Bound cloud payloads and gate direct mutations

[SunkenInTime]

What changed

• measure serialized operation and batch envelopes using UTF-8 bytes, with conservative per-value, argument, and array-entry margins
• persist new and promoted oversized operations directly as attention; classify legacy queued oversized records as attention without overwriting their only durable copy
• keep poison operations visible across restart while independent work continues; retry, predecessor/successor, explicit cloud adoption, and persistence-failure paths remain fail-closed
• expose exact-key durability uncertainty through queue reliability so the UI cannot promise that unverified work is safely saved
• enforce the existing cloud protocol version on every public Convex mutation and update the generated Flutter contract/callers atomically
• return policy-sized applyBatch failures per operation so one valid in-range poison op cannot reject its siblings

Invariants

An oversized operation is never transmitted or silently deleted. New oversized work is durable attention from its first successful write. Legacy queued oversized work is classified as attention without a queued-to-attention write, so even a destructively failing attention store cannot remove its recoverable copy. Restart restores it visibly and Use cloud removes its exact account/strategy/entity storage key before remote adoption.

If any durable write or remove cannot be verified, transport stops where required, reliability is false, the attempted intent remains in memory, and the UI states that nothing was safely confirmed. Only a successful rewrite/removal of that exact key clears uncertainty. A failed cloud-adoption remove retains attention and returns no adoption key.

Direct public mutations share the same version gate and canonical version error as applyOpsBatch. The contract audit fails if a public mutation omits the required numeric protocol argument.

Verification

• npx tsc --noEmit
• npm run test:convex (57 passed)
• npm run audit:convex-contract
• npm run snapshot:convex-contract:check
• generator analyze and tests (9 passed)
• generated contract run twice with stable output
• flutter analyze (no errors; 34 existing infos)
• final-head flutter test (641 passed, 2 skipped)
• final-head queue provider tests (54 passed)

Stack

Base: agent/conflict-resolution-98296362, accepted head e4b388b (PR #150).

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 7ce58e07-e1cb-4f04-ac7c-f7fde470a85e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[SunkenInTime]

Addressed the current review feedback in 8df0e4f.

@greptileai

[greptile-apps]

Greptile Summary

Cloud sync now fails safely when a saved operation is too large or its durable outbox state cannot be verified. Oversized work is retained for recovery instead of being sent, valid operations continue when a sibling is rejected, direct cloud mutations require the current protocol version, and uncertain outbox state displays Needs attention rather than Synced.

Focused queue, Convex, contract, and Flutter widget checks confirmed these behaviors.

Confidence Score: 5/5

The reviewed cloud-sync safeguards are ready to merge.

Focused execution covered failed and missing durable parking records, oversized server operations with valid siblings, every public direct mutation without a protocol version, unsupported protocol versions, generated contract auditing, and the rendered durability-uncertainty status.

Files Needing Attention: No files need follow-up for the reviewed behaviors.

T-Rex Logs

What T-Rex did

• Reproduced the prior restart behavior and ran the same regression on the reviewed code; confirmed that failed and missing durable parking paths do not send a cloud request; ran the cloud payload policy test group.
• Sent a batch containing a 930,227-byte operation and an independent strategy update; observed INVALID_PAYLOAD for the oversized operation and that the sibling update persisted.
• Probed all 21 public direct Convex mutations without clientProtocolVersion before and after the change; the reviewed implementation rejected every omitted-field call, and the focused unsupported-version suite and contract audit passed.
• Rendered the real cloud-sync status widget with durable outbox uncertainty; the focused Flutter test confirmed Needs attention is visible, Synced is absent, and the recovery action is available.
• Reviewed changes to durability and restart handling, including strategy_op_queue_provider.dart; tests verify the durability semantics and that there are no unintended writes.

_{Ran code and verified through T-Rex}

_{Reviews (4): Last reviewed commit: "fix: park oversized work without overwri..." | Re-trigger Greptile}

[SunkenInTime]

Addressed the current Greptile review feedback in 01e79d4.

@greptileai

[SunkenInTime]

Addressed the current Greptile review feedback in f2d38a7.

@greptileai