[trissim]

P401: screen-independent session ownership

Draft; source repair published, qualification incomplete. Toad 8da6f2b494215a270b7c7dcca880f5328b071772 is pushed, remote-equal and clean; main 91073f0f4 was fetched and confirmed included before committing. Core remains explicitly pinned/locked to P434/#2480 head 67d309df6311aec0d3d173290d941dfced7cf4f0. Production changes are at7bd56f7cf and77b2b8926. The current8da6f2b49 changes test placement, documentation and assertions only; git diff77b2b8926..8da6f2b -- src/toad is empty. Qualification below is explicitly revision-specific.

Latest hosted result at8da6f2b49: Debt ratchet SUCCESS, separate suite SKIPPED (run39702011045, job119573222582). This is hosted source/surface-check status, not a full-suite, native or installed acceptance claim. PR remains draft. Readback: P401-17954-pr-readback.json.

Six introduced source findings repaired at7bd56f7cf

• CLI startup selection returns AgentAttached directly from the matched catalog record; deleted the second name lookup and optional result decision. AgentReadError returns NoAgent directly, not an empty catalog.
• IMPL-12: removed DeliveryFailureView.flash and its copied duration/style signature. Its existing Textual getter exposes the composed Flash as feedback; all37 feedback call sites use feedback.flash. Flash alone owns duration/default/style behavior. No compatibility method or alias remains.
• IDEN-1 /IMPL-10: SessionName no longer recombines authored=None and thread_title. AuthoredSessionName retains the user's label; ThreadSessionName owns following titles and renamed identities. Both return SessionName, never None. Deleted the two construction forwarders and optional-result decisions in SessionDetails/SessionTracker; actual name equality controls updates/events.
• NativeSessionEntry supplies its existing SessionDetails object before mounting MainScreen; conversation construction takes its initial title from that object. Deleted the optional Textual-ID assertion and reverse tracker lookup. The entry still owns registration/details; no second record, nullable field or index was added.
• Removed the unused cursor_block_child forwarding property and its menu-handler absence check. The menu handler invalidates the existing CursorContainer unconditionally, including when an action clears selection; rendering remains derived from ContentNavigation.
• Deleted two unused imports of the already removed toad.messages module encountered in the touched slash-command family.
• Checkpoint:13 files,135 additions/105 deletions, including11 nominal-state/event cases in tests/model/test_session_name.py. Focused Ruff(F821,F811,F401,E9) and git diff --check passed. No local ratchet or full suite ran.
• Before AST:287 production+290 tests+431 pinned Core modules; after7bd and final8da:287 production+291 tests+431 pinned Core modules. All completed rc0 with zero parse omissions, through the same existing refactor-audit owner. Dynamic aliases/return types and runtime dispatch remain outside its syntactic resolution proof. Receipts: P401-six-{before,after}-ast.txt and P401-17954-final-ast.txt under the owned pi-story-tool scratch directory.
• Hosted at7bd56f7cf cleared all six introduced absence sites (introduced_lines={}), but reported one stale toad.messages import in screens/store.py and formatting of the owned status_thread.py. Both were fixed at77b2b8926, alongside deleting the now-unused ContentNavigation.selected forwarder. The initial new event test used the wrong subscription signature;77b2b8926 uses the actual bound-receiver subscription contract. No production implementation was patched for that test.
• Hosted at77b2b8926 passed production comparison, then ran78 surface cases:75 passed,3 failed. The remaining failures were test-layer placement and an exact-docstring-prefix assertion. At8da6f2b49 four actual UI tests (agent_binding, other_route_status, session_scope, welcome_view) move from app to textual. Removed the wording-only startswith('Textual-facing:') test and its duplicate documentation requirement; actual frontend-import, neutral-question, fixture, path and unique-file-name checks remain. This does not waive a product, native or route guard. Strengthened the other-route assertion to cover workers on every descendant of the surface, not just the parent.
• Fresh x453 at7bd56f7cf:16 executed,15 passed,1 failed/58.22s. The failure was the new event test's subscription signature; all four startup-binding cases and SessionScope's scripted ACP send/reply/sidebar/tab-return journey passed. Fresh x454 at77b2b8926:19 executed,19 passed/90.87s, runner/wrapper0 and clean unchanged heads. Covered11 label/event cases,6 mounted draft-preservation cases, the real block menu/copy/expansion journey through a private X display, and other-route status with no worker/root creation. No native owner was started. Fresh x455 at8da6f2b49:11 executed,11 passed/32.54s, runner/wrapper0 and clean unchanged heads. Nine preserved layer checks pass; the stronger other-route descendant-worker check passes; SessionScope again sends/receives through the scripted ACP peer and survives sidebar focus and tab return. Fresh x456 at8da6f2b49:3 executed,3 passed/51.71s, runner/wrapper0 and clean unchanged heads. Channel/DM/feed open-send-return, renamed DM warm tab/screen/chat/window/draft retention and current-name send, and same-name peer recreation with old-view retirement/new-incarnation destination all passed. These source-App runs do not establish physical installed/native acceptance.
• Managed-native and installed acceptance remain open. Latest inspected P464 correction is fork-fix-z/#2591 at5040f7744, still OPEN; its accepted review is not a merge or P401 qualification. The earlier2585 merge retained the sent-back branches. claude-ai owns selecting this exact Toad/Core pair for rehearsal and landing; the native prefix guard is working and unchanged. Installed Core advanced toafb5909c8, but that installation does not contain/qualify this unmerged pair.

