Order saved-repository writes across navigation and session changes

Author: antropos17

DESIGN.md

@@ -92,6 +92,11 @@ in-flight step and stops future scheduling, while the current transaction can
 finish. A changing Play/Pause/New run action label uses an ordinary button,
 without a contradictory toggle pressed state. Respect another chosen control.
 
+Repository saves expose a busy button and pending status. Their current-session
+writes run in order even when the user opens another repository; a changed
+repository gets its own form state. Completing a save restores its control only
+on the same route/account and without stealing another chosen input.
+
 ## Motion
 
 No authored animation or transition in the workspace, including modal scale/fade, progress interpolation, hover motion and smooth route scrolling. Update status immediately without recreating the page. Native dialog handles focus and Escape; returning focus must not move the document. Game canvas motion belongs to gameplay and remains independent of workspace chrome.

docs/CONTEXT.md

@@ -82,7 +82,7 @@ and external AI CLIs require a direct user request. Never merge old work implici
 - Existing Commons run 49092854-f9bd-4b7a-8d12-4ac5ea0e5f70 retains the approved,
   unmerged safe-timer change from job 811bdb98-bcbb-4b65-80b9-f19693aef6b4.
   Preserve it. 29 earlier lab experiments were verified before this release work.
-- Public source: antropos17/commit-zero at 5392fc0; all three CI jobs passed with local dfa9ecb's identical tree. Preserve separate histories.
+- Public source: antropos17/commit-zero at f7b61cb; all three CI jobs passed with local 21c0ab1's identical tree. Preserve separate histories.
   README GIF is a 15.8s condensed walkthrough of retained Sequence Kit work,
   not a continuous live recording. Static fallback included; desktop/mobile and all
   three CI jobs passed. Evidence: runtime/verification/github-readme-gif-2026-10-19.json.

docs/DEVELOPMENT.md

@@ -100,7 +100,7 @@ output under `.cache/tmp`. Child processes receive TEMP/TMP/TMPDIR explicitly.
   On Windows, a local Chrome installation can be used without downloading a
   Playwright browser by setting `CZ_BROWSER_EXECUTABLE` to its absolute executable
   path. `CZ_CAPTURE_BROWSER=1` saves catalog desktop/narrow captures under
-  `runtime/verification`. `npm run test:ui` runs four serial groups with fresh
+  `runtime/verification`. `npm run test:ui` runs the configured serial groups with fresh
   disposable in-memory services to preserve scenario independence and keep the
   normal 180-request/minute API limiter active. `scripts/test-ui.mjs`
   checks that each browser spec is listed exactly once. Playwright global setup

docs/FIRST-RUN.md

@@ -63,6 +63,7 @@ do not establish runtime correctness. [Complete workflow](COMMONS.md).
 | Project address is already in use | The form retains its name and description; choose another address and submit again. No duplicate project is created. |
 | Saving a scenario repository is rate limited | The repository shows a persistent message beside **Save**. Wait briefly and select **Save** again; a failed request does not add a bookmark. |
 | Saved repositories are unavailable after sign-in | Your sign-in succeeded. Restore the service and select **Refresh saved repositories** on **My profile**. An unknown list is not shown as empty; a previously loaded list remains visible if refresh fails. |
+| Saving several repositories while navigating | Saves from this page session finish in order. The busy button and Saving status persist until that repository's action finishes. A failed save is not retried automatically; another explicitly requested save can proceed. Signing out cancels saves that have not yet been sent. Use **Refresh saved repositories** to reconcile changes from another tab. |
 | Task fails or is cancelled | Inspect its retained timeline and raw receipt. Retry by explicitly starting a new task; a restarted server does not silently retry jobs. |
 | Provider setup is unavailable | Continue exploring the deterministic example and model-free Commons forms. Do not interpret these as actual model contributions. |
 

docs/HANDOFF-2026-10-19.md

@@ -8,17 +8,17 @@ tracks dated decisions and receipts; this file is the operational entry point.
 ## Repositories and state
 
