Make cloud sync exits and media durable

[SunkenInTime]

What changed

• Persist cloud media upload jobs in a versioned Hive outbox before the live queue accepts or advances them, then restore every strategy's lineup and placed-image work on startup.
• Keep local source images intact and fail closed when an image cannot be queued durably. Removed the destructive upload-cancel path.
• Let strategy and window close leave queued work behind only after all current edits are staged and both durable outboxes are reliable. The dialog says the work has not reached the cloud and will retry later.
• Derive the sync chip from connectivity first for ordinary transport failures, so an offline outbox reads Offline instead of Needs attention.
• Yield blocked media processing with delayed and reconnect-driven retries instead of spinning.

Verification

• flutter test test/cloud_media_upload_queue_provider_test.dart test/widgets/cloud_sync_status_chip_test.dart test/unsaved_strategy_guard_test.dart test/strategy_op_queue_provider_test.dart test/strategy_integrity_test.dart (73 passed)
• flutter test (615 passed, 2 expected environment-only skips)
• flutter analyze (no errors or warnings; 35 existing info lints)

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 98077d50-41c8-4cfd-8c79-e66ddd684616

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This change makes cloud-media uploads durable across restarts, scopes queued media to the signed-in account, and updates cloud sync and exit behavior for retained work.

Focused Flutter coverage confirmed that staged media waits for durable strategy persistence, account-A media cannot run under account B, ownerless legacy records remain retained without automatic processing, restored media keeps the active strategy in a syncing state, and a non-durable media reference prevents leaving. The relevant queue, sync-status, and exit-guard test suites passed.

Confidence Score: 5/5

The validated cloud-media durability, account-isolation, status, and exit flows are safe to merge.

The suspected strategy-reference persistence race was disproved by the awaited flush and durable-write chain plus focused execution. Each reviewed failure path was exercised using the repository Flutter SDK and corroborated by focused regression coverage.

Files Needing Attention: No remaining file requires corrective attention from the validated behaviors.

T-Rex Logs

What T-Rex did

• Focused execution and detailed log reviews were performed for the cloud durability race, including before and after logs and source excerpts to confirm queueing, durable strategy outbox loading, and serialization behavior.
• Validated that an A-owned restored-media job remains inaccessible to uploads when B is active, and confirmed the full provider suite passed (17 tests) with accompanying source excerpts.
• Validated the legacy ownerless v1 migration preserves the v1 record byte-for-byte and verified startup queue behavior shows the unknown-owner work remains in storage without reconciliation.
• Verified cloud sync status logic through source excerpts showing active cloud filtering constrains loading to the cloud path, and that pending work prevents syncing until addressed, with a regression test confirming the behavior.
• Validated the unsaved strategy guard flow with focused execution, full guard-suite confirmation, and accompanying source excerpts.

_{Ran code and verified through T-Rex}

_{Reviews (5): Last reviewed commit: "fix: scope durable media to cloud accoun..." | Re-trigger Greptile}

[SunkenInTime]

Addressed the current Greptile review feedback in 0c8fa6b with focused tests for media-outbox write failure ordering, cross-strategy media isolation, draft staging, and unreliable media-outbox exit.

@greptileai

[SunkenInTime]

Addressed the current review findings in 189993c: media jobs stay non-runnable until an exact durable or authoritative server reference exists, restart recovery works without reopening the strategy, orphan cleanup preserves the local source, and lineup jobs are persisted atomically as one batch. Added deterministic regressions for the ACK-before-promotion and partial-batch failure boundaries.\n\n@greptileai

[SunkenInTime]

@greptileai Please review current head 189993c. The prior P1 findings are addressed with non-runnable staged media, exact durable/server reference reconciliation, atomic lineup batching, and deterministic restart/failure tests.

[SunkenInTime]

@greptileai Please review current head 9e27e71. Restored active-strategy media is now derived directly from the durable media queue for Syncing and Needs attention status, with startup and offline-error regressions.

[SunkenInTime]

Addressed the current Greptile review feedback in bd402cc: every new media job has a durable account owner, restore/reconcile/process require an exact active-account match, legacy unknown-owner records remain preserved and visible only for their strategy, and account-scoped keys isolate identical asset IDs. Added deterministic migration, cross-account, same-ID removal, status, and exit-guard regressions.\n\n@greptileai Please review current head bd402cc.

[SunkenInTime]

@greptileai Please review current head bd402cc. The account-scoping P1 is fixed with durable account ownership, exact active-account filtering, preserved unknown-owner legacy records, and cross-account regressions.