Integrate current dev while preserving the mission routes, durable execution controls and specialist cleanup. Retain native usage route dependencies and align local plugin dependencies and architecture guidance with OpenCode 2.0.21.
Combine the workspace file reader with the mission reader in the central session surface. Explicit reader selection dismisses the competing preview without losing stored editor drafts or the composer. Extend the real-session browser regression to cover switching between both readers.
Validate server and UI typechecks and all ten mission browser/i18n tests. Preserve the upstream Tao patch unchanged, including its original whitespace and provenance.
Backport the exact read-only macOS maximize getter from Tao #1182 into the existing 0.34.6 vendor override, preserving the Windows input backport. The original borderless getter changed AppKit style masks and generated geometry events whose persistence capture called the getter again, starving startup independently of OpenCode readiness. Window chrome, persistence policy and shared OpenCode lifecycle remain unchanged.
Add a bounded native AppKit regression with isolated original-crate negative-control artifacts, repeated warm-cache runs, getter-phase capture evidence, maximize/restore and fixed-size/decorated cases. Reject unrelated watchdog timeouts and validate runner results with platform-independent tests. Run the native regression in macOS ARM64 CI.
Validation includes the macOS Intel VM reproduction and rebuilt Tauri startup, second-window quit/relaunch with isolated OpenCode 2.0.21, 181 macOS and 188 Windows Tauri tests, Windows input negative controls, 44 targeted Electron regressions, successful ARM64 CI tests and a published ARM64 test artifact. Both independent gatekeeper findings were fixed and re-reviewed to zero findings. All test jobs passed; remaining platform builds were still running at the explicitly requested admin merge.
Fixes#819.
Flatten Mission Control into compact top-level rows with two-line objectives, semantic state colors, direct readers and coordinator navigation. Put Work first, collapse secondary sections by default, and retain per-window reader and disclosure state.
Create UI missions in a prepared state and use one Play button for start/resume alongside Pause and terminal Stop. Persist explicit control intents and per-target receipts, serialize them with mission admissions, and use the authenticated desktop bridge for native root-session interruption and environment-fenced resumption. Park report notifications while paused, cancel mission-owned queued inputs on Stop, and prevent stale retries from reopening terminal missions. Native descendant suspension remains outside these root-actor controls.
Add opt-in deletion of mission-created specialist conversations. Persist cleanup targets and receipts, reserve journal capacity, and validate ownership through a narrow cleanup authority RPC before native HTTP removal. Preserve coordinators, reused/shared/moved sessions and roots with children; partial failures keep stable explicit retry identities.
Validate with 88 focused server tests, 10 browser/i18n tests, server and UI typechecks, the full build and an isolated OpenCode 2.0.21 fixture covering Play/Pause/Resume/terminal Stop, cleanup and transcript preservation. Inspect rendered controls and document the lifecycle, cleanup and styling conventions.
## Summary
Unify the right-panel Git and file surfaces as **Files**, with a compact
**Workspace / Changes / Commits** switch and a shared central preview
above the
conversation composer.
- Workspace: lazy, keyboard-accessible directory tree; read-only source,
Markdown and image previews; bounded binary-file fallback.
- Changes: indexed/working-tree files and central diffs, with existing
Git
mutations kept in a collapsed actions section.
- Commits: paginated history of the browsed worktree, commit
details/files and
first-parent diffs, including root commits, renames, deletions and
gitlinks.
- Preserve drafts and mode navigation; fence late responses across
session and
worktree changes. Migrate previous tab customization and retain
diff/wrap
preferences. Bundle Monaco tokenizers locally for offline highlighting.
- Worktree browsing does not move a conversation or check out a branch.
## Implementation
The common Solid UI is used by Electron and Tauri. New file previews
reuse the
directory ownership boundary and bounded filesystem reader. Historical
reads use
worker Git commands with full-hash validation, authoritative file
membership,
bounded command output/time and snapshot-based paging. The old sidebar
editor
and split viewer are retired. See `dev-docs/FILES_PANEL.md`.
## Validation
Before rebasing onto current dev:
- Server, UI and Electron typechecks passed.
- Server/UI and Electron builds passed.
- 20 focused unit/route tests passed, including real isolated root and
linked
repositories, preview bounds and directory ownership.
- 12 distinct browser scenarios passed: 5 Files flows (including real
SessionView/composer, Markdown/images/source and RTL keyboard
navigation) and
7 existing Git lifecycle regressions.
Post-rebase validation, independent gatekeeper reviews and the Windows
Tauri
test build will be recorded below as they complete. This PR is intended
for
interactive validation before merge.
## Summary
I replaced Codex Usage's legacy auth-file reads with the connected
OpenCode V2 daemon's selected ChatGPT OAuth credential. This addresses
the stale-file mismatch described in #808 without guessing WSL
credential paths or substituting another account.
- Resolve the provider integration in the owned session's native
location; use only its selected active credential and native accountID.
- Keep credentials server-only, OAuth refresh native-owned, and
credential export/generic RPC blocked through the browser proxy.
- Fence warm and pending quota results on account changes, reconnects
and session movement; scope the visible panel to its instance/session.
- Bound quota HTTP, reject redirects and sanitize errors. No SQLite
access or legacy/Codex CLI fallback.
The credential-list API requires OpenCode 2.0.20 for this feature only.
Older runtimes, expired native tokens and non-ChatGPT connections fail
closed; the global application minimum is unchanged. Other providers'
credential integrations are outside this focused fix.
## Validation
- Server/UI typechecks; 85 server tests; five UI unit tests; three
rendered browser scenarios; UI build and diff checks passed.
- A fresh native 2.0.20 Windows daemon with synthetic credentials
exercises the production adapter: selected OAuth/accountID, key-account
switch invalidating a warm snapshot, and recovery despite stale
auth.json. Quota HTTP is mocked; no shared daemon or real credentials
are used.
- This fixes the confirmed integration mismatch, but I have not
reproduced the author's real WSL/live account failure.
Closes#808.
Maintenance: existing `packages/server/src/server/http-server.ts`
(~2,317 lines) and `packages/ui/src/lib/api-client.ts` (~613 lines)
exceed the source-size guideline; their wiring changes remain small.
Keep connected MCP status dots green without a permanent pulse. Pending connect/disconnect operations retain their warning pulse and spinner; the shared reduced-motion and metadata refresh policies are unchanged.
