Feature plan: Step 1 · Step 2 · Step 3 · Step 4

Debug mode: enabled Effort study: railspike-effort / v3/private_message_sync_idle — ledger Extended estimates: enabled Status: Six stages complete locally; production replay and maintainer acceptance pending

Cycle estimate: 0.75

Step 4 entry: 2026-10-29 UTC; 0.75 reaffirmed, scope v1/A, original baseline 02dafa857, updated base e614fbd9b, R1/P2. Codex single exposed rater; inherited verified references. Planning commit 09a0a660a. Original S1–S6 stage estimates 0.12/0.14/0.16/0.16/0.16/0.06 and scopes/uncertainties are preserved in Step 3; non-additive. Measured labor unavailable. Deployment and production acceptance not authorized by this approval.

— Codex · 2026-10-29 UTC

Stage 1 - History gate

Original estimate: 0.12 Retrospective stage work: 0.12

• Changes: Add account-level has_history to unread state using an existing bounded mailbox query; unread coordinator shares identity-bound eligibility and wakes sync on status refresh. Sync waits for eligibility instead of starting on every page.

• Verification: 27/27 focused history/read-state/mailbox PHP tests; node tests/browser/private_message_history_gate.cjs passes initial ordering, unused account, first-message activation, identity change and failed-status recovery. git diff --check passes.

• Notes: No schema/dependency/UI changes. Real browser end-to-end acceptance remains Stage 5. Original scope/uncertainty unchanged; no estimate revision. Ledger planning records included now, outside the planning commit.

— Codex · 2026-10-29 UTC

Stage 2 - Donor-owned contribution evidence

Original estimate: 0.14 Retrospective stage work: 0.14

• Changes: Add contribution lookup scoped to source/target/message/digest and retained transfer. Optional sender filtering is ready for combined discovery; legacy sender discovery remains unfiltered for explicit repair/replacement.

• Verification: 15/15 history service tests pass, including unchanged sender discovery across recipient acknowledgments, independent donors, missing-transfer rediscovery and invalid unconfirmed candidate replacement.

• Notes: Contribution evidence means supplied, not readable. Recipient foreground candidate validation/retry and other donors remain available; explicit legacy sender discovery/upload retains same-donor repair. No recipient receipt is consulted by the new lookup. Prior stage commit: 4a552bbeb. No estimate revision.

— Codex · 2026-10-29 UTC

Stage 3 - Bounded combined discovery

Original estimate: 0.16 Retrospective stage work: 0.16

• Changes: Add same-origin POST work for combined account/sender discovery, up to eight pages per mode, with completed-mode and continuation fields. Return pending bundles directly. Advance only empty/covered discovery pages server-side, never client work or access receipts. Preserve legacy GET modes. Reuse own contribution evidence for other own-account targets too.

• Verification: 17/17 history/API routing tests pass; coverage includes genuine idle, 151-message covered history requiring bounded continuation, new target keys and unchanged unprocessed cursors. Initial fixture incorrectly requested an unbounded existing helper; corrected fixture to enumerate its seeded records directly. Syntax/whitespace checked.

• Notes: POST is deliberate because empty discovery progress mutates scan positions. No tables/schema/dependencies added. Prior stage commit: fc7c501f5. No estimate revision.

— Codex · 2026-10-29 UTC

Stage 4 - Combined browser coordinator

Original estimate: 0.16 Retrospective stage work: 0.16

• Changes: Consume combined work and completion state, stop immediately on idle, process returned bundles without redundant discovery, retain bounded follow-ups and only acknowledge actual receipts/checkpoints. A 405 from an older server selects legacy discovery; terminal HTTP errors are no longer retried as network failures. Foreground candidate/confirm remains independent of the background eligibility gate.

• Verification: Gate test asserts exactly one idle request; scheduling suite passes shared budgets, cancellation, interrupted sender batches, disabled messaging and overlapping re-enable with legacy fallback; real OpenPGP donor tests pass account and sender modes, lost-ack retry, target-only decryption and no plaintext/private-key/cache writes; reader test passes invalid-donor fallback and verification.

• Notes: Original scope/estimate unchanged. Prior stage commit: 2f11c3a83. Full HTTP/browser acceptance follows in Stage 5.

— Codex · 2026-10-29 UTC

Stage 5 - Normal browsing and recovery acceptance

Original estimate: 0.16 Retrospective stage work: 0.20

• Changes: Add HTTP/browser request-count acceptance and combined/paired scheduling regressions. Preserve the shared eight-bundle budget and alternating priority when a combined response returns two bundles. Valid older unread responses without the additive field keep legacy recovery available. Eligibility now uses SELECT 1 rather than loading ciphertext. Existing theme matrix selects stored themes on reload because some themes hide the picker.

