mission routes (4-line deletion in `mission-routes.ts`) and adds end-to-end coverage for long interview mission titles (`mission-e2e.test.ts`).
Fusion-Task-Id: FN-5406
Removes the speculative orphan requeue mutation path from self-healing, replacing it with an observation-only sweep that no longer attempts to re-enqueue orphaned tasks — a conservative regression that eliminates noisy false-positive recovery attempts. The change includes rewritten unit coverage, a
Fusion-Task-Id: FN-5337
Added manifest-gated checksum verification for cloudflared remote access tunnels: a pinned manifest validator (Step 1) and enforcement logic (Step 2) wired into the settings memory routes, with aligned tests and documentation covering fail-closed install behavior and pending-manifest guidance.
Fusion-Task-Id: FN-5375
Follow-up to c64884c24 addressing three review findings, including one
real interaction bug caught by a new test.
MEDIUM
- Re-indented and rewrote 'if (directReuseEligible) try { ... } catch'
as 'if (directReuseEligible) { try { ... } catch { ... } }' with the
whole body at one consistent indent level. No behavior change \u2014 fixes
the mismatched indentation from c64884c24 where the body sat one level
deeper than its containing block.
LOW
- Two new backstop tests in merge-reuse-task-worktree.test.ts:
* 'preserves worktrees with uncommitted tracked changes' \u2014 asserts the
fast-path leaves a tracked-dirty worktree alone (result.worktreeRemoved
is false, dir still exists). Without this, a future refactor could
silently re-enable destructive cleanup.
* 'cleans up worktrees with only untracked noise' \u2014 asserts untracked
junk (.DS_Store, editor swap files) does NOT block cleanup. Also caught
a real interaction bug: 'git worktree remove' without --force refuses
on untracked files, so the LOW finding's intent (drop noise, preserve
tracked dirt) needs --force on the removal call. Restored --force with
a comment explaining why it's safe (the tracked-only dirty check above
already refused if there was real work to preserve).
- Switched 'git status' check from '--untracked-files=normal' to
'--untracked-files=no'. Tracked modifications and staged changes still
block cleanup; untracked junk is correctly ignored. Dirty-skip warn log
now includes the first 5 dirty paths for operator diagnosability.
Tests
- Full @fusion/engine suite: 448 files / 5883 tests / 9 skipped, all green
- pnpm lint green, pnpm build green
Follow-up to 8e6740468 addressing six review findings, including one real
regression (combined short flags bypass amend detection).
HIGH
- Combined short flags ('-am', '-vm', '-sm', '-aF', ...) now count as
message-supplying tokens in the prepare-commit-msg empty-commit guard.
Previously, an agent could bypass the guard with
git commit --allow-empty -am 'fix --amend handling'
because '-am' did not match the literal '-m' case, so the token loop
continued past the message text and matched the '--amend' substring inside
it. The new pattern -[!-]*[mF]* matches any short combined flag containing
'm' or 'F' while leaving '--amend' (starts with '--') untouched.
Verified locally with two regression tests for '-am' and '-vm' plus one
positive test confirming legitimate '-am' with a real tracked modification
still succeeds.
MEDIUM
- Early empty-own-diff fast-path cleanup no longer uses 'git worktree remove
--force'. We now run 'git status --porcelain --untracked-files=normal'
first; dirty worktrees (or status-check failures) are left alone for the
self-healing sweep to reconcile later. Prevents silent loss of uncommitted
scratch in the no-op finalize path.
- MergeResult.task is now kept in sync with the DB after early-fast-path
cleanup. After 'store.updateTask(taskId, { worktree: null, branch: null })'
succeeds, the in-memory task.worktree/.branch are also cleared to undefined
so the returned result.task does not advertise a removed path or deleted
branch.
LOW
- Branch deletion in the fast-path cleanup only fires when 'task.branch' was
non-null on entry. If the task did not explicitly own a branch on entry,
we never invoke 'git branch -D'; orphan refs are left for
cleanupOrphanedBranches to handle. Prevents deleting a stray ref that
happened to share the canonical name.