Add real StatusTab/SUID browser regressions at 150% scale, a bounded historical/current Chromium profiler, and measurement-limit documentation. Five browser scenarios, UI typecheck/build and repeatable profiler assertions passed. Fix the gatekeeper P2 by creating the temporary evidence parent on clean machines; the second independent review reported zero findings.
The change addresses the idle-animation source in #804, not its unconfirmed generation GPU symptom or #805. Remote CI was pending at the explicitly requested admin merge.
Align server/UI client and bundled plugin pins with OpenCode 2.0.19 while retaining the demonstrated 2.0.7 timestamp minimum. The authenticated native schema and published declarations preserve the consumed API contract; runtime improvements concern compaction, context limits, provider cache affinity and Shell conventions.
Extend setup version coverage and update the maintained compatibility and architecture references. Add per-import native/UI fixture diagnostics after late Vite loading stopped on both the new runtime and the 2.0.18 control; do not claim that eager-import diagnostic acceptance fixes that failure.
Qualify both minimum/current native runtimes, historical migrations, isolated npm upgrade without daemon restart, standalone plugin installation, UI/browser behavior and production bundles. Retain the original Windows fixture failures and their bounded diagnostic results in the PR evidence.
## Summary
Fix the main-process `TypeError: Object has been destroyed` dialog
observed when
closing the Windows Electron 0.20.0 build.
The local window's `closed` handler accessed `window.webContents` after
the native
BrowserWindow was destroyed. The exception surfaced while
`MultiwindowLifecycle.exit()` called `app.exit(0)`.
BrowserController now captures the owner WebContents while the window is
alive
and observes `closed` using that retained identity. Browser target
registrations
and pending-open claims are cleaned up after the registry's existing
removal
handler, without invoking getters on the destroyed BrowserWindow.
This is an Electron native-object lifetime correction; shared shutdown
semantics
and Tauri behavior remain equivalent.
## Validation
- Electron TypeScript check passed.
- 15 browser-controller regressions passed, including a
native-getter-throwing
window fixture that verifies registration cleanup still occurs.
- 16 multiwindow lifecycle regressions passed.
- `node scripts/test-electron-owner-close.mjs` passed on Windows with
real
Electron 39.0.0 windows: forced destroy, ordinary close and final
lifecycle
exit. It also asserts that the former getter really throws after
`closed`.
- Native fixture uses its own temporary profile and no
CodeNomad/OpenCode backend.
Separate from the installation-progress UI PR. This fix is not yet
included in
the already-published 0.20.0 replacement archives.
File-size note: the existing Electron `main.ts` entry point is
approximately
625 lines; the change replaces one cleanup call with owner observation.
Integrate dev into the Missions PR without rewriting its reviewed history. Retain mission CRUD routes, authenticated report admission and the 512 KiB bridge limit alongside inspected-window automation and plugin controls. Keep dev's canonical transport, clean builds and 2.0.18 client/plugin dependencies; align the local plugin contract check with the same SDK.
Combine architecture guidance and preserve the technical runtime minimum of 2.0.7. Keep the isolated Missions fixture in the latest-runtime CI lane because its test-only ctx.tool.list driver is absent at that minimum; do not reintroduce legacy compatibility paths.
Validation: server, UI and plugin-contract typechecks; full server/UI/plugin build; 84 backend/compatibility/packaging tests; 59 UI/persistence/browser tests; isolated OpenCode 2.0.18 Missions fixture and workflow YAML parsing. Merge resolutions have no conflict markers or diff-check errors relative to dev.
Declare expected mutation rejections in the native RPC contract and return them through the invocation error API. Map structured business codes to conflict, missing and ownership responses so stale editors can request a reload instead of reporting an unavailable plugin. Unexpected exceptions remain opaque 503 failures.
Extend the isolated OpenCode fixture through the real WorkspaceManager and HTTP routes to verify stale update/delete, create/update/delete request-ID conflicts and unknown missions. Observed native 503 before the fix and 409/404 after it; targeted route/plugin/reload tests and server typecheck pass.
Recover durable report notifications that were saved before a bridge outage prevented coordinator admission. Reuse native message identities, honor journal acknowledgements and lifecycle fences, and retry only notifications through the authenticated environment-aware bridge. Nonblocking single-flight retries use bounded backoff and rotating batches without dispatching tasks.
Show pending coordinator notification separately from task completion in Mission Control, with all locales aligned. Derive managed actors from immutable task identities, resolve Pocock implementers through live task ancestry, and normalize dependencies for both new and historical idempotent requests.
Validated 53 backend regressions, server and UI typechecks, UI and plugin builds, six real-component browser scenarios, locale parity, and an isolated OpenCode 2.0.18 fixture proving idle/busy resumption and automatic outage recovery with and without restart. Native replay retains one correlated report without another coordinator wakeup.
Share project mutation and append queues across content-addressed plugin incarnations so disposal cannot let competing revision checks overwrite history. Keep in-flight operations exclusive until settlement.
Raise assembled bridge text bounds to accommodate maximum XML-escaped objective and task fields within the existing HTTP body bound. Exercise real authenticated HTTP admission with XML, JSON-control and multibyte expansion.
Observe both regressions failing before their fixes, then passing with the focused bridge suite and server typecheck. The isolated OpenCode 2.0.18 fixture now proves reports reach an actual provider request for idle and busy coordinators instead of treating session idle as proof of consumption.
Make Mission Control actionable with create/edit/delete, persistent disclosures and selection, task dependencies, native attention requests, execution comparisons and a long-content reader above the mounted transcript. Preserve drafts and native per-window layout, and arbitrate browser/reader gestures without losing the preview target.
Add coordinator-only mission.revise with revision CAS, idempotent replay, linked replacements and explicit dependency changes. Retain withdrawn task contracts and late reports, require terminal settlement for outstanding native admissions, and attribute human metadata edits in the bounded history. Mission deletion tombstones the map without deleting conversations.
Cover lifecycle and revision semantics with backend regressions and the isolated OpenCode 2.0.18 fixture, including the repaired authenticated late-report notification. Validate real Solid UI restoration, editor retry identity, native background Forms, transcript/draft preservation, layout cleanup and ten-locale parity. Record Kandev research, scope decisions and separate follow-up opportunities.
Provision codenomad.missions through connected-daemon discovery and independent backend presence instead of requiring a source plugin in every project. Bundle the integration for Electron and Tauri, retain project-scoped mission journals across shutdown, and use the same secondary surface as Status.
