[sambitcreate]

Slice D of Bot chat activity: Bot chat activity on iPhone and Android, over Aiden Remote revision 30. Slices A, B, C1 and C2 (#475, #477, #476, #478) are already merged.

Plan: docs/superpowers/plans/2026-10-14-bot-chat-activity-d-phones.md. Every ruling (R1–R22), deviation and parked item is recorded in spec §11/§12/§17 and .memory/bot-chat-activity.md.

What changes for people

• Status line on phones. While a Bot works, iPhone and Android show the Mac's calm status line ("Getting ready", "Reading", "Using Notion"), with elapsed time after 20 s.
  • The elapsed time follows the turn's real start.
  • If the connection drops, the line says "Reconnecting to your Mac".
• Steer or Queue while busy. Queued messages show as faded "Queued" bubbles.
• Faces in Bots home. A working Bot's face glances. Under Reduce Motion or Low Power it shows a still badge instead.
• Chat activity page. Advanced → Chat activity on both phones, saved on each pick. It recovers from conflicts and opens offline from the cache.
• Instant actions (owner directive). Every phone Bot action is instant and optimistic, uses skeletons, and never waits to connect.
  • A send shows at once, as "Sending…", then Queued, then failed with Try again.
  • Unsent messages persist across leaving the chat and relaunching: 24 h, file protection or no-backup, purged on unpair or access loss.
  • Stop, Resume, Retry, Dismiss, answers and approvals apply at once and roll back if they fail.
  • New Bot, model pick, Advanced, Profile and Memory edits also apply at once.

Contract (revision 30, provisional; main is still 29)

• Opt-in. A per-device negotiable bot:activity, plus the bot-activity-v1 token. Phones that haven't opted in get a no-op state frame at the same seq, so legacy streams stay gapless.
• Activity frame. Exactly { phase, app?, startedAt }.
• Queued frame and snapshot list. Only the person's own inputs, via a fail-closed classifier and an inclusion filter.
• submissionId on the person's user entries, for exact reconciliation.
• whenBusy (steer or queue).
• Detail and PATCH chatActivity, stripped for non-holders on every detail route.
• Shared Stop/Resume intents. stopping, stopCancelled and resuming, so the Mac and phones agree.
• Remote ledger. It no longer records pre-execution state refusals, so a same-key retry works once the Bot is fixed.
• Fixtures, OpenAPI and docs/aiden-remote-api-v1.md are updated. TS, iOS and Android decode the shared fixture strictly.

Verification

• tsc, lint, test:ci-policy, test:bot-runtime (194), test:bots (820)
• test:aiden-remote: all pass except aiden-remote-service.test.ts "single-transport profiles lease…", which fails locally with AidenRemotePortInUseError. An unrelated outbound socket holds one of its fixed ports on this Mac; the file is untouched by this PR. CI is the arbiter.
• iOS AidenOnTheGoTests: 1005 passed, 0 failed, 6 skipped (device-only), run with -test-timeouts-enabled YES
• Android :app:testDebugUnitTest (892), :app:lintDebug, and Bot instrumented tests 12/12 on a headless AVD
• Owner: an end-to-end run against a real Mac on this branch, plus VoiceOver and TalkBack passes

Known open items (spec §17)

• Android: the fixture null-literal raw-null guard.
• Android: Bot create still waits on the form instead of showing an optimistic Home row.
• iOS: the Files sheet still uses a spinner.
• Android: inline error text contrast in some light themes.
• Cosmetic: overlapping failed Stops.
• At merge, revision 30 must be re-claimed if main has moved past 29.

