[trissim]

Committed sends retain their exact sent record when completion fails. Saved transcript pages replace the live output they cover in one synchronous admission, so a late answer is drawn once. Direct-message tabs retain the original thread birth through rename and refuse a same-name successor.

ConversationKind now owns a retained typed destination. DmConversation supplies Core's IncarnationThreadTarget; Toad passes that object through send, page and revision requests until Core captures its registry state. Labels, status, unread counts and navigation resolve current names through CurrentDisplayReferences. Draft scopes and channel activity rows retain birth identity. Delete the foreign-root status worker and its callback; the existing other-route status explains an unobserved root without opening its stores. These consumers require the paired Core exact-target APIs.

Generic LineHistory owns paging without a native view. ConversationHistory owns the actual bound view and propagates its type. CommittedHistory now inherits the pager whose state, pages and coverage it uses; delete the old mixin from committed_presentation. Native TranscriptHistory owns live-page retirement, and projected history delegates to its existing owner. HistoricalSessions mounts the generic pager. Filtered continues its existing scan when the first projected page is empty but older source remains.

Service acquisition, route preflight and the real write guard now share one refusal boundary. A known pre-write refusal restores the draft and editable compose. Cancellation of an active worker remains UNKNOWN and blocked; committed failures retain the exact sent record. Delete the forwarding send method and the empty transcript bind context manager, migrating every consumer to the existing service owner.

Observer death enters FailedObservation before Toad displays the error. Only graceful stopping requests StopObserving and retains AnsweringReads for acquired reads; failure cleanup does not send requests to a dead process. The handler catches the declared ObserverDied. Shutdown also completes subscription release, joins the resulting retirements and runs cleanup when StopObserving itself discovers a dead process; the original failure is preserved. Native lifecycle callbacks share the async unmount contract. ToadNode declares the activity/status widgets' existing app dependency. The optional tone input is paint_text_style, leaving Textual's computed text_style with its native owner. Input coverage carries the original InputStartedUpdate instead of another optional bare ID.

Migrate fixtures to installed_wire, current route errors, typed session files and current bus revisions. Archive reads use the real observation process and verify immutable snapshots. Cancellation targets the task actually rendering the replacement. Delete the nonexistent ChannelParticipants fixture and obsolete candidate-drain calls from #1136. The overlay guard derives permitted fields and operations from its null member's declarations.

Validation:

• Final d498405 with combined Core 1d1046504: six real-app checks passed in 49.20s. These cover stale-view refusal, a route change during service acquisition, a route change at actual worker dispatch, observer death during shutdown, shared service identity and refusal to rebind it. The route controls leave Messaging.send_user_message and run_selected_write untouched; they compare real bus revisions and verify the editable restored draft. The shutdown control kills the actual observer before its death callback and confirms error propagation plus pipe/process/subscription cleanup.
• Nine positive controls passed in 80.83s on Core 77bd95b46: UNKNOWN cancellation without replay, committed sends and failed completion, default-route/fresh-launch behavior, acquired reads and application close. The shared-reader checks then passed separately after fixing the fixture's obsolete service accessor.
• Final incremental production ratchet, 75bad63..d498405 on Core 1d1046504: exit 0, no positive deltas, introduced findings or introduced lines. This covers this repair interval only.
• 27 affected checks passed in151.05s on Core7251da840:9 copied identity checks; retained DM rename/recreation and sends; filters; all3 late-answer arrivals and outgoing ToolCall retirement;7 publication-fencing checks; acquired-read shutdown; other-route status without a read.
• Final parameter/overlay guard batch:5 passed in15.54s. The other18 focused guard checks passed in the preceding batch; its one method-only overlay guard failure was corrected by deriving declared field reads.
• On Core8090ace07, the final source journey passed2 checks in24.16s: actual channel/DM/feed sends, retained tab returns and member rename; real PTY mounted error, channel mouse-open, draft entry and clean quit. This was on2bc5aacc2. The final75bad6355 changes only the wire view's lazy nominal bound and passes the application import.
• Earlier real PTY observer SIGKILL and injected close failure checks passed: the first reports its error and quits cleanly; the second saves the failure, exits1 and leaves no children. Pager/archive/hidden-session family passed13 checks in96.04s.
• Exact75bad6355 incremental production ratchet againstea0a6e65c passes with no increases or introduced findings on Core8090ace07. This is the latest consumer interval, not a claim about a full-suite run or every earlier PR commit.