Complete the existing native actor execution work: persist explicit agent/model/variant choices, validate catalog selections and avoid switching busy actors. Admit assignment and report writes through the authenticated desktop bridge with durable-contract verification, session ownership, connection and worktree fences, and per-send profile environment synchronization.
Advance the older source branch client/plugin pin to 2.0.11 and retain its bounded runtime metadata adaptation. The isolated 2.0.16 mission fixture passes native catalog, selection, busy queues, conflict, environment, reports, reconnect and idempotence checks. Server, UI and plugin typechecks, 31 mission tests, 10 lifecycle/transport tests and six resource-layout tests pass.
Align server/UI client and bundled plugin pins with the latest stable runtime while preserving the demonstrated 2.0.7 timestamp minimum. Review the published declarations and authenticated native schema: pairing and Shell signal additions require no CodeNomad API adaptation.
Make the isolated native upgrade fixture follow the recommendation while retaining its 2.0.15 source boundary and live-daemon PID assertion. Extend setup version coverage and update the current compatibility and architecture references.
Validate both minimum/current native runtimes, historical migrations, server/UI tests, setup and tool-image browser scenarios, typechecks and production bundles. Record the intermittent Windows Node pruning/UI heap exit and successful diagnostic rerun without claiming its cause is fixed.
Display HTML and JSX tags literally in user messages, pasted-text disclosures and user timeline previews while keeping existing assistant HTML rendering. Preserve stored prompt text, Markdown formatting and code entity spellings, and isolate literal render requests and caches from older sanitized HTML entries.
Escape both HTML tokens and Marked raw-region text tokens so malformed source remains visible text. The first independent gatekeeper pass identified the raw-region bypass; it was corrected and covered by unit/browser regressions. The second independent pass found zero findings after additional raw-region variant checks.
Fifteen Markdown tests, two focused browser scenarios, the existing held-tool-scroller regression, UI typecheck/build and an isolated historical-source renderer comparison passed. The tested assistant HTML DOM matches v0.19.0; user rendering intentionally differs because v0.19.0 also interpreted user tags. Remote CI was still in progress at the explicitly requested admin merge.
Use one Attach file action for native device selection and retain project-scoped @ references in the active session worktree. Remove the duplicate upload entry and composer server browser, document the outside-project scope change, and translate attachment origins and feedback across all locales.
Share serialized, bounded byte ingestion across picker, drop and clipboard. Fence open pickers and late reads across session/worktree/lifecycle changes, preserve edits and newer selections without stealing focus, release rejected-read budgets, and restore failed custom-command drafts by attachment identity. Validate project directories through existing workspace ownership before filesystem listing/search.
Cover the behavior with 20 attachment and 11 session-aside browser scenarios, attachment/submission/persistence units, server budget/proxy/ownership regressions, and isolated native Windows picker fixtures. Three independent review passes corrected five P2 findings and ended at zero; the final merged-head review confirmed that result. UI checks/build, Tauri release build and native picker smoke passed. Remote CI was still in progress at the explicitly requested admin merge.
Match OpenCode's TUI by interrupting only the selected session with resume:true. The previous Stop/double-Escape action interrupted active descendants in parallel; a background child's completion notification could wake the parent after its interruption had already settled, producing new model activity after Stop.
Keep background children independently owned and directly interruptible when selected. Native control/steering input retains TUI resume semantics rather than introducing a separate CodeNomad cancellation policy.
Cover selected parent/child scope in store tests and both gestures through real Chromium composer and keyboard handlers using the generated native client. Include an isolated native fixture with a temporary HOME/database, private server and loopback provider that reproduces the cascade restart and verifies selected-session interruption. UI typecheck, production build and both browser regressions passed on the reviewed branch; full-CI failure triage is documented in the PR.
Backport upstream tao#1215 unchanged onto Tao 0.34.6 to correct the same-thread native input mutex deadlock identified in a symbolized Windows hang dump. Preserve the existing Tauri dependency/API line, all non-Windows sources, licensing and exact published-crate/patch provenance through a workspace Cargo override.
Add real isolated Win32 reentry regressions for keydown, keyup, character, system-character and IME input. Original-crate controls reproduce bounded deadlocks; the backport passes all five cases. Independently cover the IME lock boundary with temporary-source instrumentation and require an IME-only lock-order mutation to fail, preventing keyboard pre-peeking from masking an IME regression.
Independent gatekeeper pass 1 identified the IME coverage gap; pass 2 on 462f9eac reports zero actionable findings and independently reran all controls. Full local Tauri tests passed 181/181. Administrator squash merge requested by the user; remaining CI jobs were still running at merge.
Delegate verified shared npm updates from OpenCode 2.0.15 onward to the native CLI with bundled Node/npm, a scoped prefix and registry, and Windows running-image retention. Preserve first-install and older-migration preflight, version/launcher verification and explicit daemon activation.
Retain installation ownership and the temporary adapter if an outer timeout, signal or output limit leaves descendant exit uncertain. Allow native timeout cleanup to finish and preserve original failures.
Validated with 37 targeted updater/route regressions, server typecheck, isolated live Windows 2.0.15-to-2.0.16 qualification, and a successful NSIS build/install of the initial implementation. Independent gatekeeper review found one timeout issue; the second pass after correction reported zero findings. Administrator merge explicitly requested by the user; final-head remote CI is still running.
## Summary
Retire the prerelease private OpenCode installation completely as an
executable source. Automatic selection now uses PATH and the
conventional shared user npm installation. Existing private files are
neither migrated nor deleted.
- Remove the private installer, receipt reader and fallback
introduced/retained by #756.
- Ignore saved private selections and reject validation/launch from
`~/.local/share/codenomad/opencode`, including private PATH entries.
Prevent installation into that retired prefix.
- Remove private-copy descriptions from all ten locales and update the
runtime policy documentation.
- Keep supported custom installations, native shared-service
ownership/authentication and explicit restart behavior.
## Reproduction and scope
The initial genuinely empty-profile test passed, but it did not match
the affected machine: that machine had no Git and retained a private
prerelease OpenCode copy.
On the exact installed `v0.20.0-dev-20260923-baf674fc` Tauri artifact,
seeding a valid private copy plus its `selected` receipt and `current`
marker makes setup report `state: ready`, `installationSource: legacy`,
and suppresses the missing-installation screen. The new desktop
regression fails against that release with `ready !== missing`.
With rebuilt server/UI resources in an isolated copy of the same Tauri
host, the identical private-copy scenario reports missing, offers
installation, installs the shared npm package, authenticates OpenCode
2.0.15 and resumes the requested folder without Git. This demonstrates
the missing-setup cause; it does not claim to explain every initially
reported startup slowdown.
