fix: keep Later plans conflict-safe across devices (#377)

tests/test_later_store.py

@@ -86,6 +86,57 @@ def test_batch_applies_in_one_ordered_idempotent_unit(tmp_path):
     assert replay["duplicate_operation_ids"] == ["first", "second"]
 
 
+def test_batch_rejects_stale_same_item_intent_without_blocking_other_items(tmp_path):
+    store = LaterStore(tmp_path / "later.sqlite3")
+    first = store.apply_batch("timmy", [{
+        "operation_id": "newer-device",
+        "action": "defer",
+        "item_id": "issue:r:1:",
+        "wake_at": "2026-08-12T09:00:00.000Z",
+        "base_revision": 0,
+    }])
+
+    replay = store.apply_batch("timmy", [
+        {
+            "operation_id": "stale-device",
+            "action": "defer",
+            "item_id": "issue:r:1:",
+            "wake_at": "2026-08-10T09:00:00.000Z",
+            "base_revision": 0,
+        },
+        {
+            "operation_id": "unrelated-item",
+            "action": "defer",
+            "item_id": "issue:r:2:",
+            "wake_at": "2026-08-11T09:00:00.000Z",
+            "base_revision": 0,
+        },
+    ])
+
+    assert first["revision"] == 1
+    assert replay == {
+        "revision": 2,
+        "records": {
+            "issue:r:1:": "2026-08-12T09:00:00.000Z",
+            "issue:r:2:": "2026-08-11T09:00:00.000Z",
+        },
+        "accepted_operation_ids": ["unrelated-item"],
+        "duplicate_operation_ids": [],
+        "rejected_operations": [
+            {"operation_id": "stale-device", "reason": "stale_intent"}
+        ],
+    }
+    duplicate = store.apply_batch("timmy", [{
+        "operation_id": "stale-device",
+        "action": "restore",
+        "item_id": "issue:r:2:",
+        "base_revision": 2,
+    }])
+    assert duplicate["duplicate_operation_ids"] == ["stale-device"]
+    assert duplicate["revision"] == 2
+    assert duplicate["records"] == replay["records"]
+
+
 @pytest.mark.anyio
 async def test_authenticated_later_api_uses_confirmed_account_and_csrf(monkeypatch, tmp_path):
     monkeypatch.setenv("STACKCHAIN_DASHBOARD_AUTH_MODE", "operator")
@@ -129,6 +180,21 @@ async def test_authenticated_later_api_uses_confirmed_account_and_csrf(monkeypat
                 "X-CSRF-Token": client.cookies["stackchain_csrf"],
             },
         )
+        stale = await client.patch(
+            "/api/v1/later",
+            json={
+                "operations": [{
+                    "operation_id": "offline-stale",
+                    "action": "restore",
+                    "item_id": "issue:stackchain/dashboard:363:",
+                    "base_revision": 0,
+                }],
+            },
+            headers={
+                "Origin": "https://test",
+                "X-CSRF-Token": client.cookies["stackchain_csrf"],
+            },
+        )
         fetched = await client.get("/api/v1/later")
 
     assert forbidden.status_code == 403
@@ -143,6 +209,10 @@ async def test_authenticated_later_api_uses_confirmed_account_and_csrf(monkeypat
         "duplicate_operation_ids": [],
         "rejected_operations": [],
     }
+    assert stale.json()["rejected_operations"] == [
+        {"operation_id": "offline-stale", "reason": "stale_intent"}
+    ]
+    assert stale.json()["revision"] == 2
     assert fetched.json() == {"revision": 2, "records": {
         "issue:stackchain/dashboard:363:": "2026-08-10T09:00:00.000Z",
         "issue:stackchain/dashboard:365:": "2026-08-11T09:00:00.000Z",

tests/test_later_sync.py

@@ -90,12 +90,44 @@ sync.enqueue('defer','issue:r:2:','2026-08-10T09:00:00.000Z');
         "action": "defer",
         "item_id": "issue:r:2:",
         "wake_at": "2026-08-10T09:00:00.000Z",
+        "base_revision": 0,
     }]}
     assert result["records"]["issue:r:2:"] == "2026-08-10T09:00:00.000Z"
     assert result["status"] == "saved"
     assert result["pending"] == []
 
