Repository navigation
feat: manageable session queue, truthful live view, and legible transcripts - #557
Conversation
Checkpoint via cy-loop-tasks (iteration 82, phase D review round 1). Deliver tasks03-08: manageable durable queue, bounded ACP delivery, work-signal supervision, truthful replay, calm transcripts and full-history navigation. Complete final integrated QA and repair the confirmed findings. Real-provider auth-loss/rate-limit validation remains externally unverified. Co-Authored-By: Codex <[email protected]>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Important Review skippedToo many files! This PR contains 589 files, which is 289 over the limit of 300. To get a review, reduce the PR to 300 files or fewer by splitting it into smaller PRs or changing its base branch. Usage-priced reviews support at most 300 files. ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Team Run ID: ⛔ Files ignored due to path filters (98)
📒 Files selected for processing (589)
You can disable this status message by setting the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
React Doctor found no new issues. 🎉 Reviewed by React Doctor for commit |
|
Too many files changed for review (687 files, 100 file limit). |
What & why
PR #555 shipped tasks 01–02 of the sessions-stability program (live steer, truthful stop). This PR
integrates the remaining six implementation slices, tasks 03–08. Together they close the gap between
what a long-running session is actually doing and what the operator can see and control: follow-ups
are a managed queue instead of a black box, the agent transport no longer wedges a turn under the
storm and slow-consumer conditions we can reproduce, sessions survive on observed work rather than a
wall clock, the live view reports connection and catch-up state it can actually verify, and an
hours-long transcript reads and searches like a document.
Surviving queue and send envelope (task_03). Interrupt now cancels only the active turn; every
parked entry survives it, including agent- and Goal-owned rows. Clearing is a separate explicit
action (
compozy session input clear,DELETE …/prompt/queue,compozy__session_inputs_clear) thatwrites one durable
queue_clearedtrace per removed entry with the actor identity, and repairs itsown transcript projection if the daemon dies between the queue write and the projection. Send
identity admits exactly one dispatch: replaying a
message_id/idempotency_keypair returns therecorded outcome with
replayed: true, and the same identity with different content is asend_conflict. Daemon-authored synthetic follow-ups moved onto the same durable queue, so thein-memory second scheduler is gone.
unconfirmedhas one owner now — the client. Daemon queuestatuses stay the closed set
queued|dispatching|sent|failed|canceled; a lost acknowledgment isclient-local state with a Retry that replays the printed identity.
Transport hardening (task_04). The reproduced deadlock in
internal/acpingestion and broadcastis removed, and saturation is now explicit rather than silent. The notification path no longer
blocks: pre-append ingestion goes through a bounded
IngestGatethat drains every accepted eventand then fails the turn with a stated cause when it saturates, instead of dropping events quietly;
post-append delivery goes through
LiveBroadcast, which sheds slow watchers with astream.consumer_degradedmarker they recover from durable history. Pending permission and RPC mapsare bounded and fail fast when the process dies. Both stages expose
Stats()so supervision can seethe queue depth it is reasoning about. The proof is
TestDaemonE2EACPmockTransportStorm: a real daemon and a real acpmock process,one HTTP stream deliberately stopped mid-read, a 50,000-chunk producer run to completion, and then
the whole 1,600,000-byte durable window read back through UDS starting at sequence 1, with exactly
one canonical degradation event. Storm diagnosis also caught a full transcript reprojection after
every 4 KiB write; persistence now batches to a 256 KiB byte limit alongside the existing
64-event / 25 ms boundaries while store coalescing keeps individual 4 KiB delivery frames.