• Verification: Focused PHP regression 41/41; final eligibility/mailbox/read-state check 14/14 after query optimization. Combined, paired and legacy scheduling tests pass. Full real Chromium history suites pass same-account (/tmp/history-sync-browser-RttLVT) and sender-assisted (/tmp/history-sync-browser-F2cexz): unused-account zero sync, settled-history one POST work, 31 originals across partial donors, newly approved/restored devices, unchanged ciphertext, drafts, mobile and desktop reading, paired backup/restore, sync outage with ordinary sending, signed messaging toggles across themes and environment overrides. Final direct sender run (/tmp/history-sync-browser-qV0Jm7) passes updated POST work origin/invalid-body checks, canonical reading and retained reload.

• Corrections: Browser drivers now wait for unread eligibility before requesting sync; earlier immediate refresh assertions raced the new gate. Theme selection originally timed out on a hidden picker; selecting the stored theme before reload tests messaging consistently without changing product navigation. Budget/fairness and legacy-status compatibility corrections stay within scope.

• Limitations: The broader private_message_list_browser.mjs failed at its exact bob user-link lookup (/tmp/private-message-browser-ner7y1), before its unread UI checks; not established as a baseline defect and not counted as passed. Focused unread PHP checks and actual history reading/toggle flows pass. No full suite, production deployment/replay or physical-device checks claimed.

• Notes: Prior stage commit 406979772. No prospective estimate revision; retrospective reflects fixture repair and wider integration checks, not measured labor.

— Codex · 2026-10-29 UTC

Stage 6 - Contracts and closeout

Original estimate: 0.06 Retrospective stage work: 0.06

• Changes: Document combined POST discovery, account-history eligibility, bounded continuation, old-server fallback, donor evidence and explicit legacy repair. Add four scoped concept descriptions and production network/recovery replay instructions. Update cycle/ledger state without changing prior estimates.

• Verification: Local links in all cycle/concept documents resolve; git diff --check passes. Documentation matches service/controller/browser behavior. Zero third-party dependency or database-schema delta. Six implementation stages each have their summary commit; planning commit contains only plans/debug/index and predates the summary.

• Baseline reproduction: private_message_list_browser.mjs fails on untouched e614fbd9b at the same line 132 exact bob user-link lookup (/tmp/private-message-browser-JZOPeY). Its later unread UI checks remain unverified; this failure predates the cycle. Temporary baseline worktree removed.

• Notes: Prior stage commit ca13fb623. No estimate revision. No UI copy/layout changes; actual history phone/desktop flows and messaging theme toggles passed, without claiming exhaustive visual verification.

Closeout

Scope: v1/A; original baseline 02dafa857, implementation base e614fbd9b. Six planned stages completed on feat/private-message-sync-idle, after planning 09a0a660a and staged commits 4a552bbeb, fc7c501f5, 2f11c3a83, 406979772, ca13fb623 and this closeout commit. No merge, push or deployment performed. Whole-cycle projection: 0.75 retained from entry and planning. Retrospective cycle scope: 0.80; R1/P2, 2026-10-29 UTC, Codex single exposed rater; integration fixtures and cross-version/budget corrections account for the difference. Original stage-work estimates remain intact; retrospective values are 0.12/0.14/0.16/0.16/0.20/0.06, non-additive and not measured labor. Acceptance: Local focused checks passed with one reproduced baseline failure in the broader list suite. Production ordinary-entry and recovery replay, physical devices, full suite and maintainer comfortable-fit/acceptance remain pending. No accepted-count increment or invented measurements. Roll out matching PHP/assets and use the linked production checks; retain both private databases on rollback.

— Codex · 2026-10-29 UTC

Rebase onto current main — 2026-10-30

Request: Rebase onto main. Fetched origin/main at 2e17c9713 and rebased all eight cycle commits from e614fbd9b; original evidence and estimates above remain historical. Resolution: Preserved both plan-index/ledger additions. Kept upstream shared-page viewer discovery and authentication refresh alongside history eligibility, with viewer binding preceding eligibility notification. Browser acceptance waits for both initialization conditions. No change to the combined protocol, donor evidence or recovery rules. Verification: 42/42 focused PHP tests pass; added shared-page eligibility lifecycle case and its registered focused test pass. Full same-account and sender-assisted browser suites pass, including idle counts, partial donors, later devices, backup/restore, outage and signed feature toggles. Artifacts: /tmp/history-sync-browser-tDtXUx and /tmp/history-sync-browser-DnsDll. Range-diff confirms remaining implementation patches unchanged apart from conflict context; git diff --check passes. Rebased commits: 91fb3a7d1 planning; 8ef953bc6 gate; 29157909b donor evidence; a1ba719e9 discovery; a98097ca7 coordinator; 4c125f86d acceptance; 9949cbdb4 documentation; 285fbad64 diagnostics. This follow-up commit records rebase verification and the shared-page regression test. No push, merge or deployment performed; prior full-suite/production limits remain.

— Codex · 2026-10-30 UTC