 - Working repository: `X:\ai-github`, branch `codex/development-foundation`,
-  latest fully checked local commit `dfa9ecb` at this checkpoint. The local data and model
+  latest fully checked local commit `21c0ab1` at this checkpoint. The local data and model
   installation are here. Recheck status before acting; this file can age.
 - Public repository: [antropos17/commit-zero](https://github.com/antropos17/commit-zero),
-  `main` at `5392fc00b2ac2f8faedc507acc63311705a93dcc` after a normal push.
+  `main` at `f7b61cb854c4cd8df1d31f04d631568afedd8188` after a normal push.
   Its separate checkout is `.cache/publication`. The histories are unrelated;
-  the public tree matches local `dfa9ecb` (`ceec86201675ecda32f8c844123f5994c1b8ac28`).
-  Keyboard scenario-control changes are awaiting final gates.
+  the public tree matches local `21c0ab1` (`a7e8072ee4235ae533b03ea92ad3cf5b665095ad`).
+  Ordered bookmark-write and save-focus changes are awaiting final gates.
   Do not merge histories, reset the local branch or force push. Recheck remote
   before publishing anything else.
-- Public CI [run 39233009471](https://github.com/antropos17/commit-zero/actions/runs/39233009471)
-  passed full gate, Chromium and runtime dependency audit for `5392fc0`. Local
+- Public CI [run 39234149501](https://github.com/antropos17/commit-zero/actions/runs/39234149501)
+  passed full gate, Chromium and runtime dependency audit for `f7b61cb`. Local
   `evidence:status` confirmed equal trees and current full/browser receipts. The
   preceding retry-fixture failure at `5f9f88e` is preserved in the mission log.
 - This mission has not run local or hosted model inference, spawned product
@@ -125,16 +125,20 @@ The scenario assertion follows the actual returned step and forbids reset/advanc
 requests. [Desktop error](media/service-health-unavailable-2026-10-19.png) and
 [narrow dark retained state](media/service-health-last-known-2026-10-19.png)
 are real disposable-service captures. Full 81/81 and Chrome 18/18 passed on the
-same frozen source before commit/publication. The next keyboard unit preserves
+same frozen source before commit/publication. The completed keyboard unit preserves
 manual step focus and keeps Pause usable during the current transaction; its
-four focused Chrome tests passed, with full gates pending.
+four focused Chrome tests passed, then all 22 browser journeys, full gate and
+public CI passed. The pending bookmark unit serializes explicit session writes,
+continues after a failed write, and drops unsent work after identity changes.
+Repository form state is scoped to run/repository; save completion respects focus.
+Other tabs are reconciled by explicit saved-list refresh, not cross-tab locking.
 
-- Latest local frozen full gate at `dfa9ecb`: 81/81 Node tests, compiled DOM/axe
+- Latest local frozen full gate at `21c0ab1`: 81/81 Node tests, compiled DOM/axe
   2/2, build and static serving passed. Stable source hash
-  `b68e7f8a312d9ac724e2e845eb690f0db19313e4badf3e96fb5c6590398d9360`;
-  receipts `runtime/verification/health-recovery-{full,browser}-2026-10-19.json`
+  `64ac75502a7c3c75e7141067b6701859a4f43de08c1c3546c6c92a07f0c94b8f`;
+  receipts `runtime/verification/scenario-keyboard-{full,browser}-2026-10-19.json`
   (ignored by Git).
-- Installed Chrome browser suite passed 18/18 at desktop and 390px. Real captures
+- Installed Chrome browser suite passed 22/22 at desktop and 390px. Real captures
   are `runtime/verification/commons-first-run-{desktop,narrow}-2026-10-19.png`,
   `commons-provider-offline-desktop-2026-10-19.png` and catalog captures. Tests
   used in-memory services; provider-health responses were controlled in the
@@ -203,7 +207,7 @@ four focused Chrome tests passed, with full gates pending.
 