NRA source inventories covered285 current Toad production modules,291 current test modules,452 Core modules and255 Textual modules without parse omissions. The final send/close repair additionally inventoried 285 production modules, 291 test modules and 454 Core modules without parse omissions. Before/after declarations, writes, inheritance and consumers are retained in toad-send-owner-evidence.txt, toad-conversation-identity-owner-evidence.txt, toad-history-binding-owner-evidence.txt, toad-bootstrap-consumer-evidence.txt and toad-observer-failure-owner-evidence.txt. Behavioral logs use the toad-retained-birth-and-pager-final, toad-final-core-source-journey and toad-nominal-birth-final-ratchet prefixes under the retained agent-scratch directory. AST establishes source relationships; the application checks confirm the affected behavior.

Remaining delivery: integration merges the paired changes and installs the exact pins; this Toad owner then completes the installed native fork/fresh-DM/reply/tab-return journey. Three older unqualified core_adapters edits remain excluded. The independent #1115 SessionScope refactor remains on its original branch.

[trissim]

Reviewed the six-file checkpoint through d433dbc. The fixture migrations use current AgentProcess/turn owners; direct callback coverage is correctly distinguished from ACP wire decoding. Source trace confirms canceled service-read waiters leave preparation work accepted: that worker can call CoordinationAccess.require. The existing release stack now drains navigation and PreparedRenderer/PreparationRuntime before closing CoordinationAccess, preserving the dependency instead of adding a second shutdown mechanism. The regression exercises that actual service-read path and checks the same process/service plus final process exit. This accepts this source checkpoint; the paired committed-send port and combined installed qualification remain outstanding. The earlier intermittent interpreter hang remains unresolved.

[trissim]

Reviewed the paired-send port and page-call repair through this head. Both page edges now use Core's current PageBounds and the initial upper bound is a nominal LiveCursor; the obsolete byte-budget field is deleted. CommittedMessageError retains the exact message through SentUndrawn, pre-write refusal restores editable input, and canceled writes remain blocked rather than retried. SentUndrawn carries Path and Message. Existing prompt ownership preserves an unrelated unsent draft.

Read the retained results for 12 distinct relevant checks across focused batches on virtual-bus Core8509: real child/root and process-group retirement; observer drain/unmount/turn publication; mounted refusal, interrupted write, committed write, failure after commit, retained running root and fresh-root startup. Earlier failures remain in the logs and are superseded by the named later checks, rather than being counted as passes. The original first-paint failure is resolved by the page API repair.

Source accepted for the paired integration checkpoint. Fresh production bootstrap remains with Core's coordinator owner. Final paired installed native/fork/fresh-message qualification remains open; this review does not claim that installation or explain the separate historical interpreter hang.

[trissim]

Read the retained-birth send/page/revision consumers, pager/native binding split, observer failure state and final d498 follow-through. Both concrete review failures are repaired: a real worker route refusal restores the editable draft, and a failed StopObserving request cannot skip subscription/process cleanup. UNKNOWN cancellation remains blocked and a committed failure retains the actual sent record. The yield-only bind wrapper and every caller are deleted. Six actual route/shutdown/shared-service controls passed against the exact combined Core1d1046504; these controls keep our sender/write guard unchanged. The independent source reviewer also cleared both findings. Current hosted debt findings still require their separate source judgment against the paired Core; they are not described as green. Root integration owns the installed native journey, and this review does not claim the new pair is installed.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.