CI notes

• Run 38664812492: tests/e2e/chat-message-queue.spec.ts:584 "Stop after revisiting cancels the detached response and permits a new message" flaked. The first attempt timed out after 10 s on expect(stop()).toBeEnabled() (element not found) at line 617, then passed on retry Use catalog-driven runtime model limits #1. The "Linux x64/arm64" gates failed downstream of it. The same spec flaked at line 481 on Bots: Bots-only sidebar and the Bot side panel (bot chat activity C2) #478. It predates this stack: the same specs failed on Oct 9, 10 and 13 (runs 38020507256 and 38452403485), so C2 did not cause it. It has not reproduced in about 1,300 local runs plus 360 Linux/xvfb runs. This PR fixes two real bugs in that path: a window's own run was mirrored back as a phone run after Stop (69f5c2f), and Steer/Queue failed while a response was starting (4813a5c). On failure the spec now prints on-screen errors and app error logs (a702a26), so a future failure names its cause. The whole spec passed 570/570 with --repeat-each 30 and --fail-on-flaky-tests. No retries were added and no timeouts raised.
• The core-git EPIPE race in scripts/worktree-file-io.test.mjs (seen on Bot chat activity 3/5: Extract a reusable workbench shell from the environment panel #476 and Bots: Bots-only sidebar and the Bot side panel (bot chat activity C2) #478) is fixed in this PR.

Built task by task with subagents. Each task went through its own review and fix rounds, then a final whole-branch Opus review and a final fix wave, with each part re-reviewed.

🤖 Generated with Claude Code

[pullfrog]

Important

The new Create recovery can target the wrong Mac, replay an expired operation, or lose its retry identity across a crash. These need fixes before merging.

Reviewed changes since 7744dd3, covering the complete incremental artifact, affected full-diff regions, and their host/native consumers. This focused delta review relies on the initial whole-PR review for unchanged implementation rather than repeating the 98-file review.

• Added durable Create recovery on both phones, retaining answers, frozen requests and idempotency keys across relaunch, with pairing-local storage and cleanup.
• Changed Android New Bot to close immediately, show a Creating row on Home, and offer retry/reopening after failure.
• Separated Android optimistic cache state from confirmed disk writes, rejected the shared fixture's optional null literals, and improved Bot error-text contrast.
• Preserved iOS Chat activity picks during timeout recovery and reported confirmed saves when the sheet closes directly from that page.
• Replaced iOS Files loading with skeleton rows, bounded held test saves, and contained editor-test pipe errors.
• Verified available checks: passed 47 host Bot/ledger tests, 20 Ruby and 30 Node iOS release-policy cases, and syntax parsing of eight changed Swift files. Independently confirmed that the default host ledger executes an identical Create key again after 25 hours.
• Checked native verification limits: local XCTest is unavailable without xcodebuild; Android stopped at Plugin [id: 'org.gradle.toolchains.foojay-resolver-convention', version: '1.0.0'] was not found, and the online retry returned Tool 'shell' timed out after 120000ms. The exact-head hosted Android verification step succeeded; Compose execution was still running and iOS was queued when checked. The worktree IO suite returns early on Linux, so it does not verify the EPIPE change here.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[pullfrog]

✅ No new issues found in this delta. The three previous findings are addressed; exact-head native CI is not yet complete.

Reviewed changes since 9c35409, covering the complete seven-commit incremental artifact, affected full-diff regions, and relevant host/native consumers. This focused re-review relies on the initial whole-PR review for unchanged implementation rather than repeating the 98-file review.

• Added disk-before-network barriers: Both phones now require successful persistence of the exact Create request/key before sending, including recovered retries, and report write failures without sending.
• Isolated pairing authority: Checked iOS per-pairing attempts/failures, cancelled or stale restore rejection, and retry-origin validation; checked Android persisted pairing identity and client-ownership fences during installation switches.
• Bounded ambiguous Create replay: Checked the 23-hour replay window against the host's 24-hour retention, expiry while a prompt remains open, preservation of answers without unsafe keys, and explicit new-creation intent after expiry.
• Preserved busy retry answers: Checked that an iOS Try Again rejected while another Create is pending retains its recovery state for a later retry.
• Verified available checks: Passed 47 host Bot/ledger tests, 20 Ruby and 30 Node release-policy cases, and syntax parsing of all four changed Swift files. These do not execute or type-check XCTest; this Linux runner lacks xcodebuild.
• Checked Android and hosted verification: Local Android tests stopped at Plugin [id: 'org.gradle.toolchains.foojay-resolver-convention', version: '1.0.0'] was not found; the dependency-enabled retry returned Tool 'shell' timed out after 120000ms. The exact-head Android verification step succeeded, while Compose execution remained in progress and the iOS job remained queued. This review does not establish green overall CI.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[pullfrog]

