feat(fork): visible and controllable agent sessions (#6, #7)

[spiritabsolute]

Summary

Agent replies explain whether a provider session is new, resumed, restarted or compacted, how much conversation history was delivered and how much context is occupied when the provider reports it. Restart offers the original assignment, recent messages or available thread history. Checked worker retirement preserves files and protects neighboring foreground threads. Compact operates on the selected existing session and reports queued, successful, failed or unconfirmed results.

The thread composer has Manage context immediately before mention management. It lists the thread agents the user can manage, now with the same profile-avatar/initials treatment as mention suggestions, then opens the selected agent's Restart/depth and Compact actions. Permissions and exact scope are checked again when sending. Draft text, attachments, selection and mention choices are preserved.

A successful Restart schedules one short status-only turn in the replacement session, using the selected history and conversation language without automatically continuing the task. The harness signs the generated answer into the original thread. Its first answer now includes the live session's transition, history, actor and available occupancy tags before signing and durable preparation; unavailable occupancy remains absent and old generations cannot supply it. Delivery retries reuse the same signed bytes. Failure notices retain their separate path. Previously signed messages are unchanged.

The status prompt distinguishes missing task details from missing messages, binds coverage claims to supplied history and leaves unknown prior outcomes unknown. Durable ownership, scope/token fences and prepared bytes prevent automatic replay after an uncertain crash. Later ordinary messages retain their queue entries and use the resulting session.

The Desktop tests also avoid an expensive jsdom diagnostic path by awaiting query-cache rendering and checking boolean absence rather than comparing a live DOM graph with null. Test/build workloads use external memory, swap, deadline and process-tree limits.

Candidate: 94d805f.

Current picker interaction

Retained capture at 7d9f216ea: thread head before opening Manage context. Frontend rendering inputs are unchanged by this finalization:

Agent list after opening Manage context in that same passing browser flow:

Final review and validation

Final runtime and UI reviews, including verification of previous blocking findings and both final corrections: PASS. No remaining confirmed important or critical source regression was found. The owner rebuilt the local application, reported that it looks working, and explicitly accepted completion and merging on 2026-10-20. This supersedes the earlier deferred human-acceptance status. This is owner acceptance of the rebuilt app, not a claim that every platform/provider checklist row was individually executed.

The final CI corrections address observed failures on 7d9f216ea:

• The reaction-order smoke still required the intentionally removed per-message session-control button. It now requires that button to be absent and preserves chronological pill order and exact six-pixel body/reaction spacing for the metadata-free fixture. No wait, retry, fixture or product behavior was weakened.
• Windows could not fetch the NetEq Git source. The manifest and matching lock entry now use the canonical public repository, preserving revision 16729881b0a80022a7cbe0acc94c9becf2fad313, version, features and dependency contents. Credential-free fetch of that exact commit succeeded and its complete Git tree matches the already tested source. No dependency upgrade or advisory exception was introduced.

Fresh finalization checks completed: fork-tooling suite 80 tests total, four skipped, registry render/validation, Desktop check (three existing warnings), ten file-size-policy tests, Desktop size guard against the pinned fork base, and locked offline Cargo manifest metadata (--no-deps). Source checks ran on the frozen staged candidate based on 7d9f216ea; complete commit promotion preserves all 5,704 file entries.

Retained package results remain Rust 2,258 passed / nine opt-in skips, doctests two passed / one ignored, and Desktop 7,190 passed. Complete file-manifest comparison confirms unchanged relevant Rust and Desktop unit inputs. The earlier complete Desktop typecheck remains applicable: its src, configuration and package-lock inputs are unchanged; the changed E2E spec lies outside the typecheck include. A redundant local typecheck attempt stopped at a 512 MiB V8 heap cap under external containment; that attempt is retained as unsuccessful, not counted as another PASS. The unsupported-Python and missing-local-base attempts are also retained separately.

The existing 16/16 browser smoke and four production-invocation mutation/restore proofs retain their original execution provenance. No additional local browser or real-provider run was made during finalization, as requested. Earlier static/build evidence remains scoped to its actual inputs; no new native compilation or full local just ci PASS is claimed here. Hosted CI for this exact candidate completed successfully: 55 successful checks, 39 conditionally skipped checks, no failed or unfinished checks. See CI run.