Historical paired qualification through4fe7738eb

P434's replacement head integrates main6c90b407f, including GoalExecution/ControlledExecution, without restoring the four obsolete P417 commits: git cherry confirms all four patches already exist in the PR history. No P417 edits or competing Core checkout. The missing-import blocker is resolved: fresh x445 ran app cases, completing twelve passes before the batch reached its250-second limit (rc124). It produced no final pytest XML/report; this is not full qualification. The native helper migration from unit-goalblock's explicitly supplied #1135 headf7f7448c4 is integrated at3826c782d. Conflicts retain the existing AgentConnection/NoAgentConnection types, UI-free NavigationContext and startup binding=AgentAttached. Fresh x446 completed five cases successfully, including renamed-DM warm rendered return and other-route/no-worker status. Native x447 executed two cases and both failed before completing their journey: the slow-open fixture calls deleted Messaging.send_initial_cohort, and the real ACP server cannot acquire the prepared native package under immutable cached Core67d. Its traceback is NativePackageError followed by PublicationActivationBlocked before attachment. The installed7dc tree has the same manifest, but copying/linking it into a checkout would not suffice: VerifiedNativePackage.acquire at native_package.py:428 requires the running interpreter's runtime prefix. Source inspection confirms fork-shape-p17474. These native workflows have not run; the recorded pytest setup failures remain failures, not skipped/passing cases. No source/cache or guard has been changed. Commander17431 supersedes artifact reuse: native acceptance waits for claude-ai's paired hosted install-rehearsal fix, which must select Toad#1115 rather than Toad main. No local native runs or hand-built runtimes. Independent x448 completed both remaining conversation/incarnation cases successfully. The stale send/private-route fixture family is corrected in a32f8cf, with zero old API symbols. The earlier route-fixture/final-AST launch returned UNKNOWN and produced no receipts at inspection. Commander17275 clarifies that local tests and AST inventories are not deliveries to agents; fresh isolated work can run with new log names. The original launch remains unclaimed. Fresh AST at a32 completed:287 production+291 test+431 pinned Core modules, zero omissions. Fresh x450 executed two fixture cases:0 passed,2 failed/15.12s, both on additional retired APIs. At1a4e4c5ee, the65-line ChannelParticipants test is deleted because main deliberately removed that duplicate widget in f59aa13. Fresh x451 then executed2 cases: SessionScope passed, while the channel test's process-local profiler could not observe notification reads performed in another process. At4fe7738eb that obsolete profiler is deleted: the test now checks CoordinationAccess.notification_interest/notification_views, the existing owner of actual subscriptions, while preserving live-update, parked-view and return UI assertions. No retired API or widget was restored. Current production-source hosted check at a32 failed on six introduced NoneAbsence sites: cli.py:77, delivery_failure_view.py:106, screens/main.py:368, session_tracker.py:130,136 and widgets/conversation.py:1348. P401 owns their source repair; no waiver, green check or delivery claimed. Fresh x452 at4fe7738eb completed1 case,1 passed/16.92s: live channel updates, no parked notification subscription, return update and same chat widget.

Ownership and deletions

• Mounted SessionView implements UI-free SessionScope. All 15 measured local concrete-screen imports were removed; current source search is zero. NavigationContext/NavigationOwner are UI-free; ToadNode owns app refinement. SessionView supplies the sole NoTarget default. Native membership derives from WorkspaceSessions.

