[RCmerci]

Summary

Preserve concrete error causes across storage, Worker, sync, coordination, application diagnostics, and the native bridge.

• Keep the original typed error and causal trace through reads, admission, mutation recovery, and visible Diagnostics. listTimelineDates now retains distinct database-closed, released-snapshot, and invalidated-generation origins. Queue pressure remains queueFull / storageBusy instead of becoming closedSession.
• Preserve bounded SQLite/codec/JSON field, errno, TLS, WebSocket-close, native account, and authentication validation causes. Keep checkpoint/close and primary/rollback failures together without exposing raw paths, tokens, payloads, or graph data in new diagnostics.
• Complete failed asynchronous requests exactly once. Preserve cancellation, stale-owner fencing, and unknown-commit semantics.
• Extend the two approved contracts: asset failures carry a bounded diagnostic, and Worker interruption carries its original error. Keep retry classification intact.
• Separate diagnostic-only events from business rejection. A committed child whose canonical read is refused remains recoverable; reporting its cause must not terminate the graph or turn an unknown result into a rejected write.

A pre-existing macOS build blocker was also fixed with a platform guard around listSectionSpacing(16). Its iOS behavior is unchanged.

Review follow-up: local asset fallback

Addressed the asset-wrapper review in ed22c21.

• Reproduced three real-runner failures before the fix: full cache with readable staging, missing staged file, and checksum mismatch.
• Branch on asset_failure_kind while preserving the original wrapped error and diagnostic. Full cache retains its staging lease; missing/corrupt staging releases exactly once and falls back to remote cache.
• Added four regressions including a nonfallback oversize control, lease-release counts, remote-cache lookup counts, and readable result bytes. All 74 worker tests, the full build/regression suite, native macOS build/signature, and independent review passed on the updated source.
• No spec/Dune changes, GUI retry, merge, or release in this follow-up.

Validation

• dune build @all app/native_embed.exe.o: passed on final source.
• dune runtest --force: passed on final source, including 1,315 Alcotest cases across 22 suites plus custom contract/helper checks. Localhost DNS/TLS fixtures require execution outside the command sandbox; the identical focused binary failed there and passed with the approved local-network access.
• Full native arm64 macOS App build: passed with strict/deep adhoc signature verification. The native App build and signature check were repeated after the asset-fallback follow-up.
• Regression evidence includes RED → GREEN for scheduler/callback carrier loss, storage dual failures, sync parsing/transport, cleanup/interruption, and committed-child canonical-read backpressure.
• Independent read-only review: no remaining blockers on the exact final diff.
• spec-dev-tool check --all: six unchanged, pre-existing document-format failures. Output is byte-identical to the initial baseline check; no unrelated documents changed.
• Warm-start GUI acceptance remains unverified: the isolated probe launched, but the GUI inspection tool stalled. Timeline readiness and the missing-key scenario were not confirmed. No production account or personal graph was used.
• No iOS device/TestFlight build, deployment, or merge performed.

Audit boundaries

This is a repository-wide audit and propagation repair, not a claim that every legacy error contract now carries a complete causal object.

• Some legacy interfaces still expose only unit, strings, or nullary variants: snapshot-activation cancellation, authoritative cursor/checksum mismatch, Worker settlement/recovery, and upload invalid-content. These need separately scoped contract changes to preserve richer structured context.
• The gzip native ABI still merges several failures into status 3. The fixed 24-byte native runtime failure packet still compresses request failures. Neither wire format was expanded here.
• Some private native-crypto/asset-manifest decoding, bootstrap finalizers, and store-local rollback/finalize paths remain coarse. Precise multi-failure behavior needs owner-level design and deterministic fault injection; blindly concatenating errors would change transaction semantics or duplicate SQLite step/finalize reports.
• Diagnostic observers are intentionally best-effort. Canceled/stale completions without a live owner remain fenced. Existing untrusted remote error text was not broadly redesigned.
• Not every snapshot/fatal-state/listen/close/post-commit failure has a controllable injection point. New tests exercise the narrowest public owner that can reproduce each fixed defect; this PR does not claim real-device or production-account acceptance.
• The screenshot's historical root cause cannot be established from its generic closedSession label. This change preserves distinctions for subsequent failures; it does not assert which of them occurred then.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-06T23:46:10.285189Z	528854e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 528854e761

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Unwrap asset failures before applying local-cache fallbacks

Static inspection shows that wrapping every non-cancellation failure here breaks the existing constructor matches in logseq_db_worker/lib/effect_runner/effect_runner.ml's lookup_local_asset: Error Sync.Asset_storage_full no longer returns the retained staging lease, and Error (Sync.Asset_missing_source | Asset_checksum_mismatch) no longer becomes a cache miss. Consequently, a locally imported attachment becomes unavailable when cache publication runs out of space despite its staging file remaining readable; missing or corrupt staged content also prevents the Local_and_remote path from falling back to the remote cache. Match these failures through asset_failure_kind before introducing the wrapper.

Useful? React with 👍 / 👎.