auto-fix batch claude/friendly-maxwell-BjjKA (2026-05-02)

[intendednull]

Auto-fix batch from /resolving-issues skill. Sequential fixes for small-scope audit findings + 1 high-sev perf fix. One CI run, one merge.

Fixes

• Fixes #302 — fix(storage): cap authors in sync_since/history at 256 (commit b075140). MAX_AUTHORS_PER_SYNC = 256 cap rejects oversized peer-supplied HeadsSummary at the start of sync_since + history w/ anyhow::bail!("too many heads ...") before any SQL build. StorageRole::handle_request already maps Err → WorkerResponse::Denied, so rejection plumbs to peers naturally w/ no worker-layer change. Cap = 256 not the issue's suggested 1024 — SQLITE_LIMIT_EXPR_DEPTH = 1000 hits before the bind-param ceiling (32766) when 1024 OR-clauses nest. 4 new unit tests cover oversize + exact-cap accept.

• Fixes #309 — fix(client): bind JoinResponse/JoinDenied to expected inviter (commit b51a151). Adds additive link_id: String field to WireMessage::JoinResponse + JoinDenied. Requester tracks (link_id → inviter_endpoint) in new pending_joins: Arc<Mutex<HashMap<String, EndpointId>>> map populated at JoinRequest broadcast. JoinResponse / JoinDenied handler gates on signer == pending_joins[link_id] (drops + reinserts on mismatch so legit late reply still resolves). sanitize_reason() strips c.is_control() + length-caps to 256 before surfacing JoinLinkDenied. 9 new client tests (5 signer-binding incl. legit-path regression + 4 sanitization). Wire change pre-1.0 acceptable.

• Fixes #354 — search index now incremental + persistent across channel switches. Landed in two commits due to sandbox-reset interference (see Lessons Learned): e07d974 perf(web): incremental search index, drop rebuild-on-signal Effect shipped the new crates/client/src/search/bootstrap.rs helpers + plan doc; 24499f2 perf(web): wire search bootstrap helpers, drop rebuild Effect shipped the actual wiring (mod.rs re-exports, 4 new bootstrap_tests, and the app.rs Effect → spawn_local swap). The wiring recovery commit was needed because the sandbox auto-reset wiped the agent's tracked-file edits between Bash invocations, leaving e07d974 shipping only the new untracked files — agent recovered by re-applying all three tracked edits in a single bash -c pipeline. Net effect: app.rs:419 rebuild Effect replaced by one spawn_local task that (a) calls willow_client::search::hydrate_index once at entry to seed the index from every channel via client.channels + client.messages + idempotent search.insert, (b) subscribes client.subscribe_events() and routes MessageReceived → index_message, MessageEdited → reindex_message (remove + reinsert), MessageDeleted → search.remove_message, ChannelDeleted → search.remove_channel. Index now global + persistent; signal changes never touch it.

Already-Fixed

None this run.

Parked

None — all three attempted dispatches landed. No mid-run blockers.

Skill Evolution

Commit 05d6123 — docs(skill): forbid wip-commits on master + document sandbox-reset hazard. Two failure modes from this run drove the edit:

1. [SEC-A-07] JoinResponse / JoinDenied not bound to the inviter; spoofable by any signer #309 implementer pushed two wip: commits then terminated mid-flight. Forced a finalize-implementer dispatch to verify gates + squash via git reset --soft <base> && git push --force-with-lease. ~10–15 min of cargo lock contention in rescue agent. New rule in step 8: never push wip commits to master — make all edits, run gate, commit ONCE. If you genuinely need intermediate checkpoints, use Pattern B (local feature branch + git merge --no-ff) and squash before pushing master.