• KnownTranscript/NoTranscript own reads, observations, originals, status, mailbox behavior and matching. Deleted duplicate tuple/None dispatch, the extra observer and competing session-match logic.

• CLI decodes startup AgentBinding once; app requires and retains it. NoAgent/AgentAttached own selection behavior. AgentConnection/NoAgentConnection own the distinct connection lifetime. Deleted AgentBinding.of, opening_agent, agent_definition, saved_session_id and saved-ID forwarding. Saved-session reuse precedes catalog/database reads. All constructor callers migrated, without aliases.

• HistoryRouted owns required conversation declaration/registration; missing and duplicate registrations fail loudly.

• DM identity is ThreadIncarnation. Opening names resolve before retaining a conversation/key. Tabs, unread, paging, status/details, navigation and sends resolve current names through Core CurrentDisplayReferences.thread(peer), backed by RegistrySnapshot.by_lookup. No Toad name index, fallback or new observer. HistorySessionEntry uses existing MroProjection; current chat reference handling discards the generic preparing handler.

• IDEN-6: ChannelActivity now retains widgets by peer incarnation, not mutable names. Existing KeyedRows is generic and shared by both row families, rather than copied. ChangedThreads translates names using current model members. ObservedThreadActivity acquires subscriptions at mount/bind. SessionsTabs consumes existing LinkContextChanged. Deleted obsolete row.target access and an unused import. Activity rename asserts the same widget survives.

• Prompt owns edits: one take/clear, no settlement writer, restore only into empty input. Deleted append-to-newer-draft recovery, its forwarder and tests patching our own send/read code. Mounted placeholder derives from agent info.

• ThreadPresentation is nominal throughout read/publication/UI, including Core-owned NoThreadPresentation; no second codec or nullable presentation store.

• Other-route status reads nothing. Exactly one OtherRouteThread declaration across the pinned repositories, in Core. Toad OtherRouteStatusThread binds ThreadStatusModel.other_route. Deleted its false read capability, read/result methods and both callback hooks. RouteSelection.capture and AwaitedRead.require_root are unchanged.

• Deleted the 93-line tests/app/test_foreign_status_read.py, including both rejected read cases, with the impossible capability. Added a mounted other-route/no-worker/no-root-creation case instead of making those reads green. Checkpoint dee358a: 204 deletions /128 additions across seven files, including the delivery-owner repair.

• DeliveryFailureView is an actual Widget capability owning prompt/status/feedback/compose. SendState owns settlement. Deleted sibling assumptions, nullable commit branch and duplicate Prompt accessor. No cast/ignore.

• Core errors.py owns RouteChangedError and reader_sentence. Removed old export consumers and duplicate local imports. Core GitRecord owns both CI metadata readers. Own Git siblings track main except the explicit temporary Core pair; obsolete Core[acp] was removed, PyPI pins preserved.

• Latest main conflicts are resolved: kept main's simplified native helper signatures; kept P401 scope/connection ownership; migrated Conversation to Core's current GoalExecution family and its existing AgentConnection contract. No ThreadGoalExecution compatibility alias or wrong startup-binding annotation remains.

• 4fe7738 fixture cleanup: deleted the process-local profiler and its wrong-process read counter. The retained live/parked test now exercises visible updates and the existing CoordinationAccess subscription lifetime directly, without patching production code. Checkpoint26 additions/41 deletions; focused Ruff clean, production diff zero.

• 1a4e4c5 fixture cleanup: deleted65 lines testing ChannelParticipants, a duplicate active-participants line intentionally removed from main atf59aa13e9. Initial migration of the notification-reader symbol did not fix its wrong-process measurement; x451 retains that actual failure. Checkpoint1 addition/66 deletions across2 test files; focused Ruff clean, production diff zero. Fresh x450 failures are retained, not relabelled as passes.

• a32f8cf fixture cleanup: all eight removed send_initial_cohort call sites now use Messaging.send; Message consumers take SendResult.message. Shared private-route setup uses the declared UserThreadRole, initializes the protocol before registry writes, and serializes ActiveRoute.to_record instead of copying version/field strings. Deleted the old stale-route test that patched removed _trusted_package and used the obsolete ActiveRoute package argument; route/read guards are unchanged, and no real stale-write acceptance is inferred from that deletion. The slow-open display recorder is now a ToadApp subclass using the existing stylesheet owner, not an assignment to app._display. Checkpoint:34 additions/123 deletions across8 test files, focused Ruff clean, production diff zero.