 
+def test_stale_receipt_adopts_server_truth_and_reports_another_device_conflict():
+    script = f"""
+const createLaterSync=require({json.dumps(str(LATER_SYNC))});
+const values=new Map();const requests=[];const statuses=[];const adopted=[];
+const storage={{getItem:k=>values.get(k)||null,setItem:(k,v)=>values.set(k,v),removeItem:k=>values.delete(k)}};
+const sync=createLaterSync({{
+ storage,getLogin:()=> 'timmy',createOperationId:()=> 'offline-old',
+ fetchJson:async(_url,options={{}})=>{{
+   if(!options.method)return {{revision:3,records:{{'issue:r:1:':'2026-08-12T09:00:00.000Z'}}}};
+   const body=JSON.parse(options.body);requests.push(body);
+   return {{revision:4,records:{{'issue:r:1:':'2026-08-13T09:00:00.000Z'}},accepted_operation_ids:[],duplicate_operation_ids:[],rejected_operations:[{{operation_id:'offline-old',reason:'stale_intent'}}]}};
+ }},onRemoteRecords:records=>adopted.push(records),onStatus:(state,detail={{}})=>statuses.push([state,detail]),
+}});
+(async()=>{{await sync.flush();sync.enqueue('defer','issue:r:1:','2026-08-10T09:00:00.000Z');await sync.flush();
+process.stdout.write(JSON.stringify({{requests,statuses,adopted,pending:sync.pending()}}));}})();
+"""
+    result = run_node(script)
+    assert result["requests"] == [{"operations": [{
+        "operation_id": "offline-old",
+        "action": "defer",
+        "item_id": "issue:r:1:",
+        "wake_at": "2026-08-10T09:00:00.000Z",
+        "base_revision": 3,
+    }]}]
+    assert result["statuses"][-1] == ["conflict", {"count": 1}]
+    assert result["adopted"][-1] == {
+        "issue:r:1:": "2026-08-13T09:00:00.000Z"
+    }
+    assert result["pending"] == []
+
+
 def test_pending_later_edits_are_sent_as_one_batch_without_a_preflight_get():
     script = f"""
 const createLaterSync=require({json.dumps(str(LATER_SYNC))});
@@ -136,6 +168,7 @@ sync.enqueue('restore','issue:r:2:');
                 "action": "restore",
                 "item_id": "issue:r:2:",
                 "wake_at": None,
+                "base_revision": 0,
             }
         ],
         "status": "retrying",
@@ -283,10 +316,11 @@ async def test_dashboard_syncs_every_later_change_and_exposes_account_status():
     assert "laterSync.migrate(laterWork.read());" in html
     assert "laterSync.flush();" in html
     assert "Later saved to account." in html
+    assert "Another device changed this Later item" in html
 
 
 def test_later_sync_ships_atomically_in_the_offline_shell():
     source = (Path(__file__).parents[1] / "frontend" / "service-worker.js").read_text()
 
-    assert "stackchain-dashboard-shell-v54" in source
+    assert "stackchain-dashboard-shell-v55" in source
     assert "BASE + 'static/later-sync.js'" in source

tests/test_markdown_renderer.py

@@ -137,4 +137,4 @@ def test_markdown_work_bodies_are_mobile_safe_block_containers():
     assert ".markdown-content { min-width:0; max-width:100%; overflow-wrap:anywhere;" in css
     assert ".markdown-content pre { max-width:100%; overflow-x:auto;" in css
     assert ".markdown-content a { min-height:44px;" in css
-    assert "stackchain-dashboard-shell-v54" in worker
+    assert "stackchain-dashboard-shell-v55" in worker

tests/test_mobile_composer_integration.py

@@ -35,4 +35,4 @@ def test_offline_shell_contains_every_local_dashboard_runtime_asset():
     shell_assets = set(re.findall(r"BASE \+ '([^']+)'", worker.split("async function sessionCsrf", 1)[0]))
 
     assert local_assets <= shell_assets, f"Offline shell is missing: {sorted(local_assets - shell_assets)}"
-    assert "stackchain-dashboard-shell-v54" in worker
+    assert "stackchain-dashboard-shell-v55" in worker

tests/test_service_worker.py

@@ -108,7 +108,7 @@ async function dispatchNotificationClick(route) {{
 def test_duplicate_aware_capture_ships_in_a_new_offline_shell():
     source = WORKER.read_text()
 
-    assert "stackchain-dashboard-shell-v54" in source
+    assert "stackchain-dashboard-shell-v55" in source
     assert "BASE + 'static/create-issue-sheet.js'" in source
     assert "BASE + 'static/dashboard.js'" in source
 
@@ -116,14 +116,14 @@ def test_duplicate_aware_capture_ships_in_a_new_offline_shell():
 def test_exact_later_picker_ships_atomically_in_a_new_offline_shell():
     source = WORKER.read_text()
 
-    assert "stackchain-dashboard-shell-v54" in source
+    assert "stackchain-dashboard-shell-v55" in source
     assert "BASE + 'static/later-picker.js'" in source
 
 
 def test_navigation_deadline_ships_in_a_new_shell_cache():
     source = WORKER.read_text()
 
-    assert "stackchain-dashboard-shell-v54" in source
+    assert "stackchain-dashboard-shell-v55" in source
     assert "BASE + 'static/dashboard.css'" in source
     assert "BASE + 'static/dashboard.js'" in source
     assert "BASE + 'static/install-app.js'" in source
@@ -132,21 +132,21 @@ def test_navigation_deadline_ships_in_a_new_shell_cache():
 def test_today_convergence_ships_in_a_new_shell_cache():
     source = WORKER.read_text()
 
-    assert "stackchain-dashboard-shell-v54" in source
+    assert "stackchain-dashboard-shell-v55" in source
     assert "BASE + 'static/today-sync.js'" in source
 
 
 def test_mobile_search_viewport_ships_in_a_new_offline_shell():
     source = WORKER.read_text()
 
-    assert "stackchain-dashboard-shell-v54" in source
+    assert "stackchain-dashboard-shell-v55" in source
     assert "BASE + 'static/mobile-search-viewport.js'" in source
 
 
 def test_update_ownership_flow_ships_atomically_in_a_new_offline_shell():
     source = WORKER.read_text()
 
-    assert "stackchain-dashboard-shell-v54" in source
+    assert "stackchain-dashboard-shell-v55" in source
     assert "BASE + 'static/update-ownership.js'" in source
 
 

tests/test_today_sync.py

@@ -86,7 +86,7 @@ sync.enqueue('add', 'issue:r:1:');
 def test_inflight_today_drain_ships_in_a_new_offline_shell():
     source = (Path(__file__).parents[1] / "frontend" / "service-worker.js").read_text()
 
-    assert "stackchain-dashboard-shell-v54" in source
+    assert "stackchain-dashboard-shell-v55" in source
     assert "BASE + 'static/today-sync.js'" in source