Signal-based survival and no silent starvation (task_05). Inactivity termination is driven by
evidence, not elapsed time. Six work-signal sources keep a session alive —
agent_progress,tool_running,active_child,loop_run,task_lease,scheduled_wait— and they are readable onthe session resource as
supervision.work_signals/supervision.sources. A source that cannotanswer reports unknown plus attention and suspends automatic stops instead of guessing. Genuine
silence warns exactly once (
quiet_after, default 30m) and then stops through the task_02 escalationladder (
stop_grace, default 10m); fresh work cancels the warning. The old wall-clock killers aredeleted, and
network.live.max_total_wall_timenow defaults to0, so Live participation no longerdies at 30 minutes unless you set a budget. On the scheduling side, capacity-starved runs escalate to
a visible needs-attention state through
scheduler.capacity_waiting_escalated, skipped wakes stoppedcounting as successes (the counters payload now separates
wake_attempts,wake_skipped,wake_succeededandwake_failed), blocked automation fires defer durably viaautomation_scheduler_state.deferred_untiland drain after a restart, and the audit-row sweeperactually runs.
Truthful live view (task_06). Reconnects resume exactly once from the last delivered position;
the recent-window cursor skip that silently dropped events is fixed, and a reconnect already at the
current watermark gets an empty
transcript_deltawithhas_more: false— catch-up confirmedwithout inventing a message. A brief interruption stays quiet for two seconds, then shows
Reconnecting · N; six failures showDisconnectedwith a working Try again instead of a deadstream posing as an empty session. A send pressed while disconnected is refused with the draft kept.
The prompt-POST gap is covered by a bounded one-second control poll over session detail, queue and
decisions, handing back to the transcript tail at settle with the retained cursor and projection
fences. Token bursts coalesce at a durable sequence watermark. Compaction archives only prior
completed turns and cuts their projection in the same transaction, so a surviving active assistant
keeps its message identity and the APIs never disagree with what is on screen. Retention that has
removed a resume position now answers
cursor_expiredand replaces the retired window rather thanfailing.
Legible transcript (task_07). One live tool row that replaces itself, completed tools collapsed
into a group sentence, settled turns folded behind
Worked for {duration} · Ran N commands, edited M files, and interrupted turns left open. An explicitThinking…state replaced the empty assistantbubble with floating copy actions. Scroll has one owner, so reading older history does not fight the
stream and opening a fold does not yank the viewport. Steer provenance is on the message itself:
Steered — delivered into the live turn,interrupted and replaced,Superseded by your next steer,From the queue · was #1. Stop outcomes read as outcomes (Stopped by you after 1m 40s,Stopped after … (inactivity)), a real tool failure shows danger while routine errors stay muted,large payloads get a bounded body with Show all and Download, prose streaming has a smooth
reveal with a reduced-motion path, and huge transcripts stay inside a bounded browser window.
Session navigation (task_08). Full-history search and an operator-message outline are
first-class reads with parity on all four public surfaces:
GET …/transcript/search,GET …/transcript/outlineon HTTP and UDS,compozy session search/compozy session outline, andcompozy__session_search/compozy__session_outline. Matches carry additivepart_indexandfieldhints (text,title,tool_name,filename,error,input,output), so a consumeropens the exact containing work row instead of guessing from the snippet. In the web, find-in-
conversation jumps to a match in unloaded older history, opens the folds it needs, keeps focus while
the stream runs, and invalidates cleanly when compaction archives the match. A compact message trail
hops between sent messages with hover previews and compresses when there are many.
Also in this PR:
event_summariesgained a monotonicseqcursor (the oldid-ordered log streamcould reuse a retired position after retention or VACUUM), the sessiondb projection got a
(kind, start_sequence)index plus a display backfill for user/system timestamps and settled toolresults, and the deleted
internal/session/session_supervision.goand two superseded web componentshad every consumer migrated with them.
Repairs found by this PR's own CI. Native presentation metadata now covers session
search/outline/inputs-clear and the public
qpreview. Bounded raw-stream test callers pass therequired
limit=200. ACP mock sandbox creation keeps its bounded detached acknowledgement socancellation can release a terminal it created — that was a test-provider cleanup bug, not a daemon
lifecycle change. The web keeps an unresolved file-mutation verification warning visible both
outside settled work folds and in standalone marker-only messages. React Doctor's findings were
resolved by extracting focused components and view models, moving navigation async helpers out of
the compiled hook, correcting empty Find status semantics, and giving reveal progress a per-instance
XState clock with canceled-frame identity fencing — no suppression, config, or rule changes.