Real-provider semantic evidence remains Claude 5/5 and Codex 5/5 on 0b31365: three history depths in Russian, an English conversation, Restart during streamed output and a later ordinary turn. Independent review found no invented progress, false absence of supplied messages or task execution in status answers. These earlier provider executions are retained evidence. Retirement evidence is protocol/session replacement plus durable success, not an independent OS process-tree measurement; queue overlap was not exercised.

Native default tests, both all-target Clippy graphs and the complete mesh result (3,857 passed, 23 ignored) retain their historical execution provenance. Finalization changes the NetEq source locator, with exact commit/tree identity independently verified; these older executions are not represented as new runs of the final native manifest. Local mobile remains SKIPPED_BY_OWNER.

All validation workloads used external memory/deadline/process limits, zero swap and confirmed cleanup. The agent did not restart or modify the working Buzz app, databases or installed binaries. The owner separately rebuilt and checked the app. The owner has now authorized merging this PR; no release or installation is part of this closeout.

Limits

Context telemetry is optional, may lag and is not billing usage. Claude capacity comes from unambiguous SDK metadata, preserving genuine 200k and authoritative 1M windows. Resumed Codex sessions retain their previous system prompt; fresh sessions receive current instructions. History discovery is bounded to 10,000 replies and reports incomplete coverage.

Restart does not undo files or work outside the managed process topology. A neighboring Unix background hold may delay replacement for up to ten minutes. Queued compaction is in memory; durable Started/terminal records preserve uncertain executions. After controller death an uncertain status attempt is not automatically rerun or published; a fresh Restart explicitly requests another attempt. A transport submission already sent cannot be retracted.

Language inference recognizes Russian, English or unknown. Provider tool rejection is not a universal native-tool sandbox. One earlier Claude finished-parent/live-native-child row remains owner-deferred; the previously untraced extra Codex follow-up remains qualified by its original evidence. Real macOS, Windows and ARM acceptance remains unverified here. Startup/idle-policy work in #7 and fan-out recovery in #25 remain separate. Refs #6, #7.

Accepted completion

• Final source review and affected behavior checks are complete, with the evidence and limitations above preserved.
• Hosted CI for 94d805f925c1f0d9ee959d5d8d7199ea4559322d is green.
• Human acceptance: the owner rebuilt the local app, reported it working, and requested completion and merge on 2026-10-20. Further improvements and any subsequently discovered bugs are separate tasks.
• Session continuity completes buzz-acp: resume agent sessions via session/load (SessionStore keyed by channel + thread root) #6; remaining startup/idle-policy settings in Desktop/buzz-acp: idle pool teardown is a hidden 15-minute constant; expose it per agent and refresh the idle clock on turn completion #7 and fan-out recovery in Relay silently drops fan-out frames under send-buffer backpressure; connected clients never recover the missed event #25 remain separate.

buzz-review-completed

[spiritabsolute]

Session controls and activity

Fresh synthetic browser captures of the final menu input later committed as c26e791a5. These illustrate the UI; they do not attest native-provider execution or human acceptance. The registered session-control and status browser workflows passed all 10 cases. Other validation limits remain in the PR description.

Controls beside an agent reply

A known agent retains recovery controls when optional session telemetry is absent.

Restart appears first

The warning is directly below Restart in the first menu. Descriptions use smaller text and a slightly darker color.

Choose the history depth

All three options explain what the new session receives. Entire thread explicitly retains the available history limit.

Compaction in progress

Typed activity updates one operation in place.

Compaction outcomes

Completed, failed and unsupported outcomes remain distinct.

[spiritabsolute]

Implementation work is complete at c26e791a5. The author rebuilt and restarted this candidate, reported positive initial manual results and requested completion. Additional workday testing is planned; a complete provider/platform matrix is not claimed.

• Scoped menu reviews passed, including the correction of a concrete contrast regression found during review. The final browser workflow checks the actual smaller/different-colored descriptions, keyboard and pointer behavior, permissions, routing and draft preservation.
• Current validation: 6,998 regular + 172 jsdom Desktop tests, 10/10 registered control/status browser cases, frontend checks, TypeScript and production artifact matrix passed. The current five UI captures are linked in the description.
• The final unchanged just ci completed with exit 69 at mobile-check: isolated DNS could not resolve pub.dev for the package advisory lookup. The source and locks were unchanged and the container/attach completed. It is no longer running, and is not a whole-CI PASS.

