Integrate cloud readiness hardening

[SunkenInTime]

Summary

This combines the six accepted cloud-readiness branches on top of icarus-cloud without using their merge buttons.

• Serializes account-wide background sync and keeps inactive work visible during sign-out and safe-exit checks.
• Parks oversized operations in attention before transport, splits valid batches below the Convex argument cap, and retains legacy poison records without rewriting them.
• Requires the shared protocol version on batched and direct cloud mutations.
• Adds explicit Keep Mine and Use Cloud conflict choices without dropping unrelated work or replaying discarded intents.
• Enforces owner-only library moves and view-only canvas access.
• Adds bounded image cleanup with claim leases, retries, and scheduled continuation.
• Makes cloud library action failures visible and retryable.
• Keeps production publishing and release branches fail closed.

Accepted heads

• Keep account cloud outboxes visible and drainable #153 5bf2fc590884d4d958c38df33db0896fe8f85d8b
• Bound cloud payloads and gate direct mutations #152 f2d38a7d8706f17db03c44def2ff6e13a1872e5c
• Enforce cloud strategy edit permissions #146 8c828772ef03a545676bfea8d3dfc355cf94fa85
• fix: fail closed on production publishing #151 e6de85236c0f01e15c563f3328fc79737fc5d95d
• Protect image asset cleanup lifecycle #154 680819ad8f07bb0ba93b3813076f307276fe36c4
• Surface cloud library action failures #155 96667551e5b3e6ce4d3a8913e1444fb160ada1fe

Verification

• npx tsc --noEmit
• npm run test:convex (68 passed)
• contract and architecture audits
• fresh isolated Convex function-spec comparison
• Dart client generator twice with identical output and no drift
• powershell -ExecutionPolicy Bypass -File scripts/test_release_safety.ps1
• fvm flutter analyze --no-fatal-infos (no errors)
• fvm flutter test (740 passed, 2 expected skips)
• generated-file and clean-worktree checks

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 6ed04625-3182-4755-b41b-7d71c3790612

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This change improves cloud-work durability, ownership controls, image cleanup recovery, and release configuration safeguards. Executed checks confirm that sign-out stops when local cloud persistence is uncertain, shared editors cannot move another owner’s strategy, and failed image deletions are reclaimed for retry.

Flutter configuration tests also confirm that production builds reject the known development Convex deployment and client identifier.

T-Rex validation blocked

• Missing tool: pwsh / powershell is not installed in this Linux environment. The stable and Store PowerShell release scripts could not be executed end to end, although their configuration wiring was inspected and the Flutter production-configuration suite passed. Configure VMs

Confidence Score: 4/5

The exercised cloud persistence, authorization, and image-cleanup behavior is ready to merge without a confirmed defect.

Focused Flutter and Convex tests passed for the sign-out durability, shared-editor authorization, and deletion-recovery flows. Production configuration validation also passed, but the PowerShell release scripts could not run in this environment.

Files Needing Attention: Run scripts/test_release_safety.ps1, scripts/build_desktop_release.ps1, and scripts/build_store_release.ps1 in an environment with PowerShell before performing a public release.

T-Rex Logs

What T-Rex did

• Verified that a local persistence failure blocks sign-out without offering a permissive bypass, and that an explicitly confirmed sign-out preserves already-durable queued strategy and media work; ran the focused coordinator suite and the Settings entry-point test successfully.
• Verified the strategies:move mutation requires the owner role before changing a folder; direct-share and inherited-folder-share editor requests against the Convex mutation were rejected with FORBIDDEN and left the strategy unchanged.
• Verified that failed R2 deletion releases the persisted cleanup claim and leaves the tombstone available for retry, and that the maintenance path releases stale persisted claims to allow physical deletion to complete.
• Ran Flutter production configuration checks and inspected the release-hand-off work; noted that the in-environment PowerShell blocker prevented running the release-safety suite.
• Linked the cloud sign-out durability results to the coordinator suite: all eight focused coordinator flows passed and the Settings route is exercised by the guarded sign-out contract.

_{Ran code and verified through T-Rex}

_{Reviews (4): Last reviewed commit: "Gate public image writes by protocol" | Re-trigger Greptile}

[SunkenInTime]

Fable follow-up fixes are in e79e9a1: sync revision rebasing and exact hydration bases, hydrate-before-discard conflict adoption, recoverable exit/media states, background outbox scheduling, and retry-safe library errors. @greptileai please review the current head.

[SunkenInTime]

Fixed both current-head findings in 8e971d1:\n\n- v1 strategy outbox records now migrate in place to v2; unreadable or mismatched records are preserved for quarantine instead of deleted, and unknown future versions still fail closed.\n- locally discovered media jobs now start staged (
eferenceDurable: false) and cannot upload until a durable strategy op or authoritative server snapshot proves the reference.\n\nAdded regression coverage for markerless/marked v1 migration, invalid-record preservation, future-version rejection, and pre-admission media upload blocking. Local gate: TypeScript pass; 68 Convex tests; contract audit; release safety; Flutter analyze with no errors; 741 Flutter tests pass (2 expected skips).\n\n@greptileai please review the current head 8e971d1.

[SunkenInTime]

Addressed the current Greptile review feedback in 8e971d1.

@greptileai

[SunkenInTime]

Addressed the current Greptile review feedback in 27d9065.

@greptileai