ocuclaw 1.3.1 → 1.3.3

package/dist/tools/glasses-ui-cron.js

@@ -85,7 +85,7 @@ export function createGlassesUiCronEngine(deps) {
     return Object.assign({}, outcome, extra);
   }
 
-  function resolveAndClean(state, extra) {
+  function resolveAndClean(state, extra, opts) {
     if (state.resolved) return;
     state.resolved = true;
     if (state.nextTickTimer) clearTimeoutFn(state.nextTickTimer);
@@ -93,6 +93,12 @@ export function createGlassesUiCronEngine(deps) {
     state.nextTickTimer = null;
     state.maxDurationTimer = null;
     active.delete(state.surfaceId);
+    // silent: tear down timers/state WITHOUT firing onResolve. Used when the
+    // cron slot is being RECYCLED (a replace render swapping the surface's
+    // content in place) — a synthesized outcome here would reach
+    // surfaceStore.resolve with no pending call and LATCH a bogus exit that
+    // discards the very render doing the replacing (B7, found 2026-06-11).
+    if (opts && opts.silent === true) return;
     try {
       state.onResolve(makeOutcome(state, extra));
     } catch (_) {
@@ -305,6 +311,12 @@ export function createGlassesUiCronEngine(deps) {
         resolved: false,
         nextTickTimer: null,
         maxDurationTimer: null,
+        // Pause-aware duration accounting (roadmap 6e): the cap measures
+        // ACTIVE time only. remainingMs is banked on pause and re-armed on
+        // resume; armedAtMs is monotonic (never wall-clock — the 2026-06-01
+        // freeze came from mixing clocks).
+        maxDurationRemainingMs: params.refresh.maxDurationMs,
+        maxDurationArmedAtMs: null,
         isSmokeTest: false,
         lastTickAt: null,
         generationToken: 0,
@@ -313,7 +325,14 @@ export function createGlassesUiCronEngine(deps) {
       };
       active.set(state.surfaceId, state);
       // Arm the duration cap.
+      state.maxDurationArmedAtMs = monotonicNowMs();
       state.maxDurationTimer = setTimeoutFn(() => {
+        // Cron-death observability (Wave-1 e2e leg-4 gap): the cap firing was
+        // invisible — bounded tick-silence watches were the only evidence.
+        emitLifecycle("cron_max_duration_reached", "debug", {
+          surfaceId: state.surfaceId,
+          sessionKey: state.sessionKey,
+        });
         resolveAndClean(state, { result: "timeout" });
       }, params.refresh.maxDurationMs);
       // start() is sync; runSmokeTest is async. Catch any rejection so it
@@ -326,10 +345,10 @@ export function createGlassesUiCronEngine(deps) {
         });
       });
     },
-    stop(surfaceId, outcome) {
+    stop(surfaceId, outcome, opts) {
       const state = active.get(surfaceId);
       if (!state) return false;
-      resolveAndClean(state, outcome || { result: "preempted" });
+      resolveAndClean(state, outcome || { result: "preempted" }, opts);
       return true;
     },
     stopAllForSession(sessionKey, outcome) {
@@ -374,6 +393,20 @@ export function createGlassesUiCronEngine(deps) {
         clearTimeoutFn(state.nextTickTimer);
         state.nextTickTimer = null;
       }
+      // Pause-aware duration cap (roadmap 6e): stop the wall-clock burn and
+      // bank the remaining ACTIVE budget. Pre-6e the cap kept running while
+      // the parent hid under a pushed child — hardware-observed 2026-06-11
+      // as cron_resume {found:false} → Back landed on a frozen list. Guarded
+      // on the timer handle so a double-pause cannot double-deduct.
+      if (state.maxDurationTimer) {
+        clearTimeoutFn(state.maxDurationTimer);
+        state.maxDurationTimer = null;
+        state.maxDurationRemainingMs = Math.max(
+          0,
+          state.maxDurationRemainingMs - (monotonicNowMs() - state.maxDurationArmedAtMs),
+        );
+        state.maxDurationArmedAtMs = null;
+      }
       state.paused = true;
       // Bump so an in-flight tick (started before pause) is discarded when it
       // resolves — it must not patch the now-hidden parent screen.
@@ -392,6 +425,29 @@ export function createGlassesUiCronEngine(deps) {
         });
         return false;
       }
+      // Re-arm the duration cap with the banked ACTIVE remainder (roadmap
+      // 6e). An exhausted budget resolves terminal timeout here instead of
+      // re-arming a dead cron — honest death beats a zombie surface.
+      if (!state.maxDurationTimer) {
+        if (state.maxDurationRemainingMs <= 0) {
+          emitLifecycle("cron_resume", "debug", {
+            surfaceId,
+            found: true,
+            resolved: false,
+            branch: "max_duration_exhausted",
+          });
+          resolveAndClean(state, { result: "timeout" });
+          return false;
+        }
+        state.maxDurationArmedAtMs = monotonicNowMs();
+        state.maxDurationTimer = setTimeoutFn(() => {
+          emitLifecycle("cron_max_duration_reached", "debug", {
+            surfaceId: state.surfaceId,
+            sessionKey: state.sessionKey,
+          });
+          resolveAndClean(state, { result: "timeout" });
+        }, state.maxDurationRemainingMs);
+      }
       state.paused = false;
       if (state.nextTickTimer) {
         clearTimeoutFn(state.nextTickTimer);