Redaction cost on the streaming path. CPU samples of the one-core transport storm
identified repeated secret-assignment and provider-token scans. The redactor now skips the unchanged
assignment expression when its required separator is absent, and skips provider expressions when
their derived required literal prefix is absent. Empty prefixes still scan. Rule order and
replacements are unchanged; 11,840 before/after output hashes match. The first optimization alone
still exceeded CI's deadline, so the final repair addresses both measured costs. The owning Daytona
sidecar generator regenerated the embedded Linux amd64/arm64 binaries.
Settings navigation and final terminal/selector repairs. A delayed Settings-open completion could
overwrite a newer Profiles click. The routing coordinator now honors explicit same-location navigation
and fences the older history write. Hidden terminal panes no longer publish dimensions derived from
unresolved CSS, and the visible grid fills its containing window. The CLI recognizes a completed
DETACH when the server closes before the input writer reports completion, preventing an unintended
reconnect. The runtime selector uses Base UI's default closing-focus lifecycle, preserving focus when
the operator moves into the composer during its exit. The controller implemented the final terminal,
CLI and selector integration repairs directly and reviewed the complete resulting diff.
Stop recovery and terminal selection. Canceling a known session whose process has already
exited returns nothing-in-flight even if retirement reaches the driver lookup first. Stop callers
and persisted restart receipts now share the first verified outcome, including when the process
watcher finishes before the driver returns. Terminal selection actions float inside the terminal
window: revealing them no longer resizes the PTY and clears the selection that opened them.
The existing CLI integration driver verifies its synthetic process through its owned Done channel;
the desktop geometry test follows current resize frames instead of the earlier attach dimensions.
Spec and tasks:
.compozy/tasks/sessions-stability(_spec.md,_dx.md,_uiux.md,_tests.md,task_03–task_08). Tasks 09–10 are the QA plan and its execution; their output in this diff is thedocs/qa/tree plus the repairs the walks forced, both listed below.How you verified it
Integrated real-user QA. One isolated lab (
eng-qa-bootstrap, freshCOMPOZY_HOME, own ports andsocket, Vite proxy to the lab daemon) ran eleven charters across four personas. Ten passed; the
eleventh is blocked on an external prerequisite (below). Full report:
docs/qa/reports/2026-09-06-sessions-stability.md. Highlights, all from public reads rather thaninternal state:
subprocess. An independent paginated HTTP read counted 3,023 distinct messages with
incident0000and
incident1509both retained; outline returned 1,510 rows and literal search foundincident0000from outside the latest page.202. Retry sent thebyte-identical request, the server returned the same entry with
replayed: true, and thetranscript retained exactly one authored user message and one assistant reply for that identity.
showed the terminal retry marker. Unblock plus Try again returned live at the unchanged cursor
4651 without another transcript event and without auto-sending the draft.
The independent public queue read returned
inputs: [],queue.entries: 0of cap 10, bothreceipts survived a reload, and the transcript kept every per-entry identity.
no work for 41s, daemonstop_cause=inactivity,verified and escalated, with no "Session failed" notice.
at attempt 1 after a real restart drained the queue. A capacity-bound run emitted exactly one
scheduler.capacity_waiting_escalatedat 37.5s andneeds_attentionat 53s with reasonprompting, then recovered into a linked attempt 2.to a canonical receipt that resumed the same prompt. A native clarification answered through the
composer completed with
choice 0,fallback false.ação λ caféintact (SHA256f611bf90…).their owners and verified with the applicable canonical suites and real journeys. The original
sixteen include the three final-review findings described below; five further records cover
streaming redaction, Settings navigation, terminal sizing, CLI detach and selector focus.