## Validation
- 59 targeted server tests passed: discovery/install/update, retired
paths, binary selection, Windows/WSL spawn and binary validation routes.
- 13 real-component setup browser tests passed.
- 23 focused retirement/launch tests passed after the final network-path
preflight adjustment.
- UI TypeScript check passed; production server/UI/automation/pruning
build passed.
- Installed-release private-copy reproduction failed as expected;
corrected isolated Tauri acceptance passed.
- `git diff --check` passed.
Desktop qualification uses isolated profiles, services and databases.
The sole simulated installation side effect is HKCU PATH registration,
captured by a fixture preload; bundled npm installation, package
verification, native-parent service start and authenticated API checks
are real. The shared user daemon and installed application were not
replaced by the fix. Remote CI is pending.
## Maintenance notes
Existing oversized files touched: `packages/server/src/api-types.ts`
(~583 lines) and `packages/ui/src/lib/i18n/messages/*/settings.ts`
(~625–639 lines). No size-only refactor is included.
Prefer terminal PATH and a common user npm installation, migrate historical private and official npm copies, and retain explicit authority for custom and WSL executables. Preserve running daemon ownership and defer locked Windows updates. Align recovery and settings presentation across locales.\n\nReviewed through an independent gatekeeper loop (final zero-finding review on e33a6a16). Validated 34 targeted server tests, 13 browser scenarios, typechecks, isolated Windows npm installation and real historical migrations. Full CI browser job has unrelated existing system-message search failures reproduced locally; merge requested with administrator authority without waiting for CI.
## Summary
Follow-up to #750: Git is a prerequisite for full CodeNomad
functionality, but its absence must not prevent users from consulting
their agent and asking it to help with installation.
- Keep workspace startup and ordinary conversations available without
host Git. Only the explicitly opened physical directory authorizes
sessions in this mode; do not infer sibling worktrees from native
project IDs.
- Preserve Git/worktree operation requirements and return an actionable
`git_required` failure for those operations.
- Inform the agent via the owned native `codenomad.git-availability`
instruction before prompts/custom commands. Include the backend platform
and distinguish the backend account from WSL/remote agent execution.
Remove the entry once Git is available, while preserving other
instruction keys. There is no Git setup UI or installation gate.
- Keep deletion admission safe across Git availability transitions by
draining/blocking overlapping ancestor and descendant directory
identities.
- Narrow initial project-wide session lists to the opened directory in
degraded mode; reject existing project-scoped cursors rather than
reinterpreting their native pagination scope.
- Teach the UI session inventory to request exact-directory pagination
for degraded roots while retaining unknown repository membership. Owned
children with inaccessible parents remain local display roots,
preserving their native parent metadata; worktree selection is
unavailable until Git recovers.
- Bound advisory context synchronization independently from fail-closed
profile-environment synchronization. An advisory timeout does not replay
or prevent the original send; disconnect and runtime-generation fencing
still apply.
## Validation
- Targeted server regressions cover real workspace-manager/proxy
admission without Git, foreign/child/alias directories, initial lists
and native cursor scope, worktree operations, deletion fencing,
environment admission and advisory timeout.
- Existing workspace lifecycle, inventory, native Git-worktree identity,
directory-authorization and worktree-deletion route suites pass.
- Real isolated OpenCode **2.0.7 and 2.0.15** fixtures: Git absent from
both backend and daemon PATH; project open, session creation,
instruction synchronization, prompt admission, model request containing
degraded context, assistant reply, and removal of stale instruction
after backend PATH recovery. Private databases and a local synthetic
provider only.
- Server/UI TypeScript checks and production server/UI/plugin builds
pass. Generated-client prefix regression also passes (bounded Node test
runner for its retained UI handles).
- Added no-Git unit/native qualification to the existing
Linux/Windows/macOS compatibility workflow. Local native runs were on
Windows; cross-platform CI outcomes are reported separately.
- Final UI coverage: 88 store/tree/startup/authority tests, 13
worktree-browser tests, and 43 transcript/session-rendering browser
tests pass.
The earlier #751 instruction-proxy correction remains necessary and is
covered by its existing regression tests. This change addresses the
separate missing-Git admission failure.
Validation includes isolated minimum/current native suites, historical migrations on Linux/Windows/macOS, targeted unit and browser tests, production builds and two independent gatekeeper reviews with zero actionable findings. Retain startup diagnostics for an unexplained intermittent Windows pruning/UI process exit; the complete instrumented Node 24.20.0 rerun passes locally. Known system-message search fixture timeouts remain documented. Admin merge explicitly requested; runtime activation and desktop installation remain separate actions.
Replace timestamp-based automatic deletion with fresh native content checks and local activity, draft, attachment and connection fences. Preserve sessions with queued input or children, fail closed on uncertain reads, and refresh the message proof before deletion. Keep explicit deep-clean semantics separate and count only successful deletions.
Run automatic cleanup in a coalesced background sweep so historical reads never block new-session activation or the first prompt. Add 40 cleanup regressions and an isolated native fixture wired into minimum/latest runtime CI.
The baseline fixture reproduces native conversation loss; fixed behavior passes on OpenCode 2.0.7 and 2.0.14. All 157 targeted tests and UI/Electron typechecks pass locally. Two independent gatekeeper rounds concluded with zero findings after correcting creation-path latency. Full GitHub Actions CI was still pending at the authorized administrator merge.
Follow up #737 with a shared focused-or-MRU menu snapshot, UI-thread refresh serialization, lock-free native calls, popup-tracking deferral and atomic admission before native getters. Preserve remote/Preferences isolation and trailing state publication after native tracking. Iterative independent gatekeeper review reached ZERO FINDINGS after fixes; isolated real Windows popup/focus/concurrent-request and mouse-selection acceptance passes, alongside Rust and Electron/UI regressions. Administrator merge requested by the user. CI is not fully green: final checks pending, baseline migration/system-search failures and an unexplained initial Windows pruning UI exit are documented in the PR gatekeeper report.
Reserve /btw in the composer and autocomplete, using session.generate to answer from the current native context in a non-modal Markdown window. Bare /btw opens the question form; answers can be copied or retried without adding transcript, inbox or child-session records.
Keep side-request cancellation independent of the main execution, fence late results on cancellation, replacement, session changes and disposal, and preserve unsent file/image attachments. Authorize only the reviewed session-scoped generation route through existing ownership and worktree-deletion checks. Add all ten locales and shared square window styling.
