NEC-105: Unacknowledged pushes: survive a restart, retry a failed delta, stop the oversized-push reconnect loop #171

Merged

nectenda-agent merged 2 commits from worktree-nec-105-unacknowledged-pushes-survive-a-restart into main 2026-09-25 15:29:58 +01:00

Conversation 0 Commits 2 Files changed 19 +1472 -97

nectenda-agent commented 2026-09-25 14:18:09 +01:00

Collaborator

Copy link

Task: NEC-105 — https://projectron.nerchure.com/tasks/105

Closes the three edges NEC-18 left open around unacknowledged pushes, plus a wider cause found on the way. (1) The seq checkpoint is never stored while a document owes the server anything, pre-fix checkpoints are no longer read, and a catch-up from 0 always reconciles: it used to test lastSeq === 0 after the catch-up had raised it, so any launch without a trusted checkpoint pushed nothing and read as synced (SAFE-A10). (2) A reconnect delta whose encrypt fails is retried on the live socket, 2 s doubling to 60 s. (3) Decided with the user: the server push limit rises from 4 MiB to the 16 MiB document ceiling, catch-up frames are bounded by bytes as well as count (WIRE-044), and the client never sends a push over the limit; it shows an error naming size and limit and re-attempts on the next edit, reconnect or launch (SAFE-A11). An independent review found three further routes (a checkpoint during a slow cold-start catch-up, a save timer outliving destroy, a delta clearing a newer oversize hold); each is fixed with a regression test from its repro. Every new rule mutation-checked; local gate green at 92f36d7 including the multi-vault e2e. Spec: docs/changes/NEC-105-unacked-pushes/spec.md.

Spec: docs/changes/NEC-105-unacked-pushes/spec.md

Changelog

Edits the server never confirmed are now sent again after Obsidian restarts, notes up to 16 MiB now sync, and a change too large to send shows an error on the note instead of retrying in a loop.

Task: NEC-105 — https://projectron.nerchure.com/tasks/105 Closes the three edges NEC-18 left open around unacknowledged pushes, plus a wider cause found on the way. (1) The seq checkpoint is never stored while a document owes the server anything, pre-fix checkpoints are no longer read, and a catch-up from 0 always reconciles: it used to test lastSeq === 0 after the catch-up had raised it, so any launch without a trusted checkpoint pushed nothing and read as synced (SAFE-A10). (2) A reconnect delta whose encrypt fails is retried on the live socket, 2 s doubling to 60 s. (3) Decided with the user: the server push limit rises from 4 MiB to the 16 MiB document ceiling, catch-up frames are bounded by bytes as well as count (WIRE-044), and the client never sends a push over the limit; it shows an error naming size and limit and re-attempts on the next edit, reconnect or launch (SAFE-A11). An independent review found three further routes (a checkpoint during a slow cold-start catch-up, a save timer outliving destroy, a delta clearing a newer oversize hold); each is fixed with a regression test from its repro. Every new rule mutation-checked; local gate green at 92f36d7 including the multi-vault e2e. Spec: docs/changes/NEC-105-unacked-pushes/spec.md. Spec: `docs/changes/NEC-105-unacked-pushes/spec.md` ## Changelog Edits the server never confirmed are now sent again after Obsidian restarts, notes up to 16 MiB now sync, and a change too large to send shows an error on the note instead of retrying in a loop.

nectenda-agent added the

area:plugin

label 2026-09-25 14:18:09 +01:00

nectenda-agent added 2 commits 2026-09-25 14:18:10 +01:00

Re-send unacknowledged pushes after a restart, retry a failed delta, cap push size ... dfb6b4a401

A push the server dropped was forgotten when the app quit: the read position
was stored while it was outstanding, recording it as accounted for, and a
launch without a trusted checkpoint never reconciled because it tested
lastSeq === 0 after the catch-up had raised it. Now the checkpoint is never
stored while anything is unconfirmed, old checkpoints are not read, and a
catch-up from 0 always reconciles (SAFE-A10).

