Record dev ancestry in app/v3 with a true merge

PERF.md

@@ -193,16 +193,16 @@ same commit; derive repeated values from constants.
 
 ## Paired team history
 
-These sharing budgets apply only when **share teams** is on in Settings → Devices.
-Sharing is off by default on each computer; off rounds run no team carriers,
+These sharing budgets apply only when **share teams** is on in Settings → General.
+Sharing is on by default for paired computers; off rounds run no team carriers,
 identity discovery, mirror writes or ownership lookups and retain existing polling.
 
 `teams.TrafficSyncLines` limits each writing computer's window to 32 lines per
 team, and `teams.TrafficSyncBytes` limits encoded lines to 16 KiB per team.
 `teams.TrafficSyncTextBytes` shortens text beyond 2 KiB at a rune boundary.
 `teams.TrafficSyncDeviceBytes` caps each device's encoded Traffic share at 64 KiB
 across teams, newest local activity first. `teams.TrafficSyncEvery` permits a
-publication at most once every 30 seconds; team record edits are not delayed.
+publication at most once every 2 minutes; team record edits are not delayed.
 Capture reads the bounded backward tail across the current and rotated logs. Received windows replace a
 separate display mirror and are never republished. An unchanged round on 500
 chats and 5 teams performs zero world scans and opens zero cell metadata files;
@@ -212,8 +212,11 @@ compare deterministic values, and verify quiet rounds leave the vault unchanged.
 Mirror filtering makes zero directory requests per vault round, using only an
 already-held local roster, or every other writer when none is available. A send
 shares one ownership reading across its recipients, with a 3-second timeout and
-a 5-second process cache (including failures). Cursor saves stat identity files
-but decode them only after a stamp changes. Mirror refresh never acknowledges
+a 5-second process cache (including failures). With effective sharing, cursor saves stat identity files
+but decode them only after a stamp changes. Unpaired computers retain legacy
+cursors, repairing reads and completion catalogs, with no sharing refresh clock
+or mirror reads. The first team capture preserves the original file once as
+`teams.before-sharing.json` before creating its ledger. Mirror refresh never acknowledges
 local news and each hosted window carries its own mirror version.
 
 ## Binary size

cmd/codeaf/app_devices_e14_test.go

@@ -114,7 +114,7 @@ func e14PairedEnginesRetry(t *testing.T, restart bool) {
 		t.Fatalf("A1: %d successful PUT attempts, want one per computer", puts.Load())
 	}
 	renamed := machineCall[appwire.DeviceRenameResult](t, wa, "devices.rename", appwire.DeviceRenameParams{Name: "studio"})
-	if renamed.Line != "This computer is now called studio." || puts.Load() != 3 {
+	if renamed.Line != "This computer is now called studio on all your devices." || puts.Load() != 3 {
 		t.Fatalf("A1/A3: rename was not published immediately: %+v, PUTs=%d", renamed, puts.Load())
 	}
 	appDeviceEvent(t, rb, func(v appwire.Devices) bool { return len(v.Devices) == 2 && v.Devices[1].Name == "studio" })
@@ -124,7 +124,7 @@ func e14PairedEnginesRetry(t *testing.T, restart bool) {
 	}
 	allow.Store(false)
 	pending := machineCall[appwire.DeviceRenameResult](t, wa, "devices.rename", appwire.DeviceRenameParams{Name: "office"})
-	if pending.Line != "This computer is now called office. Your other computers will see it once this computer is back online." {
+	if pending.Line != "This computer is now called office. Your other devices will show it after this one next connects." {
 		t.Fatalf("A3: pending rename receipt: %q", pending.Line)
 	}
 	allow.Store(true)