The updated description preserves the broader browser smoke failures, earlier native/provider source provenance, deferred Claude scenario and historical unexplained follow-up observation. The PR remains draft with these validation limits recorded; no merge or comprehensive completion attestation was applied.

[spiritabsolute]

Reviewed the current integrated branch and the two follow-up test fixes at 558f83ab3. The prior main-integration review remains applicable because the later delta contains test fixtures only: main's CLI attachment handling and the session-status/control commands coexist, and the composed patch registry validates.

No remaining source-review blockers were found in this scoped re-read. The history assertion now counts actual history reads, requires the exact three-request baseline and compares status enabled/disabled. Asynchronous working/reaction cleanup is excluded. The expired-command case loads chronological historical events before opening the thread; wire-shape, expiry, human-target and manual-actor assertions remain. No retry, deadline or product behavior was changed. Minimalism, elegance and correctness: 9/10 each.

All nine current session-controls browser cases passed without retries against byte-equivalent production UI inputs. Earlier complete ACP execution at c6170acbb passed 1,396 tests with nine skips; the current full package is being rerun inside unchanged stock CI. Current stock CI, full native mesh and current GitHub checks remain pending, so this comment does not attest merge readiness.

Known provider limits are recorded in the PR: Claude ACP can initially report a provisional 200k context denominator for a configured 1M model, and Compact's bounded 120-second budget includes waiting for a busy session. The observed busy timeout does not demonstrate a provider compaction RPC failure; successful completion is required before reporting success. Improving adapter window authority and queued-Compact feedback remains optional follow-up work, not a new source-review blocker against the agreed control contract.

[spiritabsolute]

Thread context controls

Browser captures retained from the recorded synthetic browser run, with frontend inputs byte-identical to candidate 0b31365b6a31e996955f9fb380ab2e9283b4832e. These images cover the menu layout; the separate validation report records provider and native coverage.

Context actions

After choosing a thread agent, the menu shows the selected agent, Back, Restart and Compact. Manage context sits immediately before mention management in the composer.

Restart history

The submenu offers From scratch, Recent history and Entire thread, with the existing restart warning and bounded-history guidance.

[spiritabsolute]

Final-build human acceptance — confirmed by owner

On 2026-10-20 the owner reported rebuilding the local app and finding it working, then explicitly requested completion and merge of PR #15. The accepted candidate is 94d805f925c1f0d9ee959d5d8d7199ea4559322d. This supersedes the earlier pending/deferred acceptance requirement below. Hosted CI for that candidate is green.

This records the owner's reported manual acceptance; it does not claim every checklist row or platform/provider combination was separately executed. Any later issues and improvements are separate tasks.

Historical acceptance checklist and its earlier status (superseded)

Final-build human acceptance remains open

Candidate: 0b31365b6a31e996955f9fb380ab2e9283b4832e. Agent checks and model traces do not replace a human app check. Build the feature branch for the platform you use and record the actual Desktop/ACP build, OS, provider and each result. The source-bound Linux ACP/CLI acceptance artifacts are not an installed Desktop package.

Use a disposable thread with an agent you can manage and harmless synthetic facts:

1. Leave a draft, attachment and mention choices. Open Manage context immediately before mention management. The first view lists eligible thread agents, including a single-agent thread. Selecting an agent exposes Restart/depth and Compact; Back/Escape sends nothing. Confirm draft, attachment, selection and mentions remain, including when the editor is busy.
2. Start with an English checklist assignment, then substantive Russian conversation about an agreed draft and verification not yet started. Exercise From scratch, Recent history and Entire thread. Without another message, each successful reset produces one short Russian task status using only its selected history. Missing progress stays unknown; it does not recover files or continue implementation. With Entire thread, include two distinct intermediate notes and confirm the status does not call either supplied note missing. Missing checklist requirements are different from missing messages. Reset acknowledgment and the later answer are separate outcomes.
3. In a separate English-only conversation, choose From scratch. Its automatic status is English. Check that the original thread remains unaffected.
4. Ask for a harmless longer fictional text without tools. Restart while real output is streaming. Check old work stops before the new status, then send a distinct ordinary request and confirm it is handled normally. A naturally completed turn is not a busy-cancellation check.
5. Open Compact through the new entry point and check the existing visible request/result flow. Record any unavailable provider or platform case as UNTESTED rather than PASS.