Cover routing, Markdown, attachments, concurrent main prompts, cancellation races and narrow layouts with ten browser scenarios, plus proxy regressions. Verify native idle and busy behavior with isolated local-provider fixtures on OpenCode 2.0.7, 2.0.11 and 2.0.12; include the fixture in minimum/latest CI. UI/server typechecks, twelve adjacent unit tests and diff checks pass.
Integrate dev at 306c2ba4, including full-history search, cached global timeline navigation and README updates. Preserve the new RPC/client methods alongside managed setup, explicit restart/reload and the technically justified OpenCode 2.0.7 minimum.
Correct the incoming standalone plugin manifest to include navigation-scope, outline-index and outline-preview. Both the existing packed-entrypoint regression and independent gatekeeper review identified the omitted dependencies; the corrected package resolves outside the source checkout.
Validate 643 server tests (2 skipped), 154 UI store/reducer tests, 29 browser scenarios and both typechecks. The rebuilt bundled plugin passes the complete isolated native 2.0.7 suite with rendered UI, including 241-message history cleanup and 1501-message global navigation/restore parity. Record pre-merge evidence in the compatibility register.
Integrate the current dev baseline while retaining PR 723's server-backed full-history search and direct navigation. Resolve the sole message-section conflict by keeping the bounded history query flow instead of reinstating the superseded resident-page traversal and resident-result reconciliation.
Preserve dev's system-message visibility and untracked search locator changes. Validate UI and server typechecks against the updated locked dependencies, plus browser regressions for restored checkpoint reconciliation and current-session search navigation.
Replace the arbitrary 2.0.11 floor with the 2.0.7 native step-timestamp boundary, keeping 2.0.11 as the separately recommended qualification target. Unlisted, prerelease and custom runtimes negotiate authenticated API requirements; preserve complete CLI labels so unknown builds neither fail solely by name nor enable unintended automatic upgrades.
Finish retiring pre-2.0.4 location/worktree/credential/Form serialization and obsolete catalog events while preserving internal identity, import/cursor authorization, pruning claims and connection fences. Remove the unused global package-manager installer and clean generated server output before packaging so deleted modules cannot survive incremental builds.
Distinguish missing setup, technical incompatibility and optional updates in the shared UI, including minimum rationale and optional restart wording. Retain a usable daemon through older discovery CLIs, check reload capability independently, and suppress installation when bundled npm is unavailable.
Validated 622 server tests, 7 browser scenarios, real reducers and fixture guards, production native suites on 2.0.7 and 2.0.10, and synthetic 2.0.3-to-2.0.7 history migration. Independent gatekeeper re-review closed the production version-parser finding. CI now qualifies the source-defined minimum and latest; rebuilt desktop acceptance is recorded separately.
Restore provisional timeline geometry through optional content-addressed index chunks, bounded independently from drafts and attachments. Validate durable session/location/project/revert identity, preserve other restored state when an index chunk is missing, and reuse immutable normalized values and encoded leaves during scroll or draft captures. Fence older renderers with a graph extension and retain monolithic-host compatibility.
Revalidate native structural indexes using stable checkpoint ranges and return only changed structure. Grow the live tail before adding ranges, reserve a complete block within each RPC page budget, and schedule a trailing scan when messages arrive during a fixed-horizon read. Route bulk-cleanup completion and ambiguous failure through the shared coalesced refresh path so the final invalidation cannot strand an obsolete native transcript window.
Cover large partition round trips, corruption isolation, restoration clear/disable, offline edits/pruning/deletions/appends, manifest growth, deletion-hole pagination, active-window refresh races and Solid trailing scans. All 21 Chromium navigation cases, package typechecks, packaged-resource smoke, Electron state tests and isolated OpenCode 2.0.5 integration pass. The second independent whole-PR gatekeeper review reports zero actionable findings; installed-app restart verification remains pending and is documented explicitly.
Build rail geometry from a structural native index of IDs, sequence, types and technical-part counts. Project that metadata in SQLite without transporting or parsing full message bodies in JS. Bounded 16384-entry pages replace 256-entry excerpt scans, and indexing runs independently of transcript hydration. Remove the excerpt-loading countdown.
Retain up to sixteen structural snapshots with a 200000-entry LRU budget, allowing one larger active index. Unchanged session returns reuse the index without a read; message changes refresh only the last 32 indexed rows and arrivals. Preserve destructive-mutation, undo, connection-generation and route ownership fences.
Restore bounded Markdown hover and focus previews. Fetch visible-nearby excerpts in batches of twelve, prioritize the hovered marker and cancel obsolete demand. Keep a separate 512-excerpt cache with on-demand age revalidation. Unavailable excerpts show no empty popup, and arriving content cannot alter marker geometry or load a transcript window.
All nineteen browser navigation cases pass, including blocked transcript/excerpt hydration, exact scrollbar extent, native thumb gestures, rich historical/resident previews, six intervening session indexes and tail-only live refresh. Six SQL tests, three route race tests, UI/server typechecks, packaged-resource smoke and the full isolated OpenCode 2.0.5 native/UI fixture pass. Record installed desktop cold-index responses of 2.05s for 11210 messages and 0.58s for 4857 messages; the warm-switch run was interrupted by user selection and is not claimed as qualified.
Large-session desktop switching reproduced repeated restoration requests for the same absent anchor. Distinguish anchor_missing in the bounded native window RPC from ownership and revert conflicts. Automatic restoration recovers once through a fresh visible latest page and replaces the stale saved cursor only after success; explicit navigation and authority failures retain their error semantics.
Cancel view-owned initial reads when hidden, release their request authority before an immediate return, and prevent obsolete hydration callbacks from reviving after away-and-back navigation. Pause outline scans while transcript hydration is loading, preserving their accepted cursor and completed display. Add the user-approved lightweight timeline scrollbar separator, hidden when its measured content does not overflow.
Record the real Windows desktop baseline and remaining priorities in SESSION_HISTORY_STRESS_REVIEW.md: 62.62 MiB of transcript responses, repeated outline scans, transient heap growth and main-thread stalls. Separate observations from unproven leak or CPU attribution, and document the live-event merge, incremental metadata and byte-budget work still needed.
Validate 18 browser navigation cases (17 in the complete run and the corrected localized conflict assertion in a targeted rerun), four active-load lifecycle tests, seven navigation store/routes tests and both typechecks. The complete isolated native Windows OpenCode 2.0.5 UI fixture passes, including missing-anchor RPC semantics and native outline/window parity.