cmd/codeaf/app_pair_merge_test.go

@@ -71,7 +71,10 @@ func TestM1M2M5M9M10AppPairRealHomes(t *testing.T) {
 		return c, []byte(history)
 	}
 	chatA, wantA := seed(dirA, "A chat")
-	chatB, wantB := seed(dirB, "B chat")
+	// A startup-only joining home is legal; its own chat is created after pairing.
+	if _, err := identity.EnsureSolo(dirB); err != nil {
+		t.Fatal(err)
+	}
 	_, recA, wa := appDeviceBackend(t, dirA)
 	oldB, recB, wb := appDeviceBackend(t, dirB)
 	defer assertAppPairCopyM9(t, recA)
@@ -93,6 +96,7 @@ func TestM1M2M5M9M10AppPairRealHomes(t *testing.T) {
 	if err := oldB.Close(); err != nil {
 		t.Fatal(err)
 	}
+	chatB, wantB := seed(dirB, "B chat")
 	down.Store(true)
 	_, restarted, nextWire := appDeviceBackend(t, dirB)
 	wb = nextWire

cmd/codeaf/app_relay_test.go

@@ -267,7 +267,7 @@ func TestM1M4M8M9M10AppPair(t *testing.T) {
 
 func assertAppPairCopyM9(t *testing.T, rec *appRecorder) {
 	t.Helper()
-	allowed := regexp.MustCompile(`^(Pairing shares your chats with another computer\.|On your other computer, choose Pair a computer, then Enter a code from the other computer, and type [0-9-]+ \(dashes optional\)\. This code lasts 10 minutes\.|Waiting for approval on your other computer\. It should show: .+\.|Paired with .+\. Your chats can continue on both computers\.|Paired\. Your chats are kept\. Both computers' chats will appear as sharing finishes\.|Cancelled\. Nothing was paired\.|Pair with .+\?|Pair only if your other computer shows the same (three words|check number): .+\.|Pair|Don't pair|Open this pairing link on a computer you already use\.|Compare the check number on both computers: .+\.|Waiting for approval\. This link lasts [0-9]+ minutes\.)$`)
+	allowed := regexp.MustCompile(`^(Paired with your other device\. Run codeaf to open your chats\.|Pairing shares your chats with another computer\.|On your other computer, choose Pair a computer, then Enter a code from the other computer, and type [0-9-]+ \(dashes optional\)\. This code lasts 10 minutes\.|Waiting for approval on your other computer\. It should show: .+\.|Paired with .+\. Your chats can continue on both computers\.|Paired\. Your chats are kept\. Both computers' chats will appear as sharing finishes\.|Cancelled\. Nothing was paired\.|Pair with .+\?|Pair only if your other computer shows the same (three words|check number): .+\.|Pair|Don't pair|Open this pairing link on a computer you already use\.|Compare the check number on both computers: .+\.|Waiting for approval\. This link lasts [0-9]+ minutes\.)$`)
 	rec.mu.Lock()
 	defer rec.mu.Unlock()
 	for i, name := range rec.events {
@@ -295,7 +295,7 @@ func assertAppPairCopyM9(t *testing.T, rec *appRecorder) {
 
 			// The three check words are drawn at random from a word list that holds
 			// "ledger" and "cello", so only the copy around them is held to this list.
-			copyOnly := strings.ToLower(strings.ReplaceAll(line, p.Words, ""))
+			copyOnly := strings.ToLower(strings.ReplaceAll(strings.ReplaceAll(line, "Paired with your other device. Run codeaf to open your chats.", ""), p.Words, ""))
 			for _, banned := range []string{"codeaf pair", "--replace", "device", "identity", "cell", "lease", "fence", "ledger", "vault"} {
 				if strings.Contains(copyOnly, banned) {
 					t.Errorf("L3 terminal copy: %q", line)

cmd/codeaf/app_take_recovery_test.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"errors"
 	"net/http"
 	"os"
 	"path/filepath"
@@ -14,14 +15,15 @@ import (
 	"github.com/Agent-Field/codeaf/internal/cell"
 	"github.com/Agent-Field/codeaf/internal/cell/celltest"
 	"github.com/Agent-Field/codeaf/internal/cellstore"
+	"github.com/Agent-Field/codeaf/internal/chatlist"
 	"github.com/Agent-Field/codeaf/internal/home"
 	"github.com/Agent-Field/codeaf/internal/identity"
 	"github.com/Agent-Field/codeaf/internal/session"
 	"github.com/Agent-Field/codeaf/internal/syncsetup"
 )
 