Visual contracts. All 37 required rows pass with 0 blocking divergences: 29 new rows for tasks
03/05/06/07/08, plus task_01 VC-01..05 and task_02 VC-01..02 recaptured because later composer and
timeline changes invalidated their geometry. Task_01 VC-06 (settings) is reused because its visual
markup, layout and styles are unchanged; the later repair changes routing event handling. Bundles live at
.compozy/tasks/sessions-stability/evidence/visual/<task>/<VC>/with reference, implementation,side-by-side, diff,
comparison.jsonand a per-rowreview.md. These are deterministic Storybookcaptures of production components; they are evidence for visual language, not for motion cadence or
runtime behavior, and each
review.mdstates that scope explicitly.Automated checks. New and changed tests went into their existing canonical suites
(
internal/acp,internal/session,internal/store/{globaldb,sessiondb},internal/api/{core, httpapi,udsapi},internal/automation,internal/scheduler,internal/cli,internal/daemon,internal/config,web/src/**/__tests__). The complete JS side runs from the repo root: root Turbolint typecheck testover./web,./packages/uiand./sdk/typescript, with 7,101/7,101 webtests across 771 files in 120.56s and zero lint or type warnings
(
.cache/sessions-prefix-final-gate-regenerated.log). Focused Go evidence, with logs under.cache/: themigration and schema catalogs (
internal/store/globaldb3.884s,internal/store/sessiondb2.127s)and the native descriptor catalog (
internal/tools/builtin1.641s); for the review repairs, the realSQLite/HTTP reconnect suite for the resumed-stop bug (15.011s), the HTTP/UDS empty-head log cursor
integration (12.803s / 4.784s), the queue-edit payload case (0.751s), and the compaction race
selection (3.656s).
Repairs for the CI failures. The existing daemon transport-storm (50,000 events) and
blocked-cancel regressions pass in 50.115s; real cancellation and its owning cleanup selection pass
over 20 repetitions; metadata and harness race suites plus the Windows mock-driver cross-build pass;
the existing timeline and thinking-visibility tests pass 50 cases, and the focused suites behind the
React Doctor work pass 72. For the final redaction repair, the same real one-core storm drops from 51.92s to 16.83s,
with all 50,000 chunks, exact 1.6MB durable bytes, terminal completion and one correlated degradation
record. Ten sequential benchmark samples show median reductions of 73.7% for 64KiB plaintext and
42.4% for JSON envelopes. The unchanged title/verifier browser journey passes in 19.3s.
A subsequent Linux CI failure exposed the storm watcher's receive buffer being applied after TCP
negotiation, allowing all 1.6MB to fit without application backpressure. Configuring the same 1024-byte
option before dialing makes the pressure condition effective: an isolated Linux probe admits 1.03MB,
versus 2.56MB before. Assertions, 50,000 chunks and the deadline are unchanged. The corrected real
one-core journey passes in 16.05s; runtime CI on
201591b96passed all 268 tests, including 182 daemoncases. This is a corrected test precondition within the existing storm incident.
All 12 terminal browser/CLI journeys pass against the fixed served build. The canonical UI suite has
761 passing cases and 264 focused Web terminal cases pass. The detach regression fails before the
production repair and passes with the race detector afterward; its unchanged real CLI golden path
passes three times with Bash, matching CI. Six combined provider/terminal journeys pass with the
repaired daemon and Web build. After extracting the selector search header, both provider/model
journeys pass again in 13.2s; all 98 selector component cases pass. The browser regression explicitly
checks composer focus after the popup closes and fails on the old served build. Each wrapper
restored
web/distbyte-for-byte.The earlier claim that five local Profiles repetitions and seven related journeys served a patched
alternative bundle is withdrawn: the fixture forced
web/dist. Profiles and related Settingsjourneys passed actual CI on
d897e90f5and201591b96; the final current-head result is below.Evidence and causal detail are retained in
docs/qa/reports/2026-09-06-sessions-stability.mdand theCI defect records.
The final cancellation regression fails deterministically on the old production code; the
unchanged receipt recovery case also reproduces under one core. Both pass over 30 repetitions after
the repairs. The full session race suite passes in 136.495s, three real subprocess lifecycle journeys
in 6.012s, and both real network gateway journeys in 38.164s; the Windows build passes.