A reconnect delta whose encrypt fails is retried on the live socket, 2 s
doubling to a minute. A push over MAX_PUSH_BYTES is never sent: the note shows
an error naming size and limit, keeps the work, and tries again on the next
edit, reconnect or launch (SAFE-A11). The push limit rises from 4 to 16 MiB,
the document ceiling, so a large note's first sync goes through, and catch-up
frames are bounded by bytes as well as count (WIRE-044).

Task: NEC-105
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012MCWWbpGZfyDgfuaxS9xmJ

Close three routes a review found around the NEC-105 rules ... 92f36d7d58

A cold start's first catch-up frame armed the checkpoint save, and content
restored from IndexedDB sits in no queue, so a slow catch-up stored a read
position covering work the reconcile had not sent yet. Not being caught up
now counts as owing the server (SAFE-A10).

A save armed before destroy fired afterwards, when the close had already
cleared the Ack count and could not mark a document it no longer held. The
timer is cleared with the subscription and checks it still belongs to it.

A reconnect delta that finished after a flush held back a newer oversized
change cleared that hold, so the note read "sending" instead of the error.
A delta now clears only holds placed before it was computed (SAFE-A11).

The large-push server test now pushes at the 16 MiB boundary and checks the
live relay to a peer.

Task: NEC-105
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012MCWWbpGZfyDgfuaxS9xmJ

cruelacid added the

area:server

label 2026-09-25 14:18:22 +01:00

cruelacid force-pushed worktree-nec-105-unacknowledged-pushes-survive-a-restart from 92f36d7d58 to ac732bb29d 2026-09-25 14:25:27 +01:00 Compare

cruelacid force-pushed worktree-nec-105-unacknowledged-pushes-survive-a-restart from ac732bb29d to 38010cb182 2026-09-25 15:17:06 +01:00 Compare

cruelacid force-pushed worktree-nec-105-unacknowledged-pushes-survive-a-restart from 38010cb182 to 1eaad4b308 2026-09-25 15:23:57 +01:00 Compare

nectenda-agent merged commit 1eaad4b308 into main 2026-09-25 15:29:58 +01:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

area:docs

docs/

  

area:identity

packages/identity

  

area:ops

deploy/, CI, hosting

  

area:plugin

packages/plugin

  

area:server

packages/server

  

channel:community

Obsidian forum, Obsidian Discord, Reddit

  

channel:direct

Cold outreach to named firms

  

channel:owned

nectenda.com pages, the feedback board

  

channel:press

Hacker News, newsletters, outlets, YouTube creators

  

channel:social

Bluesky, Mastodon, X, YouTube accounts

  

e2ee-constrained

End-to-end encryption changes the shape of the answer

  

gate:at-ga

Held until Gates A-C close and terms/privacy leave DRAFT

  

gate:pre-ga

Safe to do before the launch gates close

  

marketing

Reach and positioning; work published off nectenda.com

  

parity

Relay feature-parity programme

  

relay:absent

4 - Not supported, not requested, not planned at Relay

  

relay:planned

2 - On Relay's roadmap (Active/Planned) or has an open PR

  

relay:requested

3 - Asked for by Relay users or under 'Considering'; not committed

  

relay:supported

1 - Relay ships this today

  

risk:additive

New message type, table or column; backward compatible

  

risk:contract

Changes something existing accounts or stored data depend on

  

risk:none

Client-only; the server is untouched

  

usability

How the product is understood and learned, not what it does

No labels

area:docs

area:identity

area:ops

area:plugin

area:server

channel:community

channel:direct

channel:owned

channel:press

channel:social

e2ee-constrained

gate:at-ga

gate:pre-ga

marketing

parity

relay:absent

relay:planned

relay:requested

relay:supported

risk:additive

risk:contract

risk:none

usability

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Nectenda/nectenda!171

No description provided.