- Inverted the empty 'if (poolBypassRequired) {} else { ... }' block in
reacquireReuseIntegrationWorktree to 'if (directReuseEligible) try { ... }'
with the pool-bypass note above it. No behavior change \u2014 just removes the
awkward empty branch and the one-level-deeper indent on the direct-reuse
logic.
Tests
- Full @fusion/engine suite: 448 files / 5881 tests / 9 skipped, all green
- pnpm lint green, pnpm build green
Follow-up to 1983dac6e addressing nine findings from a code review of the
FN-5345/FN-5377 engine fixes. Includes a real bug fix (commit-message bypass
of the amend detection), two reliability invariant restorations (FN-4811 +
FN-4954 in the new D3 reuse-fallback path), a resource-leak cleanup, plus
test/audit/taxonomy polish.
HIGH
- D3 reuse-fallback now respects FN-4811 active-session safety: matches whose
path is currently owned by a different task in activeSessionRegistry are
skipped, never silently rebound. Skipped owners are recorded in audit
metadata for forensics.
- D3 reuse-fallback now respects FN-4954 pool-lease bookkeeping: when
recycleWorktrees=true AND a worktree pool is attached, the direct-reuse
shortcut is bypassed and the existing acquireTaskWorktree path is used so
WorktreePool.acquire/.release stays consistent. Without this guard the
new path could trip PoolDoubleLeaseError.
- prepare-commit-msg amend detection tokenizes the parent command line and
stops at the first message-supplying flag (-m/-F/--message/--file/=variants)
so a commit message containing the substring '--amend' cannot bypass the
guard. New regression test in prepare-commit-msg-empty-guard.real-git.test.ts.
MEDIUM
- Early empty-own-diff fast-path extracted into tryEarlyEmptyOwnDiffFinalize()
helper. Removes the exception-as-control-flow sentinel ('skip-early-fast-path:
not-reuse-mode') in favor of a plain if (eligible) { try { ... } catch {} }
block.
- Fast-path best-effort cleans up the stranded fusion/<id> worktree and branch
before completeTask(), so empty-own-diff residuals do not accumulate in
.worktrees/ or the branch namespace. FN-4811 guard ensures we never remove
a foreign-owned worktree.
- Two new audit subtypes in run-audit.ts replace the prior overloading of
merge:reuse-fallback-new-worktree:
- merge:reuse-fallback-pruned-stale-registration
- merge:reuse-fallback-reused-existing-registration
merge:reuse-fallback-new-worktree is now reserved for actual new-worktree
creation. Local emitReuseHandoffAuditEvent type union updated to match.
- New direct classifier test in merger-finalize-unproven.real-git.test.ts
('classifies proven-no-op for empty-own-diff branches') covers the new
branch in classifyOwnedLandedEvidence that self-healing and post-handoff
paths also depend on.
LOW
- Alpine/busybox ps fallback: prepare-commit-msg hook reads /proc/$PPID/cmdline
if 'ps -o args=' returns empty (busybox ps often lacks '-o args=' support).
- New backstop test variant 'FN-5345: empty-own-diff fast-path fires even
when branch is registered to two worktrees' reproduces the actual FN-5345
production wedge geometry where fusion/<id> was double-registered to two
worktrees.
Tests
- Full @fusion/engine suite: 448 files / 5881 tests / 9 skipped, all green
- pnpm lint green, pnpm build green
Three engine-level fixes for the in-review wedge class identified via FN-5345
(verification-only task with empty handoff commit + drifted worktree mapping
escalating to 'merge-deadlock-detected: verified content not on main' after
FN-4999 completion-handoff-limbo recovery exhausts).
D1 — prepare-commit-msg empty-commit guard
Fusion task worktrees install a prepare-commit-msg hook that refuses
'git commit --allow-empty' and other zero-staged-diff commits. Amend
(detected via $2==commit source arg or '--amend' in 'ps -o args= -p $PPID')
and merge/squash/cherry-pick/revert/rebase ceremonies are allowed.