Do not treat a newer CLI's stopped status as proof that its older shared daemon is absent. Resolve native service metadata read-only through the selected execution host, match the channel's credential/configuration unambiguously, and authenticate historical metadata routes before admitting the registered endpoint. Repeat discovery inside ensure before starting.
Fail closed for malformed or oversized records, ambiguous identity, authentication failures, timeouts and existing WSL registrations with forwarding errors. Distinguish fresh configuration with no native registration, preserve the shared loopback policy including 127.0.0.2, and translate mounted/aliased WSL metadata through the selected distro.
Add lifecycle regressions and bounded, isolated packaged desktop acceptance. Both rebuilt Electron and Tauri retain an actual 2.0.3 daemon through installation until explicit restart, then activate 2.0.11 and resume the pending folder. Normal installation/reload and all three WSL modes pass. Final gatekeeper review reports no actionable findings; full server suite passes 621 tests with two skips.
Exercise the real Windows-to-WSL service lifecycle and plugin provisioning through native, mounted and aliased discovery roots. Use guarded fixture-owned registrations, unique service ports and fully isolated environments; record actual watcher behavior, measured lease heartbeats, explicit reload, restart and cleanup.
Characterize reload with a held synthetic provider stream and native pending Form, Shell and PTY. Verify one successful provider request without replay and record native resource teardown. Update all locale descriptions to explicitly include terminals and background commands.
Bound the whole fixture, native requests, predicates and cleanup independently. Handle detached event-consumer failures immediately while preserving awaited failure reporting. Seven guard regressions and final real aliased reload-safety acceptance pass; autonomous gatekeeper re-review reports no remaining fixture findings.
Ensure a wedged migration reports a failure instead of retaining a native fixture indefinitely. Apply a whole-run deadline and per-request cancellation through the generated client, bound startup/version probes, and reject repeated pagination cursors.
Escalate termination only for the child spawned by the fixture, with bounded graceful/forced waits and explicit failure if termination cannot complete. Keep cleanup in finally blocks and add workflow timeout backstops.
Gatekeeper re-review reports no remaining findings in acceptance/CI paths. Three failure-guard regressions pass; native historical migrations pass again on Windows and Linux with the guards enabled.
Keep activation explicit after optional upgrades while reconnecting backend authority to the newly selected executable. Supported running daemons remain usable and new workspaces can open when restart is deferred. Recheck executable selection and execution-host eligibility before mutating the shared service.
Publish verified installations with immutable, exclusive version receipts. Concurrent older installs cannot downgrade a newer selection, and same-version Windows publishers no longer replace an open receipt. Continue reading previous current markers.
Cover the gatekeeper findings with real manager/shared-service ownership regressions, browser recovery tests, and concurrent installer tests. Extend native migration to beta and stable seeds, same-version Forms durability controls and historical provider connections. Provide the POSIX shell explicitly in the no-system-Node fixture, fixing Linux/macOS installation CI isolation.
Require stable OpenCode >=2.0.11 <3.0.0 from authenticated daemon metadata before functional clients and plugin provisioning. Keep bounded contract recognition, connection-generation fencing and native ownership checks while retiring old request, response and event conversions.
Unify missing and outdated runtime recovery with Preferences. Install exact stable releases through bundled Node/npm into a verified versioned user prefix, preserve custom and WSL selections, and separate installation from explicit shared-service restart through the native-parent starter. Fence stale setup responses, retain pending folder opening and never replay prompts.
Certify isolated 2.0.3-to-2.0.11 history migration with executable hashes, untouched seed storage, paginated messages, forks, compaction checkpoints, location moves and pending inbox data. Add minimum/latest cross-platform migration and installation gates, packaged npm closure checks, real Solid recovery regressions and supported-contract authority tests.
Validated server/UI types, focused unit and reducer suites, browser captures, actual packaging-prepared Node 24.20.0 installation without system Node, and native location, automation and pruning fixtures. Document packaged-desktop, WSL, broader historical-state and remote-CI evidence as remaining release gates.
The installed Windows application returned only four metadata entries from a 10,763-message session because the outline's wall-time budget included cooperative event-loop waits. Remove scheduler time from pagination and bound each page by 256 rows and 24 MiB of parsed source payloads instead. Yield every 16 rows in both outline and message-window reads, preserving cancellation without paying one scheduler round trip per message.
Regression coverage advances the clock across each observation, checks full metadata pages, verifies cancellation releases the read transaction, and proves byte-budget pagination retains the first unread message. Strengthen the isolated native fixture to require full small-record pages. Seven navigation/store/route checks and the server typecheck pass.
Align the server/UI OpenCode client and bundled plugin at 2.0.11. Route canonical server.info through authenticated discovery, preserve legacy step timing, and honor hidden Forms protocol fields without rendering their inputs or dropping defaults.
Reconcile terminal tools into the bounded visible transcript and fence native reducer history reads against intervening events. Discard stale pages and coalesce trailing reads so a late settlement snapshot cannot remove a newer streaming assistant. Preserve lifecycle, generation, disposal, location and historical-data safeguards.
Qualify the latest stable runtime in CI and record the resolved version. Each CodeNomad release fixes its minimum supported OpenCode version to the latest stable available when that CodeNomad release ships. Keep one shared compatibility reference and detailed evidence in PR/CI history rather than per-version reports.
Validation includes isolated native runtime/proxy/pruning, automation, environment and fork acceptance; hidden Forms browser coverage; deferred settlement/new-execution regressions; 112 final targeted UI tests, typechecks and production builds. Gatekeeper findings were fixed and independently re-reviewed before merging.
Cancel deferred active-marker reveals when the reader scrolls or interacts with the global rail, and reveal without a smooth animation. A previous selection must not move or unmount the next click target while its distant window is still loading.
Extend the Chromium latest-intent regression to keep the next destination visible beyond the reveal delay. Update the isolated native pruning UI fixture to proxy history routes and provide the same service-location inventory used by whole-session cleanup.
Validated all five browser navigation cases, the UI typecheck, packaged-resource smoke checks, and the complete isolated OpenCode 2.0.5 native/UI pruning fixture, including whole-session confirmation and persistence after reload.
Extend the existing history-query plugin with bounded outline and anchor-window reads so timeline and current-session search can reach distant passages without loading intervening transcript pages. Share daemon-storage identity binding, preserve location/project/revert authorization, enforce payload budgets and retain overlapping neighbors for reading-position restoration.