• 3826c78 integration: deleted the helper-created Conversation.agent shadow; migrated remaining absence imports to NoAgentConnection; cold SessionObservation captures its existing AgentConnection family. Deleted the31-line test that patched production methods and asserted the removed helper-only agent field. The slow-open case now uses the real delayed-load peer, not a patch of ThreadNavigationRequest.read; retained one-tab/one-connection/loading/history/editor assertions. Integrated helper root installation, explicit --comms-root capability, typed model/thinking values and existing native-session cleanup rather than a second launcher.

• 16729 /1fbde869a: migrated both stale Conversation.agent reads in tests/native/test_thread_open_during_slow_load.py to the actual agent_binding. Unit-goalblock owns the helper/native.py/native_journey.py changes in P448: qualify goals through the existing managed native workflow #1135; no overlapping helper edit. Focused Ruff and AST checks passed, with zero obsolete conversation.agent readers in this case. Native warm/open execution still needs the compatible Core pair; no goal resume or native pass is claimed.

Executed verification — revision-specific

• x452:1 executed,1 passed/16.92s, Toad4fe7738eb/Core67d309df6, serial isolated App case, runner/wrapper rc0 and clean unchanged heads before/after. Live channel updates paint; parking removes notification interests/views; return resubscribes, shows the parked update and retains the same chat. No process profiler, production patch or native owner involved.

• x451:2 executed,1 passed,1 failed/53.70s, Toad1a4e4c5ee/Core67d309df6, clean before/after. SessionScope sent through the real scripted ACP peer, received its answer, switched to a second session and back, and retained the mounted scope without an error. This is App/ACP-fixture proof, not managed native-owner or installed acceptance. The channel-return test failed its obsolete in-process read-profiler assertion;4fe7738eb removes that measurement and checks actual subscriptions instead.

• x450:2 executed,0 passed,2 failed/15.12s, Toada32f8cf7b/Core67d309df6. Both failed at retired APIs before exercising their App journey. The removed ChannelParticipants test covers deliberately deleted code; no participant behavior is restored or declared accepted by deleting its test.

• x448:2 executed,2 passed/37.94s, Toad3826c782d/Core67d309df6, clean before/after. Covered channel/DM/feed open/send/return, incarnation-keyed activity-row rename retaining its widget, and same-name recreation retiring the old view, opening a distinct view/draft and sending only to the successor. Combined with x446, seven focused App cases passed on this production tree.

• x446:5 executed,5 passed/88.97s, Toad3826c782d/Core67d309df6, serial isolated real-App cases. The renamed-DM case settled its captured read, retained the exact tab/screen/window/fragments/rendered lines and draft across return, then sent to the renamed peer. Other-route status started no worker or alternate root; all three observation-lifetime cases passed. Exact heads/status clean before/after, runner rc0. This is current-head App evidence, not native/installed acceptance.

• x447:2 executed,0 passed,2 failed/36.36s, Toad3826c782d/Core67d309df6, normal per-case isolation. Slow-open failed at the removed send_initial_cohort fixture call; real ACP attachment failed on the absent prepared Node tree in cached source before any native journey. Both roots and the actual ACP log are retained; no sends were replayed. Fixture migration is P401-owned and published ina32f8cf7b; the native workflow needs an owner-built runtime, not a package link into source. These are actual pytest setup failures before the native journeys, not executed native acceptance.

• x445: twelve completed passes, then250-second batch timeout (rc124), Toad9bf099341/Core67d309df6. The24-case target did not complete and there is no final XML; the interrupted private roots are retained. Exact source heads/status were clean and unchanged before/after. A follow-up generic cleanup launch returned UNKNOWN with no log; it was not replayed. Read-only inspection identified three surviving preparation children in the exact private case root, then a separate exact-root cleanup through the existing process owner completed rc0. No old test inputs were replayed.

• x441:24 executed,23 passed,1 failed/152.90s, Toad726c662c3/Core82d. Normal OwnProcessTest isolation was restored: separate interpreter/store per app case, serial -n0, timeout300, faulthandler60. Exact source heads/status were clean and unchanged; child cleanup completed. Activity-row rename, same-name recreation/reopen, model stop-before-delete, scope and other-route/no-worker cases passed. Remaining rename-return case inspected paint before the normal UI frame step.