D5 — early empty-own-diff fast-path in aiMergeTask
In reuse-task-worktree integration mode, BEFORE any reuse-handoff acquisition,
detect branches with own_commit_count >= 1 but zero net diff vs merge-base
(git diff --quiet <mergeBase>..<branch>) and finalize as no-op with
mergeDetails.noOpMerge=true + task:auto-recover-finalize-already-on-main
audit (reason: empty-own-diff-early-fast-path). cwd-main integration mode
is unchanged. classifyOwnedLandedEvidence also detects empty-own-diff so
self-healing and post-handoff finalize paths benefit too.
D3 — reuse-fallback consults existing branch registration
Before creating a fresh worktree in merger's reacquireReuseIntegrationWorktree,
consult 'git worktree list --porcelain' for existing registrations of
fusion/<id>. Reuse extant usable registrations directly. Prune stale
registrations first. Eliminates FN-5083-class double-registration where
'git worktree add -f' on an already-registered branch produced two worktrees
both claiming the branch and wedged the next handoff gate.
Tests
- New real-git backstop: prepare-commit-msg-empty-guard.real-git.test.ts
- New reliability interaction backstop in merge-reuse-task-worktree.test.ts
('FN-5345: empty-own-diff branch auto-finalizes via early fast-path')
- commit-msg-trailer.real-git.test.ts updated to use real commits (it was
relying on --allow-empty, which the new guard now refuses)
- Full @fusion/engine suite: 448 files / 5879 tests / 9 skipped, all green
- pnpm lint green, pnpm build green
Removes the branch-recovery CLI surface, orphan-rescue engine primitives, and their associated tests (over 1,500 lines deleted), while restoring a minimal prune-only orphan branch sweep with proper git audit mutation types. Documentation across `cli-reference.md`, `task-management.md`, and `AGENTS.m
Fusion-Task-Id: FN-5329
Implements selective room composer restoration — the dashboard now classifies room send failures and gates composer restoration by error type, preventing spurious recovery on transient delivery errors while preserving composer state only for actionable failures. Covers the new classification logic i
Fusion-Task-Id: FN-5360
Implements external integration validation (FN-5321) with a manifest validator scaffold, worktrunk manifest wiring, and an evidence gap detector that runs during spec validation and triage; the reviewer also gates on external integration readiness. Includes tests for manifest, evidence gap, and tria
Fusion-Task-Id: FN-5321
Restores the activity feed event map in `ActivityFeed.tsx` that was missing after the merge, fixing a typecheck failure introduced by the prior commits.
Fusion-Task-Id: FN-5290
The merge introduces an engine-activation timestamp as the staleness floor for task age calculations, replacing arbitrary wall-clock thresholds with a runtime-relative anchor. Step 1 adds settings defaults, Steps 2–4 wire the floor helper through project engine, in-process runtime, and task store hy
Fusion-Task-Id: FN-5223
The merge delivers several meaningful features and fixes: a **priority-aware overlap deferral fix** (FN-5325) in the scheduler that aligns the queued-overlap helper with the priority-sortable type, preventing inversion; a **merge integration worktree feature** (FN-5279) with settings UI, reusable wo
Fusion-Task-Id: FN-5325
Adds an explicit duplicate-marker guard (FN-5220) spanning core helper, dashboard API endpoint, triage short-circuit, and self-healing sweep to detect and handle duplicate task creation attempts; includes comprehensive test coverage across unit, API, and integration layers plus documentation.
Fusion-Task-Id: FN-5220
Replaced a hardcoded `rgba` shadow with the design token `var(--shadow-lg)` in `DesktopLaunchGate`, added a regression test to catch raw `rgba` usage in component CSS, and removed an accidental changeset since the fix is dashboard-internal and doesn't require a published release.
Fusion-Task-Id: FN-5126
Adds direct thread viewport write functionality to ChatView with corresponding mobile keyboard regression test coverage, plus lint and test suite restoration.
Fusion-Task-Id: FN-5365
The merge fixes a stale cache-miss path in the heartbeat executor and adds `reports-health` diagnostics for cache-state reporting, with a regression test covering a sparse-cache false-positive scenario. It also adds a two-line tweak to the merger and updates the diagnostics documentation.