The existing terminal quote journey selects actual rendered rows with a real pointer gesture and
still fails on the old UI. On the fixed UI it passes selection, quoted source identity/text, reply,
and no-session fallback in 18.2s total. Packaged macOS clipboard, zoom and IME pass again in 12.8s
against the final Web build. Assertions and deadlines remain intact. React Doctor 0.9.13 reports
100/100 with zero warnings or errors on the final UI.
Final controller review. The integrated diff was reviewed once against the tasks 03–08 contracts.
Three findings came from this pass; each was repaired with red-then-green
evidence and re-walked in the browser where a user could see it: a replayed
session_stoppedframefrom history closing an active resumed
raw stream, a queued-edit refusal losing concurrently typed composer text (the browser re-walk found
a second half of the same loss — a completed send returning
409without its actionable dispatchcode), and an empty live-only log stream synthesizing a wall-clock cursor that dropped newly
persisted older-timestamp events. Notes:
.compozy/tasks/sessions-stability/memory/peer-review.md.Not verified
The local default Fish shell delays the terminal start marker by about ten seconds and causes the
approximate journal actor assertion to fail on both the old and repaired binaries. Bash, matching
CI, passes the complete open/run/detach/journal path three times. The Fish result remains a recorded
pre-existing environment limit.
Real provider auth loss, rate limiting, and reauthentication inside the cache TTL remain
externally unverified. The operator account is logged in and real Claude prompts succeeded, and the
Compozy native auth probe truthfully returns
unknownbecause noauth_status_commandisconfigured. Reproducing the failure branch needs a separate real-provider account whose
authentication or rate limit can be controlled; no operator logout or credential mutation was
performed, and no
acpmockfixture or successful-login screenshot substitutes for it.RT-018'sprovider-error branch and the
MS-web-provider-auth-gatecanary carry that limit. The owningprotocol and cache suites still pass; they cover the code path, not the live provider behavior.
One further note on the record: several gate fixtures were reconciled along the way (bounded stream
limits, ACP saturation drain order, broadcaster sequence-reset delivery, nested folds). The
observable invariants they assert are unchanged, and no production regression was hidden behind
those updates.
React Doctor 0.9.13 reports 100/100, zero errors and zero warnings for the changed Web sources.
The same CLI first reproduced CI's 2 errors and 14 warnings (84/100); the source corrections above
resolved all 16 without suppression, config or rule changes
(
.cache/sessions-final-repairs-react-doctor.json).Screenshots
Twelve deterministic visual-contract captures of the production components at 1440×900, then four
frames from the integrated lab run and one from the daemon-served Playwright journey that covers a
CI regression. The 37-row visual-contract accounting above is unchanged; the last image is
additional regression proof, not a contract row.
Queue strip with three parked follow-ups, per-row Steer / edit / remove, Clear all, and the
⏎ steer · ⌘⏎ queuehint under a live turn.Acknowledgment lost in transit: a client-local
Not confirmedrow carrying the message identity, witha Retry that replays it. The daemon queue never shows this state.
Clear all is explicit and inline, and the rows it is about to remove show who owns them (
reviewer,release-1.4). Keep leaves the queue untouched.Stream severed after the quiet grace:
Reconnecting · 3in the window header, transcript andcomposer intact.
Retries exhausted:
Disconnected, an explicit "Live updates stopped at 09:31 AM — couldn't reconnectafter 6 tries. What you see is saved up to then." and a working Try again.
Send pressed while disconnected: refused as
Not sent, draft preserved verbatim, no silent drop.The single silence warning on an open session, with the countdown mirrored in the status row and a
Stop now action. Any real work signal cancels it.
Steer provenance on the messages themselves: superseded, interrupted-and-replaced, and promoted from
the queue, with the interrupted turn folded as
Interrupted after 1s · replaced by your steer.A turn stays working while its children run: two live child-agent rows and
Working for 6m 6s · 2 agents running.Stop reads as an outcome, on the turn and in the status row:
You stopped after 1m 40s, with theinterrupted command marked
stoppedrather than failed.Find-in-conversation:
1 of 4, the result list under the bar, and the landing turn openedfor a matchwith its tool bodies revealed.Message trail: one tick hovered, preview card with the sent message, its reply preview and
2 of 2.Integrated lab, real ACP permission request:
Working for 2m 2s · Waiting for your decision, thedock beside the composer with Allow once / Always allow / Reject. This survived a page reload before
being answered.