 ## Next work, in order
 
-1. Complete keyboard scenario controls: run grouped Chrome and `npm run check` on frozen source,
+1. Complete ordered bookmark writes: run grouped Chrome and `npm run check` on frozen source,
    commit it, copy the unpublished local commit into the separate public
    checkout, compare Git trees, push without force and inspect public CI.
    Record exact SHA and receipt.

docs/MISSION-2026-10-19.md

@@ -12,7 +12,7 @@ Start: 03:46:17 UTC. Deadline: 15:46:17 UTC. Final integration reserve begins 14
 
 ## Current action
 
-Finish keyboard scenario controls after two preserved Chrome failures. Next step now retains entry, terminal/error steps fall back to content, and Pause remains available during a transaction without cancelling its committed work. Verify current-step completion, no future scheduling, chosen-input focus and preserved exports; then frozen full gates and publication. Keep all new profiles disabled. The final integration reserve still begins at 14:16:17 UTC.
+Finish ordered account bookmark writes after a preserved delayed-response race. Explicit saves queue within one identity, failed writes do not poison the queue, and identity changes discard unsent earlier requests. Add visible pending/focus recovery and verify direct repository navigation, error continuation and account switching; then frozen full gates and publication. Keep all new profiles disabled. The final integration reserve still begins at 14:16:17 UTC.
 
 ## Decisions and limits
 
@@ -93,4 +93,7 @@ Finish keyboard scenario controls after two preserved Chrome failures. Next step
 - 09:50 UTC: health/manual-refresh recovery committed locally as `dfa9ecb16afea0c7d5e31ff6bc029a9483fef1ac` after full 81/81 and Chrome 18/18 on the same frozen hash `b68e7f8a312d9ac724e2e845eb690f0db19313e4badf3e96fb5c6590398d9360`. Receipts: `runtime/verification/health-recovery-{full,browser}-2026-10-19.json`. Normal publication produced `5392fc00b2ac2f8faedc507acc63311705a93dcc`, identical tree `ceec86201675ecda32f8c844123f5994c1b8ac28`. CI39233009471 passed all three jobs. Local preflight confirmed current full/browser receipts and both clean equal trees.
 - Chrome then reproduced Next step losing focus after a successful transaction and Pause being disabled while a cycle request was pending. Both traces are retained under `runtime/verification/scenario-keyboard-baseline-2026-10-19`. An initial three-test focused correction passed; the strengthened pause cases also distinguish restoring the control from respecting another chosen input. No model calls or retained-store writes.
 
-Run focused UI, freeze complete source for all browser groups and full gate, then commit/publish the keyboard unit. Next inspect competing bookmark writes and remaining release acceptance gaps. Keep the final 90-minute reserve from 14:16:17 UTC.
+- 10:00 UTC: keyboard scenario controls committed locally as `21c0ab140fb94dae5c030f37688c0cfeadb006f1` after full 81/81 and Chrome 22/22 on frozen hash `64ac75502a7c3c75e7141067b6701859a4f43de08c1c3546c6c92a07f0c94b8f`. Receipts: `runtime/verification/scenario-keyboard-{full,browser,evidence}-2026-10-19.json`. Normal push produced `f7b61cb854c4cd8df1d31f04d631568afedd8188`, identical tree `a7e8072ee4235ae533b03ea92ad3cf5b665095ad`. CI39234149501 passed all three jobs. Diagnostics reported 74 GB free; retained database, identity, backups and model sizes remained unchanged.
+- Chrome reproduced two successful bookmark writes followed by a delayed first response removing the second saved label. Baseline: `runtime/verification/bookmark-write-baseline-2026-10-19`. A separate actual focus failure is retained under `bookmark-focus-baseline-2026-10-19`. Six focused account tests passed the queue/error/session contracts before the final pending/focus refinement. The queue has no automatic write retry, provider execution or database migration.
+
+Complete focused account/UI checks, then freeze all source for the full 25-test browser suite and `npm run check`; commit/publish and inspect CI. Next inspect release acceptance gaps and generic resource failure states. Keep the final 90-minute reserve from 14:16:17 UTC.