package/dist/tools/glasses-ui-paint-floor.js

@@ -2,15 +2,22 @@
 //
 // Governs ALL plugin->glass sends (initial RebuildPageContainer render and
 // every surface_update patch). Collapses bursts to last-write-wins per field
-// and emits at most one frame per paintFloorMs (default 150ms, Spike D), with
-// a leading-edge send + a trailing send carrying the final merged patch.
+// and emits at most one frame per paintFloorMs, with a leading-edge send + a
+// trailing send carrying the final merged patch.
 //
 // There is NO glass-side paint-ack: the only backpressure signal is
 // relay/BLE transport-side (see the isUnderBackpressure shed in Task 13).
 // Local fake-list textContainerUpgrade scroll-swaps are client-side and never
 // reach this coalescer.
+//
+// 250 is the unconditionally hardware-proven floor. Spike D approved lowering
+// to 150 ONLY once the backpressure shed has a live signal; the shed's
+// isGlassesSendBufferOverHighWater query is implemented nowhere yet, so the
+// shed is inert and 150 would run without its safety condition. Restore 150
+// when the relay-service bridge lands and is validated on hardware
+// (roadmap step 4, docs/superpowers/plans/2026-06-10-glasses-ui-state-reset-and-roadmap.md).
 
-export const DEFAULT_PAINT_FLOOR_MS = 150;
+export const DEFAULT_PAINT_FLOOR_MS = 250;
 
 export function createPaintFloorCoalescer(deps) {
   const paintFloorMs = Number.isFinite(deps.paintFloorMs) ? deps.paintFloorMs : DEFAULT_PAINT_FLOOR_MS;
@@ -28,6 +35,14 @@ export function createPaintFloorCoalescer(deps) {
     return !!(p && p.__render === true);
   }
 
+  function markerOf(p) {
+    if (!p) return undefined;
+    return p.__marker !== undefined ? p.__marker : p.marker;
+  }
+  function isMarkerOnly(p) {
+    return !!p && !isRenderSentinel(p) && Object.keys(p).length === 1 && p.marker !== undefined;
+  }
+
   function mergePatch(base, incoming) {
     // A render sentinel ({ __render, __depth, __spec }, Task 13) and a field
     // patch ({ body }/{ items }/{ title }) must NEVER shallow-merge — a merged
@@ -36,8 +51,22 @@ export function createPaintFloorCoalescer(deps) {
     // earlier one wholesale (a render replaces a queued field patch; a field
     // patch after a queued render replaces that render). Same-kind writes
     // merge last-write-wins per field as before.
+    //
+    // Marker-only field patch must NEVER drop a queued render (7a): merge the
+    // marker onto the render sentinel instead of superseding it wholesale.
+    if (isMarkerOnly(incoming) && isRenderSentinel(base)) {
+      return { ...base, __marker: incoming.marker };
+    }
     if (isRenderSentinel(base) !== isRenderSentinel(incoming)) {
-      return incoming && typeof incoming === "object" ? { ...incoming } : {};
+      // Different write kinds: later supersedes wholesale (a render replaces a
+      // queued field patch; a content field patch replaces a queued render).
+      // Marker is sticky — carry it forward if the survivor didn't set one.
+      const next = incoming && typeof incoming === "object" ? { ...incoming } : {};
+      if (markerOf(next) === undefined) {
+        const m = markerOf(base);
+        if (m !== undefined) { if (isRenderSentinel(next)) next.__marker = m; else next.marker = m; }
+      }
+      return next;
     }
     const merged = base ? { ...base } : {};
     if (incoming && typeof incoming === "object") {