Route timeline, search and missing restoration anchors through the existing message-load authority fences. Keep the visible transcript during navigation, let the latest requested destination win, reject late results after cancellation or leaving the session, and retain historical reading positions during live generation.
Restore a discreet timeline scrollbar with stable reserved geometry. Only marker rectangles narrow; icon dimensions and vertical spacing remain fixed across hover, focus, RTL and fractional zoom. Include localized loading/retry UI and document the navigation contract.
Validated with server/plugin/route regressions, 75 UI store tests, 56 distinct Chromium cases, server/UI typechecks, UI/plugin builds and an isolated Windows OpenCode 2.0.5 fixture comparing 1501-message navigation against native export and message reads. Installed desktop and other-platform validation remain separate.
Replace transcript-wide API downloads with bounded plugin-side history scans. The search window now offers session/workspace scope, message and technical-content snapshots, paginated excerpts and explicit single-message previews that do not populate or displace the resident transcript window.
Plan whole-session technical cleanup using compact IDs, revisions and counts, then execute batches through the existing synchronous SQLite ownership and durable execution-claim fences. Preserve text and pre-compaction history semantics, refuse changed or active content, retain atomic retry receipts, and expose progress, cancellation and partial failures.
Bind reads to the authenticated daemon storage, constrain cursors and payload sizes, and validate every contributing location against local worktree ownership before publishing workspace counts or excerpts. Keep native RPC access narrow, preserve migrated global history, add translations for all locales, and retain search-input focus with the new controls.
Validation: 56 server/plugin/route tests, 45 UI store tests, 43 transcript browser regressions and 8 search/utility-window browser tests passed. Server/UI typechecks, the UI build and bundled plugin build passed. The isolated Windows OpenCode 2.0.5 fixture verified 241-message counts/search/cleanup, exact batch retries, active-claim refusal, pre-compaction discovery and existing concurrency/cache behavior. Desktop release interaction and other native platforms remain separate validation.
## Summary
Live transcript events were measured arriving 139–160 seconds late
through CodeNomad while the direct native stream arrived in 22–55 ms.
Serial event routing awaited ownership checks across every logical
workspace before accepting the next SDK event.
- Buffer before slow routing I/O, preserving per-session/PTY/Shell
ordering and independent per-recipient FIFO delivery.
- Share validated ownership checks by recipient and complete native
location; fence inventory invalidation, disconnected generations and
stopped/reopened workspace incarnations.
- Bound retained jobs, payload size and routing age; reconnect through
normal authoritative recovery on overflow instead of silently dropping
deltas.
- Cancel pending session lookups and add rate-limited stage-specific lag
diagnostics without event contents.
## Base
Rebased onto upstream/dev at 7312ac22, including #717 and #718.
## Validation
- 43 targeted server routing/worktree regressions passed.
- Server TypeScript compilation and diff whitespace check passed.
- Isolated native OpenCode 2.0.9 fixture passed, including a
deliberately blocked recipient and another subscriber on the same SDK
client.
## Desktop testing
A Windows Tauri build of this PR is being prepared for manual testing
with the existing profile. Live before/after measurements will be added
after installation.
## Summary
- Upgrade the standalone Node executable bundled with **both Tauri and
Electron** from **22.22.2 to 24.20.0 LTS (Krypton)**.
- Add a single exact `.node-version` pin consumed by the runtime
preparation script and all Node CI setup steps, replacing the previous
Node 20/22 build/test split. Official archive SHA-256 verification and
executable-only packaging are preserved.
- Set **macOS 13.5 minimum** explicitly in both desktop bundle manifests
and update the build documentation. This compatibility change was
explicitly accepted by the requester.
- Strengthen packaged-resource smoke checks: verify the bundled Node
matches the pin, reject stale runtimes, and exercise ESM imports
including the native OpenCode V2 client from the packaged server
directory.
- Add regression coverage for the shared runtime/CI pin and macOS
minimum-version parity.
## Scope and compatibility
This updates the Node process running the CodeNomad backend. It does
**not** upgrade Electron 39 or its internal Node/Chromium, WebView2, the
user's Node installation, or the independently managed OpenCode daemon.
No application dependencies or lockfile versions are changed.
Node 24's official macOS binaries require 13.5 rather than Node 22's
11.0. Windows x64/ARM64 and Linux glibc x64/ARM64 keep their existing
Node platform floors. No additional platform or musl support is
introduced.
The Windows x64 Node executable increases from approximately **83.04 MiB
to 89.06 MiB** uncompressed. Final installer/archive size changes have
not been measured. This is a runtime maintenance update, not the
deferred packaging-size optimization.
## Validation
Performed in an isolated worktree on Windows with the official,
checksum-verified **Node 24.20.0 / npm 11.19.0** distribution:
- [x] Clean `npm ci`; lockfile unchanged.
- [x] UI, Electron, and server TypeScript checks.
- [x] Server suite: **391 passed, 2 platform-skipped, 0 failed**.
- [x] Electron Node-level native-logic suite: **192 passed**.
- [x] Packaging/runtime regression tests: **6 passed**.
- [x] `npm run bundle:server --workspace @codenomad/tauri-app`: rebuild
UI/server resources, stage production dependencies,
download/check/extract Node 24, and run packaged
startup/import/loading-asset checks.
- [x] Negative smoke: the previous release's packaged Node 22.22.2 is
rejected with a version mismatch.
- [x] Desktop manifest schema checks (Tauri numeric-format annotations
ignored by the standalone JSON schema validator).
- [x] `git diff --check`.
The preliminary compatibility study also loaded all 14 direct server
dependencies and the packaged `msgpackr-extract` N-API binary under Node
24, with a successful serialization roundtrip.
## Remaining release gates / existing warnings
- [ ] Cross-platform CI builds and tests on the final head.
- [ ] Native GUI launch, restore, OpenCode streaming, shutdown, and
restart verification for the rebuilt desktop applications. Resource
smoke tests and Node-level Electron tests are **not** a complete
native-release approval.
`npm ci` still reports the existing 49 dependency advisories; this PR
does not run an unrelated dependency upgrade. npm 11.19 also warns about
existing install scripts awaiting `allowScripts` coverage. `actionlint`
reports only the pre-existing constant-false condition in
`build-and-upload.yml` (now line 816).
The touched `build-and-upload.yml` remains approximately 913 lines; no
unrelated workflow refactor is included.