prototype/app/App.jsx

@@ -126,6 +126,7 @@ function Page({ route, preview, notify }) {
     case "repo":
       return (
         <Repository
+          key={`${data.runId}/${id}`}
           id={id}
           tab={tab}
           file={file}

prototype/app/pages/workspace.jsx

@@ -530,6 +530,16 @@ export function Repository({ id, tab = "code", file, preview, notify }) {
   const account = useAccount();
   const [saving, setSaving] = useState(false);
   const [saveError, setSaveError] = useState("");
+  const saveOrigin = useRef(null);
+  useLayoutEffect(() => {
+    if (saving) return;
+    const pending = saveOrigin.current;
+    saveOrigin.current = null;
+    if (pending && pending.owner === account.user?.id &&
+        pending.hash === location.hash && pending.node.isConnected &&
+        (document.activeElement === document.body || document.activeElement === pending.node))
+      pending.node.focus({ preventScroll: true });
+  }, [saving, account.user?.id]);
   const r = data.repos.find((x) => x.id === id);
   if (!r) return <NotFound />;
   const prs = data.prs.filter((p) => p.repo === id),
@@ -545,7 +555,8 @@ export function Repository({ id, tab = "code", file, preview, notify }) {
       notify("Copy unavailable. Select the code and copy it manually.");
     }
   }
-  async function save() {
+  async function save(event) {
+    saveOrigin.current = { node: event.currentTarget, hash: location.hash, owner: account.user?.id };
     setSaving(true);
     setSaveError("");
     try {
@@ -692,7 +703,7 @@ export function Repository({ id, tab = "code", file, preview, notify }) {
             </button>
           )}
           {account.user ? (
-            <button className="btn" disabled={saving} onClick={save}>
+            <button className="btn" disabled={saving} aria-busy={saving} onClick={save}>
               {account.bookmarks.includes(id) ? "Saved" : "Save"}
             </button>
           ) : (
@@ -711,6 +722,7 @@ export function Repository({ id, tab = "code", file, preview, notify }) {
             <span className="count">{r.stars.length}</span>
           </a>
         </div>
+        {saving && <p className="field-help" role="status">Saving repository…</p>}
         {saveError && <p className="repo-save-error" role="alert">{saveError}</p>}
       </div>
       <Tabs

prototype/app/state.jsx

@@ -145,10 +145,12 @@ export function AccountProvider({ children }) {
     [checked, setChecked] = useState(false);
   const currentUser = useRef(null),
     identityVersion = useRef(0),
-    bookmarkVersion = useRef(0);
+    bookmarkVersion = useRef(0),
+    bookmarkQueue = useRef(Promise.resolve());
   const installIdentity = useCallback((next) => {
     identityVersion.current++;
     bookmarkVersion.current++;
+    bookmarkQueue.current = Promise.resolve();
     currentUser.current = next;
     setUser(next);
     setBookmarks([]);
@@ -222,24 +224,31 @@ export function AccountProvider({ children }) {
     currentUser.current = result.user;
     setUser(result.user);
   };
-  const bookmark = async (repo, saved) => {
+  const bookmark = (repo, saved) => {
     const identity = identityVersion.current,
       owner = currentUser.current?.id;
-    const result = await request(
-      `account/bookmarks/${encodeURIComponent(repo)}`,
-      { method: "PUT", body: { saved } },
-    );
-    if (
-      identityVersion.current !== identity ||
-      currentUser.current?.id !== owner
-    )
-      return;
-    // A read captured before this completed write must never replace its result.
-    bookmarkVersion.current++;
-    setBookmarks(result.bookmarks);
-    setBookmarksKnown(true);
-    setBookmarksLoading(false);
-    setBookmarksError("");
+    const isCurrent = () => owner && identityVersion.current === identity &&
+      currentUser.current?.id === owner;
+    // Responses contain full lists without revisions. Serialize this session's
+    // explicit writes so a delayed earlier response cannot undo a later list.
+    const operation = bookmarkQueue.current.then(async () => {
+      if (!isCurrent()) return { applied: false };
+      const result = await request(
+        `account/bookmarks/${encodeURIComponent(repo)}`,
+        { method: "PUT", body: { saved } },
+      );
+      if (!isCurrent()) return { applied: false };
+      // A read captured before this completed write must never replace its result.
+      bookmarkVersion.current++;
+      setBookmarks(result.bookmarks);
+      setBookmarksKnown(true);
+      setBookmarksLoading(false);
+      setBookmarksError("");
+      return { applied: true };
+    });
+    // Keep the caller's error, while allowing the next explicit save to proceed.
+    bookmarkQueue.current = operation.catch(() => {});
+    return operation;
   };
   return (
     <Account.Provider