2. Sandbox git reset --hard origin/<branch> interference. All three implementers hit it ([SEC-V-02] sync_since builds unbounded SQL from peer-supplied heads #302, [SEC-A-07] JoinResponse / JoinDenied not bound to the inviter; spoofable by any signer #309, and [GEN-11] Search index rebuilt from scratch on every message-list change #354 — the [GEN-11] Search index rebuilt from scratch on every message-list change #354 dispatch's split into two commits is exactly this hazard). The sandbox runs a periodic auto-reset between tool invocations that silently rolls back uncommitted edits. New documented hazard + recovery pattern: tight bash -c commit-immediately pipelines; squash at end via soft-reset + force-push. Note the workaround in commit body so the human can audit.

Lessons Learned

• wip: commits on master = dispatch-recovery cost. Cost a finalize-implementer agent + ~15 min cargo lock contention to clean up. Skill now explicitly bans the pattern. Future implementers see this in step 8 immediately.
• Sandbox auto-reset is real and silent — and the bash -c recovery pattern works but isn't perfect. The [GEN-11] Search index rebuilt from scratch on every message-list change #354 dispatch lost its tracked-file edits between two Bash calls, leaving the new untracked files committed alone (e07d974) and recovering with a clean follow-up (24499f2). Better than wip-spam, but the skill's bash -c recovery guidance in step 8 only applies if you detect the wipe before the next commit. Future improvement: implementers should git status after every Edit call to catch wipes early.
• Pre-existing rot detection working as designed. Finalize agent surfaced wasm-clippy --all-targets failure on willow-client (pre-existing on base b075140, not introduced by SEC-A-07). Coordinator filed follow-up [tech-debt] willow-client lib tests don't cfg-gate native-only deps; wasm clippy --all-targets fails pre-existing #506 per skill's "Implementer-flagged out-of-scope rot" rule. Pattern clean.
• SHA-advance vs agent-completion as independent signals worked. The wip-commit pattern triggered multiple SHA-advances per dispatch — coordinator correctly waited for further commits after each SHA-advance, didn't preemptively conclude crash. Skill's existing "two independent signals" guidance held up. Same pattern caught the [GEN-11] Search index rebuilt from scratch on every message-list change #354 second commit cleanly.
• Self-driven brainstorm on [GEN-11] Search index rebuilt from scratch on every message-list change #354 produced a sound design. Implementer chose one spawn_local task per session with hydrate_index + ClientEvent routing over the alternative of layering on top of the existing rebuild Effect. Justification in commit body. The cap-at-256-not-1024 deviation on [SEC-V-02] sync_since builds unbounded SQL from peer-supplied heads #302 also reflected sound TDD-driven discovery (SQLITE_LIMIT_EXPR_DEPTH discovered when test failed).
• Wire-format additive change on [SEC-A-07] JoinResponse / JoinDenied not bound to the inviter; spoofable by any signer #309 was scope-justified. Adding link_id to wire format vs. tracking expected-inviter via separate map was the cleaner design — issue body suggested the latter, brainstorm chose the former for per-link scoping correctness. Pre-1.0 wire changes acceptable; reasoning in commit body.

Test plan

• Local merge gates green per implementer (cargo fmt --check, cargo clippy --all-targets -D warnings, cargo test on touched crates, cargo check + clippy --target wasm32-unknown-unknown for dual-target lib crates).
• Master-PR CI runs full just check-all — load-bearing quality net for the run.
• Headless wasm-pack test --headless --firefox crates/web cross-checked on CI runner (sandbox lacks geckodriver).
• Manual smoke: just dev, send a few cross-channel messages and verify search returns hits from inactive channels (regression sniff for [GEN-11] Search index rebuilt from scratch on every message-list change #354).
• Manual smoke: trigger a join-link race in just dev two-peer setup; spoofed JoinDenied from non-inviter should NOT surface to UI (regression sniff for [SEC-A-07] JoinResponse / JoinDenied not bound to the inviter; spoofable by any signer #309).

Note: pre-existing wasm-clippy --all-targets failure on willow-client (lib tests use tokio/std::fs without cfg-gating) is not introduced by this PR — verified on base commit b075140. Tracked in #506 for follow-up.