Fusion-Task-Id: FN-5362
The dashboard's git pull endpoint failed outright when the working tree had
local edits or untracked files. It now stashes (including untracked) under a
fusion-dashboard-pull-autostash label, performs the pull, and reapplies the
stash. If reapplying conflicts, the stash is preserved and GitPullResult
surfaces autostashed/stashReapplied/stashConflict plus a message pointing at
the stash label so the user can resolve from the Stashes view.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
In reuse-task-worktree mode the merger detaches HEAD in the task worktree so
the squash commit lands on detached HEAD; nothing previously advanced the
project root's local integration branch, so changes never appeared on main.
Step 5c now applies the squash to projectRootDir via git merge --ff-only,
falling back to a regular merge with AI conflict resolution if main has
diverged. pushAfterMerge (when enabled) now runs from projectRootDir where
the branch was just advanced, so parsePushRemoteTarget can resolve a branch
instead of failing on the worktree's detached HEAD.
Also tightens acquireReuseHandoff: the executor-lease check above the
queue-lease acquisition was non-atomic, letting a local executor grab the
task between checks. Re-check after acquisition and release the queue
lease with a precise diagnostic instead of proceeding into a generic
failure later.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The previous commit wired targetTaskId through the engine caller but the
store's acquireMergeQueueLease SQL still grabbed the queue head unconditionally,
leaving the no-lease loop intact. This lands the store-side change: when
targetTaskId is provided it attempts a direct-match UPDATE first; only falls
back to queue-head ordering if that row isn't available (backward-compatible).
Adds regression test covering the polluted-queue-head scenario (FN-5363).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
When targetTaskId is passed, the lease attempt must target that task only.
The previous code silently fell back to queue-head selection if the targeted
task was not available — producing a lease for a different task, then
returning it with the wrong taskId. acquireReuseHandoff would then see
lease.taskId !== input.task.id and emit a misleading 'no-lease' diagnostic
that hid the real cause (queue head was occupied by an unrelated task).
The fix: when targetTaskId is set and the lease for that task returns null,
return null immediately instead of falling through to the queue-head SELECT.
Callers (acquireReuseHandoff) already validate the returned taskId and emit
structured 'no-lease' diagnostics including acquiredTaskId so the polluter
is identifiable in audit logs.
Queue-head fallback is preserved for callers that omit targetTaskId
(backward-compatible).
The merge handoff path in acquireReuseHandoff called acquireMergeQueueLease
without a targetTaskId, which grabbed the priority/FIFO-sorted queue head
instead of the specific in-review task. When the queue head was a different
task (e.g. a polluted non-review entry), the returned lease had a mismatched
taskId and triggered 'no-lease' for every in-review task.
Fix:
- Pass targetTaskId: input.task.id to acquireMergeQueueLease so the merge
lane targets its specific task instead of grabbing the queue head.
MergeQueueAcquireOptions.targetTaskId is already wired in store.ts.
- Replace the broken typeof check (typeof object !== 'object' is always false
for plain JSON objects returned by RETURNING *) with a proper 'taskId' in
lease guard.
- Add acquiredTaskId to the no-lease error payload for better observability.
Reliability backstop: merge-reuse-task-worktree.test.ts guards this path.
Fixes: FN-5363
The behavioral cwd-main fallback is gone (fresh-acquire on refusal
replaces it), but the type string was left as a dead entry in the
emitReuseHandoffAuditEvent union (merger.ts) and the
DatabaseMutationType union (run-audit.ts). Remove both so the dead
string cannot be accidentally reintroduced.
Before: when reuse-task-worktree was configured but task worktree was missing/unusable,
merger fell back to cwd-main, losing the task worktree isolation benefit.
After: merger creates a fresh worktree for the task branch inline (using the standard
git worktree add pattern with identity guard installation) and retries the reuse handoff.
Only falls back to cwd-main if fresh acquisition also fails.