 // S5 uses L4's post-acquisition permission failure with a real open source
-// conversation, then submits through the source app's ordinary send door.
+// conversation. Dev requires fresh consent before that source may send again.
 func TestAppTakeInstallFailureS5(t *testing.T) {
 	if runtime.GOOS == "windows" || os.Geteuid() == 0 {
 		t.Skip("L4 injection needs ordinary file permissions")
@@ -120,15 +122,35 @@ func TestAppTakeInstallFailureS5(t *testing.T) {
 		t.Fatalf("S5 failed taker row: %+v", rows)
 	}
 	t.Setenv(home.EnvVar, dirA)
-	if err = drive.started().CheckLease(t.Context()); err != nil {
-		t.Fatal(err)
-	}
 	var view appwire.Agent
-	source.locked(func() { view = source.agents[agent.ID].view })
+	appSyncWait(t, "released take is available without restoring work", func() bool {
+		if err := drive.started().CheckLease(t.Context()); err != nil {
+			t.Fatal(err)
+		}
+		source.locked(func() { view = source.agents[agent.ID].view })
+		return view.Location != nil && view.Location.Line == chatlist.Available
+	})
 	if view.Location != nil && strings.Contains(view.Location.Line, "continued") {
 		t.Fatalf("S5 released chat claims a continuation: %+v", view.Location)
 	}
-	turn, err := source.Send(agent.ID, "continue after the failed move", "s5-recover")
+	// A failed destination install releases the hold, not consent for this stale window.
+	if _, err := source.Send(agent.ID, "without fresh consent", "s5-refused"); err == nil {
+		t.Fatal("S5 stale source send was admitted without a new hold")
+	} else {
+		var failure *appwire.Error
+		if !errors.As(err, &failure) || failure.Code != appwire.CodeConflict {
+			t.Fatalf("S5 stale source refusal: %v", err)
+		}
+	}
+	current, err := source.ListChats()
+	if err != nil || len(current.Chats) != 1 || !current.Chats[0].CanTake {
+		t.Fatalf("S5 source continuation: %+v, %v", current, err)
+	}
+	resumed, err := source.TakeAgent(appwire.TakeParams{Cell: c.ID, Seen: current.Chats[0].Seen})
+	if err != nil {
+		t.Fatalf("S5 explicit source continuation: %v", err)
+	}
+	turn, err := source.Send(resumed.ID, "continue after the failed move", "s5-recover")
 	if err != nil {
 		t.Fatalf("S5 source send: %v", err)
 	}

cmd/codeaf/apperrand.go

@@ -50,6 +50,11 @@ func (b *appBackend) Errand(ctx context.Context, id string, ask session.ErrandAs
 			return session.ErrandAnswer{}, err
 		}
 	}
+	// Factory page calls and the brief writer borrow the agent for one errand.
+	// Ordinary calls on that same agent retain their refusal policy.
+	if session.IsFactoryAIPurpose(ask.Purpose) {
+		ask.DropRefusedEffort = true
+	}
 	answer, err := door.RunErrand(ctx, ask)
 	if err == nil || errors.Is(err, session.ErrErrandAsk) || errors.Is(err, session.ErrErrandRoute) {
 		return answer, err