• x443:3 executed,2 passed,1 failed/42.11s, Toad8878cdc9d/Core82d. The stronger test failed its page-wrapper identity assertion without waiting for the renamed read scope to settle. Source trace: Core DMDisplayIdentity changes requested_peer on rename; WireObservation.apply replaces that reading; PreparedTranscriptPage.for_view intentionally owns an independent range. Page-wrapper identity is not warm-body ownership. The corrected test waits for the renamed read's source_ready and paint, then checks actual fragment and rendered-line identity across return. This corrected behavior has not executed yet.

• x444: collection error, zero executed, Toad43e78f485/Core82d, missing ControlledExecution after current-main integration. Not an app result. Later annotation fixes passed focused Ruff F821/F811/F401/E9; they do not repair the missing Core dependency or establish app acceptance.

• Earlier x440:24 executed,20 passed,4 failed/103.33s, Toad72effea90/Core5e. Its failure evidence is retained, not relabelled as success. All fresh runs preserve failed roots/sent inputs and do not replay them.

Latest receipts: P401-six-{publish,finish-publish,label-binding,hosted,hosted-run,hosted-failure,before-ast,after-ast}., P401-17954-{resources,pr,hosted-failure,layers-publish,affected,layers,dm,final-ast,final-hosted}.. Initial new-test subscription failure and both hosted failures are retained; none is relabelled as a passing run. Aggregate change since4fe7738eb:22 files,159 additions/122 deletions; current source matches77b2b8926 exactly.

Historical receipts: P401-17541-{resources,remote,hosted,hosted-failure,ast,fixtures,fixture-publish,repaired-fixtures,subscription-publish,subscriptions,final-ast}., P401-cohort-publish-final.log, P401-cohort-before-ast., P401-1135-incarnation-checks., P401-1135-warm-checks., P401-1135-native-checks., P401-1135-publish-final.log, P401-67d-paired-checks., P401-67d-lock.log, P401-67d-publish.log, P401-x445-known-orphans.log, P401-row-identity-paired-checks., P401-renamed-tab-frame-checks., P401-settled-rename-checks.*, clean before/after source files, publish logs and P401-current-family-lint/P401-attachment-contract-publish.log under the owned scratch directory. Only the listed head-specific App cases are qualified; complete hosted acceptance, installation and delivery remain open. No local ratchet/full suite or environment sync/build was run.

Source inventory reuses refactor-audit Package/Repository. Beforea4/after726:287 production+292 test modules; Core82d:430 production modules; zero parse omissions. The final main-integration inventory covers287 production+292 test modules at both8878cdc9d and a5bf65c; the new Core0cb owner inventory covers430 production modules, all with zero parse omissions. Receipts: P401-main-integration-ast.txt and P401-new-core-owner-ast.txt. Dynamic aliasing, indirect returns and runtime dispatch still require semantic reading. The helper-integration before/after inventories at9bf099341 and3826c782d each cover287 production+292 test modules, with431 Core67d modules and zero parse omissions (P401-1135-before-ast.txt and P401-1135-after-ast.txt). The final inventory at4fe7738eb covers287 production+290 test+431 Core modules, zero parse omissions, rc0 (P401-17541-final-ast.txt). P401 has no source/test borrow of P417/P434; tests read immutable existing uv source.

Assumed / remaining delivery

• Another route means reopen, never damaged history or permission to read another root. No service/cache/history attachment or weakened route guard.
• P434 owns Core projection, sentence, immutable snapshot reconstruction and incarnation lookup. Its owner supplied compatible head67d309df6; restore the temporary Core dependency to main after coordinated landing.
• Native qualification needs claude-ai's exact-pair hosted install-rehearsal, per commander17431; source checkouts cannot satisfy acquire's runtime-prefix guard. No hand-built runtime, package symlink/copy into source, env override, build/install or guard change has been performed. P401 keeps the UI/native verification context; it does not build a parallel runtime. Worker checks reuse existing dependencies. The merger owes fresh paired installation/rehearsal and the configured saved-session/native journey: fresh copied-agent DM/reply with its tab open, surviving turn/tab return, other-route row and rename/recreation/reopen. Preserve original sessions and UNKNOWN inputs.
• P407 uses that same installed journey: with merged Textual#181 and Toad#1115 installed, open an existing saved session, assert query_ancestor(SessionScope) is its actual mounted SessionView and no error notice appears. Record build/session evidence and send it to unit-hygiene. Source tests do not substitute for installed acceptance.
• Toad ready/merge remains commander-owned;16111 explicitly requires manual merge, not --auto. A PR link is not a delivery claim. Record delivery in Core only after the requested behavior qualifies.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.