Fix cloud conflict adoption and durable media recovery

[SunkenInTime]

After #156, choosing "Use cloud" could overwrite unrelated queued edits, and recovered disk writes or expired media uploads could leave sync blocked. This follow-up fixes the remaining recovery cases from the two reviews.

• Project unrelated overlays during cloud adoption, preserve pending map/theme edits, and restore conflicts whose durable deletion fails.
• Apply acknowledgements to retained overlays on inactive pages and keep the page side baseline across rename acknowledgements.
• Track media persistence failures by account and record. Verified writes and removals clear their own errors; an unreadable old record cannot make an unverified new edit safe to leave behind.
• Recover a deleted R2 upload intent by durably clearing its remote metadata so the next attempt uploads the local source again. Recheck references and job identity after server reads before promoting or removing media work.
• Allow v1 media outboxes to open while preserving accountless records as visible recovery issues. They are not silently erased or assigned to the next signed-in account.

Validation: TypeScript; 78 Convex tests; contract audit (42 functions, 34 error codes); release-safety checks; Flutter analyzer (no errors or warnings, 34 existing infos); 756 Flutter tests passed, with the two existing environment-only skips. Regression tests cover conflict preservation, failed discards, inactive-page/rename acknowledgements, write/removal recovery, mixed unreadable/unverified work, legacy startup, expired uploads, and references or restaging during a server read.

No manual two-client session was run for this provider-layer change. Windows and Linux CI cover the tests, native bridge, and app builds.

The beta deployment policy remains a separate release decision: keep the dev deployment stable for the beta window, or move beta builds to production before invitations.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 95bf726c-5bd4-4207-8a04-ded2f549f351

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This change makes cloud conflict recovery and media synchronization safer when local persistence or remote upload state is uncertain. Cloud adoption keeps unrelated local page and metadata edits, media recovery avoids stale job mutations and deleted upload intents, the exit flow blocks departure after an unverified current write, and legacy accountless media records remain unreadable rather than being assigned to the next account.

Focused Flutter coverage passed for conflict adoption, media queue recovery, durable outbox migration, and cloud exit handling. No merge-blocking defects were found.

Confidence Score: 5/5

Safe to merge based on the verified conflict, durability, recovery, concurrency, and account-isolation flows.

Focused Flutter tests and controlled before-and-after reproductions confirmed preservation of unrelated conflict edits, safe reconciliation after asynchronous reads, recovery from deleted upload intents, blocked exit after unverified current writes, and isolation of legacy accountless media records.

Files Needing Attention: No additional files need attention from the validated scope.

T-Rex Logs

What T-Rex did

• Validated that cloud conflict adoption snapshots local metadata, omits only rejected entities, and preserves unrelated queued work, and exercised both normal and durable-discard-failure recovery paths.
• Validated exit guard conditions requiring both outboxes to be loaded and reliable without a current-session durability failure, and confirmed that starting a cloud-ready queue for a signed-in account does not request an upload for the legacy unreadable record.
• Provided exact implementation and test evidence showing preserved pending map/theme state and verified test outcomes, including pre-change suite results and PR test expansion to 34 tests.
• Presented guard evidence that identity is rechecked after the awaited server read before promotion or deletion, and summarized restaged/durable-reference handling across related tests and the full cloud-media suite.
• Demonstrated end-to-end non-durable flow coverage for upload intents, unsaved strategy guards, and startup/queue isolation, with focused before/after evidence and all related tests passing.

_{Ran code and verified through T-Rex}

_{Reviews (1): Last reviewed commit: "Fix cloud conflict adoption and durable ..." | Re-trigger Greptile}