Three new audit events track the recovery path:
- merge:reuse-worktree-fresh-acquire — fresh acquisition started
- merge:reuse-worktree-fresh-acquired — fresh worktree created and bound to task
- merge:reuse-fallback-cwd-main — only when fresh acquisition itself fails (last resort)
Behavior:
- Missing/unusable task worktree → fresh worktree created, merge continues from it
- Fresh acquisition fails → cwd-main fallback (last resort, fully audited)
- Genuine liveness conflict (usable worktree but lease refused) → re-thrown, not masked
Regression test covers the missing-worktree case: verifies fresh acquisition + handoff
succeeds without any cwd-main fallback event.
After merge:reuse-handoff-refused with no usable task worktree:
- Acquire a fresh worktree and restore the fusion/<task-id> branch
from baseCommitSha before continuing merge
- Hard-fail only if fresh acquisition itself fails (not cwd-main fallback)
- Emit merge:reuse-worktree-fresh-acquire / merge:reuse-worktree-fresh-acquired
audit events around the acquisition lifecycle
Replaces the incorrect cwd-main fallback (499784581) with correct
reacquire path. Updates regression test in merge-reuse-task-worktree.test.ts
to assert fresh-acquire audit trail instead of cwd-main fallback.
Refs: FN-5353
When mergeIntegrationWorktree=reuse-task-worktree but the task has no
worktree or the worktree classifies as unusable, the merger now:
1. Creates a fresh worktree at the standard path with the fusion/<id> branch
2. Installs identity-guard hooks
3. Updates task.worktree + task.branch in the store
4. Emits merge:reuse-worktree-fresh-acquire / merge:reuse-worktree-fresh-acquired
5. Retries the handoff from the new worktree
Only falls back to cwd-main as last resort when fresh acquisition also
fails. Lease/liveness conflicts (worktree exists and classifies OK but
handoff refused on active-session or lease grounds) are re-thrown — not
masked with cwd-main.
New audit event types: merge:reuse-worktree-fresh-acquire,
merge:reuse-worktree-fresh-acquired
Clears agent logs when a task is soft-deleted, with new regression tests covering the end-to-end behavior and documentation updated in the storage guide. The core logic lives in `store.ts` while `store-upsert.test.ts` is updated to reflect the new expectations.
Fusion-Task-Id: FN-5143
Adds broad-scope advisory chips to TaskCard and banner to TaskDetailModal with comprehensive test coverage and a dashboard guide entry. TaskCard gains an inline advisory chip (with styles), TaskDetailModal gets a matching banner, and both components have dedicated test suites covering the new UI ele
Fusion-Task-Id: FN-5314
Fusion-Task-Lineage: cbc88f36-d029-4e4b-ac9c-32a77560b8b9
Implements the `mergeIntegrationWorktree` setting (FN-5279) that allows tasks to reuse their own worktree as the integration root instead of spawning a separate one. Steps 1–2 added the settings schema, types, and SettingsModal surface with documentation; Step 3 wired an integration-root resolver th
Fusion-Task-Id: FN-5279
FN-5275 aligns the fallback copy in TaskChangesTab with updated wording, and updates the corresponding test assertions to match the new text.
Fusion-Task-Id: FN-5275
- Add a merger guard that verifies source fusion/FN branch attribution when rebase capture reports zero own commits
- Fail finalize with explicit no-op attribution mismatch handling instead of marking mergeConfirmed on ambiguous no-op ranges
- Type and emit dedicated audit events for mismatch and source-ref-unavailable skip diagnostics
- Expand branch attribution, merger, and reliability interaction tests to cover the full no-op guard matrix
Fusion-Task-Id: FN-5304
Implements canonical worktrunk binary naming and manifest handling (FN-5320), adding a worktrunk installer that canonicalizes the executable name and manifest data, with documentation updates for architecture and settings, plus test alignments across routes, audit, and worktree acquisition fixtures.
Fusion-Task-Id: FN-5320
Fixes the main chat composer flex sizing so the input area properly expands (FN-5322), with regression guards in the autosize test suite and a new browser layout smoke script covering the composer expand behavior.
Fusion-Task-Id: FN-5322
Add regression tests for queued concurrency in the scheduler and tighten the memo key used to track queued tasks, improving correctness of scheduler dispatch decisions.
Fusion-Task-Id: FN-5319