Report build identity, selected history, reset outcome, automatic answer/language, any unexpected task/tool work and PASS/FAIL/UNTESTED. The repository AGENTS.md requires: “A human then tested it themselves”. Keep this PR draft and omit the readiness attestation until the applicable final-build manual checks are explicitly confirmed.

[spiritabsolute]

Final-build human acceptance — confirmed by owner

On 2026-10-20 the owner reported rebuilding the local app and finding it working, then explicitly requested completion and merge of PR #15. The accepted candidate is 94d805f925c1f0d9ee959d5d8d7199ea4559322d. This supersedes the earlier pending/deferred acceptance requirement below. Hosted CI for that candidate is green.

This records the owner's reported manual acceptance; it does not claim every checklist row or platform/provider combination was separately executed. Any later issues and improvements are separate tasks.

Historical acceptance checklist and its earlier status (superseded)

Owner-deferred manual acceptance for 94d805f925c1f0d9ee959d5d8d7199ea4559322d

The owner explicitly requested removing draft now and will rebuild/check the local app later. This supersedes the earlier draft timing requirement. The manual checks below remain unperformed and unconfirmed; readiness does not attest their completion.

• Build and run this candidate. Open a thread with a managed agent, then Manage context. The agent row shows its profile avatar or initials, with the same treatment as mention suggestions. Selecting it opens that agent's Restart/depth and Compact actions.
• Request a new Restart. The first automatic status answer in the same thread displays the restarted session and selected history. It attributes Restart to the requester when that profile is available; otherwise the line remains neutral.
• When the provider reports current context occupancy, the first answer displays it. Unavailable occupancy does not produce an invented percentage or reuse retired-session data.
• Send a later ordinary request and check that it continues in the replacement session.

Previously signed messages are immutable; use a new Restart for this check. The automatic answer remains a short task-status response using the selected history. Final source review and scoped validation are recorded in the PR body; hosted CI is tracked separately. The working local Buzz app was not restarted or updated during finalization.

[spiritabsolute]

Thread before opening Manage context

Candidate 7d9f216ea: the thread head immediately before opening the picker. This pair shows two states of the current interaction.

Agent list after opening Manage context

The same candidate shows the profile avatar treatment used by mention suggestions. Missing images use initials. Both captures come from the passing browser smoke workflow.

The separate final-build human checklist is here. The PR remains a draft.

[spiritabsolute]

Final review of 94d805f925c1f0d9ee959d5d8d7199ea4559322d: PASS, with no remaining confirmed important or critical source finding. Runtime and UI reviewers traced authorization, exact scope/token/generation fences, cancellation and prepared-event retries, selected history, metadata projection and composer controls. Previous blocking findings were checked for closure. Minimalism, elegance and source correctness: 9/10 each after the corrections.

The hosted reaction-order failure was confirmed and corrected without relaxing chronology or spacing. The Windows dependency fetch failure was addressed by the public locator for the identical pinned NetEq commit/tree. Independent rereviews passed both changes. Selected finalization checks and retained full-package evidence are described in the PR body; new hosted CI remains a separate integration result.

The owner explicitly requested readiness now and will rebuild/check the app locally later. Those manual steps remain unconfirmed; this review does not attest manual completion. The working local app was not restarted and no extra local browser/model run was performed.

[spiritabsolute]

Accepted completion — 2026-10-20

Candidate: 94d805f925c1f0d9ee959d5d8d7199ea4559322d.

The owner rebuilt the local app, reported that it looks working, and then explicitly requested completion and merge. This supersedes the earlier deferred manual-acceptance status. No exhaustive platform/provider checklist execution is inferred from that report. Improvements and any later bugs will be handled as separate tasks.

Hosted CI run is complete: 55 checks succeeded, 39 were conditionally skipped, zero failed or unfinished. Final independent source review and retained package/provider evidence remain as documented in the PR body; historical failed attempts and limitations remain preserved.

The PR targets the fork's actual default branch, main. Merge is authorized for the exact candidate above. No release, installation, extra local browser/model run or restart of the working app is included.

[spiritabsolute]

Merged into main as 258fba8eb89a67451806b4ff4e984981d0432d13 after owner rebuild/acceptance and explicit merge authorization. #6 is closed; #7 remains open for its remaining startup/idle-policy scope.

The merged tree exactly matches the clean Git merge-tree result for the previous main plus the accepted candidate. Separate device-home changes already in main and their registry entries are preserved. Candidate CI is green; no new test run of the squash commit is claimed. No release, installation or restart of the working app was performed.