[jlewi]

A release upgrade previously waited for every tab to preserve edits and acknowledge readiness before replacing storage and reloading all pages. A frozen tab or failed storage request could hold up that coordination indefinitely.

Activation now replaces the shared storage worker under its existing lifetime lock without asking other tabs to prepare. Only the initiating tab reloads automatically. Other tabs retain their mounted editors and reconnect independently to the selected worker; a stable capability handshake precedes data RPCs. Confirmed incompatibility attempts local recovery once, while timeouts never trigger an automatic reload.

Each tab preserves its editor contents, captured baseline, observed history, actor identity, and exact pending operations in a verified, versioned session-storage checkpoint before reloading. The new app restores the captured editor and replays identical operation IDs, preserving concurrent edits and deduplicating lost acknowledgements. Quota errors, preservation deadlines, active execution, and uncertain generic mutations keep that tab open. Legacy snapshot editors require a durable flush. Published manifests declare tabRecoveryFormat: 1. Rolling back to a release without that contract first flushes the initiating tab durably; current peers refuse to discard their editors into an incompatible checkpoint reader. Historical launchers keep their original policy, so pre-bootstrap installations use the explicit migration entrypoint.

Storage restart remains separate from app reload. Independent management diagnostics report worker startup phase, elapsed time, and pending requests; stop/force-stop and restart controls remain available. Release recovery controls expose published releases, exact commit/build selection, downloads and release-settings diagnostics even when settings fail. Force close requires a responsive worker event loop; it does not steal the ownership lock.

Validation:

• Required SHELL=/bin/bash runme run build test passed.
• 184 focused unit/UI tests passed, including notebook restoration, checkpoint failure, bounded console backup, RPC negotiation, and release controls.
• Isolated Chromium passed lost-acknowledgement replay across a real page reload, concurrent peer edits, force/graceful worker restart without reload, and independent retries after a missed stop notification.
• Production-bundle browser acceptance passed frozen-peer activation, older UI saving through the new worker, quota failure preserving the page, local incompatibility recovery before any data RPC, offline rollback, broken app/worker recovery, and observable real IndexedDB stalls.
• App typecheck adds no diagnostics over the existing baseline. Changed lifecycle/UI lint and diff checks passed.

The design and CUJs document the independent-tab lifecycle and historical migration boundary. CI includes checkpoint/negotiation tests and both current and frozen release compatibility suites. The final historical browser run passed upgrade, offline migration-entry startup, rollback with a current peer left open, and broken-app/worker recovery against frozen commit 9a5fdbf0ca30bf73431b7c4eb90f75f3c91e3ecf. Publisher tests verify the recovery capability survives manifest publication. A deterministic regression test also verifies that normal editor restoration finishes before the orphan-checkpoint scan, preventing duplicate save sessions after reload. CI passed both current and frozen historical release suites for ddecc8c. One local fault-injection run timed out observing the worker settings-read failure; five isolated repetitions passed without runtime changes. Startup acceptance now records full worker status history on failure. The complete final candidate acceptance gate passed for eb786ba.

Deployed to staging at commit eb786ba8f28f8473300592c442f55b5d75c7db37, release eb786ba8f28f8473300592c442f55b5d75c7db37-8a74c53ceb6d8b89f804354bdd17f1329675f65955ef733d9b4d3bb0c38b605b. Verified all 514 asset hashes before pointer promotion, then verified stable/latest and root files through the gateway. An isolated staging browser created a notebook, saved content, reloaded only its tab, restored the content, and cleared its acknowledged recovery checkpoint with no page errors.