✅ No new issues found in this delta. Exact-head CI is still incomplete.

Reviewed changes since 492eb1a, covering the complete four-commit incremental artifact, affected full-diff hunks, and lifecycle/admission/composer consumers. This focused re-review relies on prior reviews for unchanged implementation; commit artifacts supplied patches omitted from the full diff.

• Preserved run ownership after settlement: Checked that delayed observer updates cannot mirror this document's own run after detached cleanup, while subsequent phone/window runs remain visible.
• Enabled Steer/Queue during startup: Checked completion at the durable append and bounded admission retries, including Stop, terminal, committed-refusal and unknown-outcome boundaries.
• Improved failure diagnostics: Reviewed bounded notice/log output and the queue spec's focus and saved-reply assertions.
• Verified available checks: Passed 133 focused tests, project and E2E type-checks, and changed-file lint; collected all 19 queue specs. Electron execution requires macOS under the repository's E2E skill, so collection does not establish runtime acceptance. Exact-head CI remains pending.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[pullfrog]

✅ No new issues found in this delta. Exact-head CI is still incomplete.

Reviewed changes since f7b919c, covering both new commits, all four changed files, and their cancellation, persistence-recovery and send-path consumers. This focused incremental review relies on prior reviews for unchanged implementation rather than repeating the 111-file review; commit artifacts supplied the three Pi patches omitted from the full diff.

• Distinguished Stop from write failure: Checked the exported cancellation classifier and once-per-stream info logging while preserving unhealthy-journal marking, real-failure error logs, and rollback/resync recovery.
• Extended journal recovery coverage: Checked cancellation during streaming, detached-write settlement, exact lease rollback and visible-history reconstruction, plus the existing fail-closed write-failure case.
• Corrected transition-test expectations: Checked that the existing assertions follow the non-awaited generation start and guarded asynchronous error callback without changing production send behavior.
• Verified focused checks: Passed 287 tests across seven harness, durability, compaction and renderer suites, project type-check, and changed-file lint. Four initial compaction failures were resolved by building the required VCC worker before rerunning that suite; Electron and native mobile execution were not performed for this desktop logging/test-only delta. Exact-head CI remains pending, so this review does not establish green CI or merge readiness.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[pullfrog]

✅ No new issues found in this delta. Exact-head CI is still incomplete.

Reviewed changes since fee9ae3, covering the complete one-commit, one-file delta and its composer, send-lifecycle, IPC-handler and mock-provider consumers. This focused incremental review used the authoritative incremental/full-diff hunks and commit artifact, relying on prior reviews for unchanged implementation rather than repeating the 111-file review.

• Added separate receipt gates: Held the first-message save and generation-start acknowledgements independently, checking attachment intake stays closed before save acknowledgement and reopens while start acknowledgement remains held.
• Preserved queue and Stop coverage: Queued image and text follow-ups during the held-start window, then retained the checks that Stop leaves both paused without sending either to the model.
• Verified available local checks: Passed E2E type-checking, changed-file lint, collection of all 19 queue specs, and 60 focused attachment/composer, queue and transition tests. These checks do not execute the changed Electron test; Electron execution was not attempted on Linux under the repository's macOS-only E2E guidance. Exact-head CI was queued when checked, so this review does not establish green CI or merge readiness.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}