Integrated lab, the queued-edit recovery re-walk. A held
PUTon entryinq-cfa9b26f210c1465released after the entry had already been sent returned
409 entry_dispatchingwith the edited textin
details.text, and the composer kept both blocks in order: the draft typed while the request wasin flight, and the recovered edit handed back by the refusal. A page reload preserved the same three
editor paragraphs, and the public queue drained to
entries: 0of cap 10.Integrated lab, real inactivity stop:
Stopped after 1m 9s · no work for 41 seconds. The daemonrecorded
stop_cause=inactivity, verified and escalated.Integrated lab, find into a truncated tool payload on the 3,023-message session:
1 of 1on line 251of 260, Unicode needle
payload needle ação λ caféhighlighted inside every nested clipping box.Daemon-served Playwright journey, covering the file-mutation regression: the unresolved verification
warning stays visible below the completed answer even though the turn's work is collapsed into its
fold.
Impact
CLI
compozy session input clear <session-id>(new) — explicit clear with per-entry transcript traces;returns
inputs,cleared_count,queue_generation.compozy session search <id> <query>(new) andcompozy session outline <id>(new) — full-historytranscript search and the operator-message outline.
compozy session statusgrowssupervision.work_signals,supervision.sources,supervision.quiet_warningand thequeue: {entries, cap}summary.compozy session events --follownow supplies a bounded 200-event initial window.session promptexamples advertised--expected-turn-idwhile help exposed--expected-turn.HTTP / UDS (same routes on both transports)
DELETE …/sessions/{id}/prompt/queue(new) — explicit clear-all, traced per entry.GET …/sessions/{id}/transcript/searchandGET …/sessions/{id}/transcript/outline(new) —read-only, workspace-scoped. Search matches carry additive
part_indexandfieldhints; theentry cursor stays the result identity and older readers may ignore the hints.
supervision(work signals, sources, quiet warning) and thequeuesummary.limit; an unbounded request is rejected.An explicit
after_sequence(including zero) pluslimitreads the next matching events inascending order instead of the most recent ones. New reset reason
cursor_expired. Newdelivery-only frame
stream.consumer_degraded(after_sequence,through_sequence,refresh: true; noid, cannot advance the replay cursor). A reconnect at the current watermarkreceives an empty
transcript_deltawithhas_more: false.SchedulerCountersPayloadsplitswake_attempts/wake_skipped/wake_succeeded/wake_failedand addscapacity_waiting_runs,spawn_requested,needs_attention,last_cycle_at.Native tools
compozy__session_inputs_clear,compozy__session_search,compozy__session_outline(new).compozy__session_describegains thesupervisionblock andqueuesummary. Descriptors and thecatalog digest are regenerated.
Canonical events —
session.queue_cleared,session.queue_clear_failed,session.supervision_warning,session.supervision_stopped,session.supervision_source_error,session.turn_quiesced,scheduler.capacity_waiting_escalated, and thetranscript_marker.queue_clearedmarker.config.toml
[session.supervision]:quiet_after(default30m) andstop_grace(default10m) replaceinactivity_warning_after/inactivity_timeout. Per SD-013 the released keys stay readable andwritable through the v0.4 window with a deprecation warning and are removed in v0.5.0. A file
using only the legacy keys keeps their independent absolute timers, including disabled warnings and
equal thresholds; setting either new key opts into the new zero semantics, and explicit new values
win over the translated legacy value. Translation lives at the loader boundary
(
internal/config/supervision_compatibility.go), not in the manager.[network.live] max_total_wall_timedefault changes from30mto0(aggregate wall budget off bydefault). Per-wake wall time, wake count, tokens and depth stay enforced.
SQLite (append-only, lossless)
00104—session_input_clear_tracestable plus its pending index, so a clear survives acrash between the queue write and its projection.