cmd/codeaf/appfactory_memory_spend_test.go

@@ -483,11 +483,14 @@ func TestMemorySpendAndLifecycle(t *testing.T) {
 		failUpdates.Store(true)
 		defer failUpdates.Store(false)
 		before := calls.Load()
-		ctx, cancel := context.WithTimeout(context.Background(), 6500*time.Millisecond)
+		// Three-attempt rule: an unchanged failed input makes exactly three attempts,
+		// ordinaryBuildAttemptLimit in internal/knowledge/build.go. Failures wait 5, 10
+		// and 20 seconds, so a fourth attempt would come at about 35 seconds.
+		ctx, cancel := context.WithTimeout(context.Background(), 38*time.Second)
 		defer cancel()
 		_ = v.Run(ctx, history, func() string { return "fixture" })
-		if got := calls.Load() - before; got != 1 {
-			t.Errorf("unchanged failed input spent %d model calls, want 1", got)
+		if got := calls.Load() - before; got != 3 {
+			t.Errorf("unchanged failed input spent %d model calls, want exactly 3 and no further retries", got)
 		}
 	})
 	t.Run("unchanged refinement", func(t *testing.T) {

cmd/codeaf/chatv3.go

@@ -1028,6 +1028,7 @@ func v3ConfigFor(proc *v3Process, opts v3Options, workspace string, place sessio
 
 	cfg := session.Config{
 		TeamComputers:  teamComputers,
+		TeamsPaired:    teamPaired,
 		Workspace:      workspace,
 		Model:          chosen,
 		APIKey:         settings.APIKey,
@@ -2006,7 +2007,7 @@ func v3Policy(workspace, profileDir string, yolo bool) (*approval.Policy, error)
 // ordinary launch — so the exceptions, the shell rules and the floor cannot
 // differ between them.
 func v3PolicyMode(workspace, profileDir, mode string) (*approval.Policy, error) {
-	rows, err := v3ApprovalRowsAt(workspace, profileDir, mode)
+	rows, err := v3ApprovalRowsAt(workspace, profileDir, mode, false)
 	if err != nil {
 		return nil, err
 	}
@@ -2018,15 +2019,32 @@ func v3PolicyMode(workspace, profileDir, mode string) (*approval.Policy, error)
 // configuration reader's file freshness rules.
 type v3ApprovalRows struct {
 	mode, tools, bash string
+	profileReadError  string
 }
 
-func v3ApprovalRowsAt(workspace, profileDir, mode string) (v3ApprovalRows, error) {
+func v3ApprovalRowsAt(workspace, profileDir, mode string, headless bool) (rows v3ApprovalRows, err error) {
 	project, err := config.LoadProjectConfig(workspace)
 	if err != nil {
 		return v3ApprovalRows{}, err
 	}
+	// Every profile read participates, including a read that fails after an
+	// earlier row succeeded. Returning an ordinary error would retain an old,
+	// potentially permissive live policy instead of asking the person.
+	defer func() {
+		var pathErr *os.PathError
+		if errors.As(err, &pathErr) && pathErr.Path == config.BudgetConfigPath(profileDir) {
+			rows, err = v3ApprovalRows{profileReadError: err.Error()}, nil
+		}
+	}()
+	if _, err := config.ReadProfileApprovalConfig(profileDir); err != nil {
+		return v3ApprovalRows{}, err
+	}
 	if mode == "" {
-		mode, err = project.ResolveString(profileDir, config.KeyToolApprovalMode)
+		if headless {
+			mode, err = config.HeadlessToolApprovalModeAt(workspace, profileDir)
+		} else {
+			mode, err = project.ResolveString(profileDir, config.KeyToolApprovalMode)
+		}
 		if err != nil {
 			return v3ApprovalRows{}, err
 		}
@@ -2043,6 +2061,9 @@ func v3ApprovalRowsAt(workspace, profileDir, mode string) (v3ApprovalRows, error
 }
 
 func (rows v3ApprovalRows) build() (*approval.Policy, error) {
+	if rows.profileReadError != "" {
+		return &approval.Policy{ProfileReadError: rows.profileReadError}, nil
+	}
 	raw := map[string]any{"default": rows.mode}
 	// The repository's exceptions REPLACE the person's, whole (internal/config
 	// states the merge law): a rule set assembled from two files is a rule set