## Summary
I added **Fork after this message** to completed agent responses and
user prompts. Both actions keep the selected message and open the new
conversation with an empty composer. The source conversation and its
draft are preserved.
I resolve the cut against native message history, including hidden
records and cursor pages. A tail fork checks the native boundary; if
another client appended in the meantime, I discard that fork rather than
open the wrong history. Pending prompts and unfinished responses do not
offer the action.
Closes#693.
## Validation
- UI typecheck passed.
- 7 fork regressions and 65 existing request-authority tests passed.
- 5 Chromium scenarios passed: prompt, historical response, latest
response, unfinished response, and narrow overflow menu. These exercise
the real SessionView, empty composer, preserved source draft, and
absence of an extra prompt.
- The isolated native fixture passed on OpenCode 2.0.10 and beta-19271,
including page crossings, a hidden model-change message, both tail
roles, and preserved source history. I used private homes/databases and
left the shared daemon untouched.
- I added the unit regression to CI; the browser regression is picked up
by the existing browser suite.
The shared UI implementation applies to Tauri and Electron. I have not
rebuilt or installed a desktop binary.
## Maintenance note
The touched existing files are already large: `session-api.ts` (~1,826
lines), `message-item.tsx` (~817), and `session/session-view.tsx`
(~693). I kept the new boundary logic in a separate module.
## Summary
Apply the existing CodeNomad profile environment **before every prompt,
custom command and session-shell send**, then forward the request only
after OpenCode acknowledges it. This makes profile changes available to
local commands even when the shared daemon is already running.
No per-conversation settings UI, polling, session-opening writes or
daemon restart. The implementation lives in the shared server for
Electron/Tauri/web parity.
close#711; awaiting reporter validation rather than automatically
closing the issue.
## Implementation
- Build a complete execution-host snapshot; preserve PATH and other
inherited values, normalize Windows key collisions, and exclude internal
authentication/storage variables. WSL reads its selected distro's
environment instead of sending Windows PATH/HOME.
- Apply after ownership checks and worktree mutation admission, using
the pinned native connection. Fail the send on environment errors, stale
connection or disconnect; never log the native environment request body.
- Update help and failure messages in every locale. Changes and removals
take effect on each conversation's next send.
## Validation
- Server suite: **586 passed, 2 platform skips**.
- Focused UI send/SDK/authority tests: **112 passed**.
- Server, UI and Electron typechecks; production UI build passed.
- **OpenCode 2.0.9 / Windows native fixture:** real WorkspaceManager +
guarded proxy + native shells, two conversations, changes/removal, no
mutation on read, Git Bash, unchanged daemon PID. Independent
configuration/database/port; only the fixture service was stopped.
- Reproduction: `node scripts/test-session-environment-native.mjs
<absolute-opencode-executable>`.
## Scope
This changes local session command environments, not provider/MCP/LSP
configuration or daemon-internal temporary files. The native environment
belongs to a session: another client or a new send during existing work
can replace it. Queued prompts do not get individual snapshots, and
native-created subagents are not automatically intercepted. Details:
`dev-docs/SESSION_ENVIRONMENT.md`.
Existing oversized files touched narrowly:
`packages/server/src/server/http-server.ts` (~2,300 lines),
`packages/server/src/workspaces/manager.ts` (~1,200 lines), and
`packages/ui/src/lib/i18n/messages/*/settings.ts` (~600 lines each).
## Summary
Restore the saved project/conversation promptly, preserve restored tabs
when later hydration fails, and remove a filesystem heartbeat that
repeatedly invalidated OpenCode configuration.
## Root cause and reproduction
PR #666 placed desktop plugin presence leases beneath the authenticated
OpenCode configuration discovery root. Updating their mtimes every two
seconds triggers recursive configuration watchers and expensive
revalidation across loaded locations.
With CodeNomad closed and the same shared OpenCode daemon left running,
updating only a temporary file in that directory reproduced the
slowdown:
- Quiet: 77–92 ms for the same 200-message request.
- File mtime updated every two seconds: 5.3–8.8 seconds.
- Updates stopped: 71–138 ms.
The pre-#666 server/UI comparison was only a partial baseline: native
reads recovered after startup, but the older UI also exhibited
restoration failures.
## Implementation
- Derive a sibling plugin storage namespace from the connected daemon's
authoritative discovery root. Move new heartbeats outside its
recursively watched configuration tree.
- Migrate existing managed inside-root storage while retaining read-only
observation of older backends' leases. Preserve existing outside-root
storage, independent backend lifetimes, and native WSL path translation.
- Seed saved selection identity before HTTP hydration, prioritize the
saved project, and hydrate its conversation directly. Preserve bound
project tabs across subsequent hydration errors/timeouts and respect
user selection changes.
- Load model/agent catalogues when the client becomes ready and retry
reads superseded by the initial stream connection.
- Publish session lists without waiting for runtime-status reads; merge
delayed status results without overwriting SSE updates or local
admissions. Use lightweight status reconciliation for liveness.
- Bound secondary reads across projects, coalesce Shell refreshes, and
prevent duplicate catalogue/Shell refreshes through the native
transcript projection.
- Preserve directory authorization while avoiding Git mutation-identity
resolution on reads; reject unrelated Git common directories before
native worktree inventory scans.
## Validation
- Targeted UI and server suites covering reconnect races, status
authority, background queue cancellation, projection isolation, Shell
refresh coalescing, and ownership enforcement.
- 19 plugin path/lifecycle/migration/presence tests passed.
- Six browser restoration scenarios covering Electron/Tauri, saved
selection, user selection, and hydration timeout behavior passed.
- Isolated OpenCode 2.0.9 integration fixture passed: native
provisioning, plugin availability, independent leases,
shutdown/reopening, and OS watcher verification that heartbeats do not
modify the configuration tree. A negative control using the old storage
placement fails that assertion.
- Typechecks, complete server/UI/plugin build, and `git diff --check`
passed.
- Installed usual-profile Tauri validation on the requested
conversation: launch-to-display 3.86 and 5.33 seconds; initial
200-message requests 178–239 ms; latest forced reload 218 ms. No
intermediate wrong conversation selection observed. Verified all three
saved projects and the real model menu.
## Remaining observed edge case
A forced reload racing restoration of an old scroll position can still
show the existing history retry control. Retrying succeeded. This PR
addresses the reproduced latency trigger and startup restoration races;
it does not claim that every scroll-restoration edge case is resolved.