00105—session_input_queuerebuild addingsynthetic_prompt_json(durable syntheticfollow-ups) and the active-steer uniqueness index; every existing row is copied.
00106—automation_scheduler_state.deferred_untilfor durable defer/drain.00107—event_summariesrebuild to a monotonicseq INTEGER PRIMARY KEY AUTOINCREMENTwith
idkept unique. The migration preserves the pre-migration rowid cursor including retainedgaps, so existing numeric log cursors keep working and retention/VACUUM/reopen never reuse a
retired sequence.
00007—(kind, start_sequence)index for outline and role-scoped search.00008— display backfill for user/system message timestamps and settled tool results,from the authoritative event ledger. It rewrites no event bytes, identities, archives or sequence
fences.
Web — queue strip with in-row editor, owner attribution, cap state and clear confirmation;
unconfirmed row with Retry; transport chip and notices (grace, reconnecting, disconnected, paused,
send guard); quiet warning notice and status row; live tool row, tool group row, turn fold row,
thinking row, steer receipts and user steer provenance; find bar with Highlight API marks;
message trail; one scroll owner with a page window and viewport host for bounded memory on huge
transcripts; smooth streaming preference. Two superseded components
(
session-composer-queued-prompts,session-working-row) were deleted with their consumers.Docs (packages/site) — new
cli/session/search,cli/session/outline,cli/session/input/clear; updatedsessions/control-plane,sessions/events,sessions/lifecycle,cli/session/{index,prompt},cli/session/input/{index,steer},configuration/config-toml.Official skill:
skills/compozy/references/runtime-operations.mdgains explicit queue-clearsemantics, prompt-identity rules and a silence-supervision / scheduling-pressure section.
QA tree — new charter
CH-session-history-navigation, the run reportdocs/qa/reports/2026-09-06-sessions-stability.md, 24docs/qa/bugs/BUG-20260906-*records, andupdates to the affected scenarios (
RT-018,RT-019,RT-session-live-steer,RT-session-prompt-cancel,RT-session-native-stop,RT-visible-session-streaming,RT-session-context-rebuild,ET-web-session-transcript-calm-grammar,ET-web-session-permission-dock,MS-web-provider-auth-gate,TA-schedule-catchup-overlap) plusjourney
J-14.Compatibility regimes and delete targets for this program are recorded once in
_spec.md's CompozyImpact Audit; this PR does not restate them.
Local gate and delivery
15fb49715cc5967984d5ef897aa288f8a0bd5236, still current after commit. Codegen: 33s; Go lint:35s and zero issues; Go race: 13s using valid package evidence from the preceding full pass
(373s, including session 141.637s and daemon 155.516s). Go SDK, desktop, UI and TypeScript SDK pass;
Web: 7,101 tests in 771 files, 123.91s. Source-size and Go source-policy pass.
The configured commit hook ran all checks with stash and revert disabled; the checked tree
fingerprint remains current. Evidence:
.cache/sessions-stop-selection-delivery-gate.logand
.cache/sessions-stop-selection-delivery-gate-status.log.ea4db72734b780c4d8a0a27870d928fdc9b5f746. The working tree is clean and theremote PR head matches. Images 01–16 retain capture key
ca00890294bc; image 17 retains91bc7b2b3. All 17 verified URLs are preserved.ea4db72734b780c4d8a0a27870d928fdc9b5f746:31 passed, 17 conditionally skipped, zero failed or pending. CI run 34065173749
passed all eight Go race shards, all four Web E2E shards, runtime and desktop E2E, frontend,
codegen, static checks and both aggregate gates. React Doctor and the site preview also passed.
Terminal evidence:
.cache/sessions-stop-selection-ci-green.json.Herdr-orchestrated Claude Fable frontend changes. Claude Code Opus prepared the initial detailed
description and screenshot publication; Codex updated the final evidence and delivery metadata.
This PR remains draft. The real-provider auth-loss, rate-limit and reauthentication-within-cache-TTL
branch remains externally unverified; passing CI does not establish that live-provider behavior.