cmd/codeaf/chatv3_approval.go

@@ -80,17 +80,14 @@ func (g *v3ApprovalGate) Build(posture string) (*approval.Policy, bool, error) {
 	case session.PostureDeny:
 		mode, guardian = string(approval.ActionDeny), false
 	}
-	if mode == "" && g.headless {
-		var err error
-		mode, err = config.HeadlessToolApprovalModeAt(g.workspace, g.profileDir)
-		if err != nil {
-			return nil, false, err
-		}
-	}
-	rows, err := v3ApprovalRowsAt(g.workspace, g.profileDir, mode)
+	rows, err := v3ApprovalRowsAt(g.workspace, g.profileDir, mode, g.headless)
 	if err != nil {
 		return nil, false, err
 	}
+	if rows.profileReadError != "" {
+		guardian = false
+	}
+
 	g.mu.Lock()
 	defer g.mu.Unlock()
 	if g.policy != nil && g.rows == rows {

cmd/codeaf/chatv3_approval_live_test.go

@@ -37,11 +37,23 @@ func TestApprovalGateRejectsUnreadableProfiles(t *testing.T) {
 				if err != nil {
 					t.Fatal(err)
 				}
-				if policy, _, err := gate.Build(posture); err == nil || policy != nil {
-					t.Fatalf("%s profile produced policy %+v, error %v; want a failed build", broken, policy, err)
+				policy, _, err := gate.Build(posture)
+				if broken == "malformed" {
+					if err == nil || policy != nil {
+						t.Fatalf("%s profile produced policy %+v, error %v; want a failed build", broken, policy, err)
+					}
+				} else {
+					if err != nil || policy == nil {
+						t.Fatalf("unreadable profile must keep interactive startup available: %v", err)
+					}
+					for _, tool := range []string{"write", "read", "manual", "use_service", "unknown"} {
+						if got := policy.Check(tool, nil); got.Action != approval.ActionPrompt {
+							t.Errorf("%s = %s; want prompt", tool, got.Action)
+						}
+					}
 				}
 				if first.Check("write", json.RawMessage(`{"path":"example.go"}`)).Action != approval.ActionDeny {
-					t.Fatal("failed rebuild changed the previous policy")
+					t.Fatal("rebuild changed the immutable previous policy")
 				}
 			})
 		}

cmd/codeaf/chatv3_host_teams.go

@@ -114,7 +114,7 @@ func hostTeamsSeam(far hostFar, welcome remote.Welcome) tui3.TeamsSeam {
 // when the engine answers them, so an older engine's window has a seam whose
 // delegation doors are nil, which the surface says rather than guesses at.
 func (h *hostTeams) seam() tui3.TeamsSeam {
-	s := tui3.TeamsSeam{Load: h.load, ReadSince: h.readSince, Update: h.update, Traffic: h.readTraffic}
+	s := tui3.TeamsSeam{Sharing: h.sharing, Load: h.load, ReadSince: h.readSince, Update: h.update, Traffic: h.readTraffic}
 	if h.history != nil {
 		s.DisplayTraffic = func(team, after, version string, limit int) ([]teamstore.Entry, string, string, bool, error) {
 			got, err := h.history(team, after, version, limit)
@@ -306,3 +306,18 @@ func (h *hostTeams) forgetChecked(team string, expected []string) ([]string, err
 	}
 	return reply.Gone, nil
 }
+
+// sharing asks the engine rather than borrowing the viewing computer's pairing.
+func (h *hostTeams) sharing() (bool, error) {
+	_, stamp, _ := h.held(nil)
+	reading, err := h.read(stamp, h.reservedHues())
+	if err != nil {
+		return false, err
+	}
+	if reading.Sharing != nil {
+		return *reading.Sharing, nil
+	}
+	// Older engines gate their own history. Keep that display door available
+	// when they cannot report the gate separately.
+	return h.history != nil, nil
+}