[AbirAbbas]

What this is

app/v3 landed on dev as one squash (#2561), so the pull requests that were still open against app/v3 could not simply be re-pointed. This carries the ones that integrate cleanly onto dev, one commit per pull request with its title and number kept, after merging them into app/v3 itself (where each now shows as merged).

Carried (16): #2198, #2469, #2586, #2366, #2192, #2149, #2377, #2463, #2269, #2386, #2358, #2090, #1931, #2387, #2364, #2570.

Held, not in this PR (6), each for a stated reason:

• sync: a late save after a noticed expiry is kept as a copy #2381 (late saves and expired holds): with it, the relay outage test TestAppRelayOutageO1O2O3O4O5 fails three of three isolated runs and passes without it. Its expiry refusal conflicts with the automatic same-holder outage recovery.
• app: process actions wait for an opening crew owner instead of saying it is not held #2156 (process actions wait for an opening crew owner): conflicts with the newer app: stop-all during an open stops what the owner holds #2313, which already makes those reads return promptly and refresh.
• Relay: scoped clients, sealed slots, and a signed queue #1928 (relay scoped clients): written against the relay's earlier client protocol; the hosted identity routing changed underneath it.
• perf: cut the app engine's resident memory (about 930 MB to 250-430 MB on a real home) #1933 (engine memory): 18-file conflict with the current work-admission code; needs its author.
• An idle chat on a paired computer can hand its hold to the relay (opt-in idle handoff) #2287 and Generic collections (factory_job refs) and client tools (integration branch; draft, do not merge) #2306: marked unfinished in their own descriptions.

How it was judged

By hand checks of the built binary, not by a fully green suite (the suite has known flaky tests; each red here got one isolated rerun and a run on the base before being called real, flaky or already red, and the lists are in the wave's notes).

Hand checks on the dev build with a real model, 20 of 21 passing:

• first start and a plain answer; a turn that edits a file and runs its tests; a task that reaches done; Esc stops a streaming reply in 0.09 s and the next message works; cost and history identical across two reopens (44 ledger rows, same ids, nothing re-booked); codeaf exec exits 0 with its edit; the desktop engine's newline-JSON door (create an agent, a real reply, reopen the answered receipt, clean shutdown);
• one check per carried pull request that changes behaviour a person can see: Typing into your own idle chat reopens it instead of saying it's available #2469, app: answered receipts and quiet notices disappear after relaunch #2586, A big move from the hosted relay goes through; a move sync answered with an error says so #2366, Book a tool completion once when the process dies between seal and WAL cleanup #2377, Keep waiting job actions from going stale on bookkeeping #2463, Spending: daily rollup for date-only spend.report #2269, Keep billing facts and missing receipts when taking a chat #2386, An idle job chat stops reading every job ten times a second #2358, agentdid: add encrypted custody, purpose-bound signing and v1 identity documents #2090, Idle factory workers wait for changes instead of re-decoding the store #1931, Recover usage rows after a crash without changing charges #2387, Crossing the day cap stops running work, not only the next turn #2364, Factory: compare failing Go tests with the base, and Accept as is #2570 pass; app tests: B2 recovery must show its worker's answer, not only a settled state #2198, tests: FIFO and Unix-helper cases build for Windows; make vet checks the Windows test build #2192 and session: split the task and memory roads back under the endings ceiling #2149 are test-only or refactors.
• The one failure: quit right after a turn took 2.6 s and once more than 10 s against a 2 s bar, with the machine's disk under heavy load from other jobs. The unchanged dev commit missed the same bar in the same conditions (5.4 s once, 0.56 s once), and on a quiet machine the landing head quit in 0.16–0.7 s (Land app/v3 on dev: one trunk (draft until the hand gates pass) #2561). No latency regression from this wave was established; it is recorded, not waved away.

Real failures found by the tests during integration were fixed in small follow-up commits (each named in the commit list) or caused a hold (#2381). No assertion was loosened.

What a person should know before these ship

• Recover usage rows after a crash without changing charges #2387 adds a pending journal beside the usage ledger (usage.jsonl.pending-v1.jsonl): usage returns after the journal append, with a sync every 100 ms or 64 rows and on clean close. A power loss can lose the last unsynced batch. Older builds do not replay the sidecar.
• Crossing the day cap stops running work, not only the next turn #2364: crossing the daily cap now stops running owned work, not only the next turn. Calls already producing tokens finish and are booked.
• Factory: compare failing Go tests with the base, and Accept as is #2570: the built-in Test rule becomes "no new failures" against the pinned base (Go only); a person can accept a stuck judging step, and accepted failures stay in the evidence.
• agentdid: add encrypted custody, purpose-bound signing and v1 identity documents #2090 writes v1 agent identity documents with encrypted custody; an existing public identity keeps its DID.
• A big move from the hosted relay goes through; a move sync answered with an error says so #2366 limits hosted fetch batches to 16 objects; Keep waiting job actions from going stale on bookkeeping #2463 adds an optional action_revision to job envelopes; Spending: daily rollup for date-only spend.report #2269 keeps daily spending rollups in memory (bounded).
• Paired-computer outage paths were checked with local fixtures, not against a live second machine.

This branch also merges current dev (#2595, #2596); the one conflict (the factory worker's start) keeps both changes.

🤖 Generated with Claude Code