Repository navigation
Continue a usage-limited chat with another account or agent - #31241
brennanb2025 wants to merge 18 commits into
Conversation
|
October 25 reset-gated Continue review: The delta review fixed two timer defects: a mounted row used an old clock after its reset changed, and supported monthly resets exceeded the timeout limit. The row now reads current deadline eligibility and uses one bounded boundary timer, refreshed on render, focus and visibility changes. No scheduled retry or saved state was added. Independent correctness and copy/performance reviewers verified both fixes with no new findings. This is source round 6, including fix verification; the earlier five rounds remain recorded. Verification: both targeted renderer suites passed, 56 tests. Coverage includes just before/exact reset, unknown reset, replacement/remount, forward/backward clock correction, cleanup, and timer-operation bounds at 1 and 10 mounted rows. The required pre-commit hook passed. The shorter row copy is intended alongside #33392; the existing “Use it once the limit resets” explanation remains true after the action appears. For Brennan’s review — branch renderer fixture, no agents: Before the reset:
After the same row reaches its reset:
The actual notice row and production styles rendered in a hidden Electron fixture on the M4Air. Before 00:12:36.986 UTC, Continue Now was absent; at 00:12:37.333 it was visible. Hand Off stayed visible and enabled in both frames. DOM receipts record the same element, one mount, no unmount and no action calls. A separate unknown-reset assertion kept Continue hidden. Switch Account was unavailable in this declared fixture; its unchanged path is covered by the renderer/source review. Fresh checks found all six recorded launch/listener/keeper PIDs absent and ports 9460–9479 clear; ticket 2437 is released. One monitored Claude configuration hash changed with unknown attribution; contents were neither inspected nor restored, and the other monitored hashes matched. Earlier accepted real-agent evidence below remains carried from Not ready to merge. Current-head CI fails because the unchanged October 24 targeted recovery retry complete on
The source fixture initially auto-loaded its opening because 180 genuine Bash calls collapsed into two short groups. One real neutral 80-line reply fixed the recent-tail height; the new readiness prompt and reply did not repeat the probe. The separate older-message rail still indexes the opening preview by design. That outline was not passed to Codex; the transcript body/tail checks and recorded destination inputs distinguish it from loaded-tail recovery. An earlier plan incorrectly required the outline to be absent and stopped before hand-off; that setup requirement was corrected. Both app launches stopped gracefully. Final cleanup found no survivor among 58 recorded owned process identities and no assigned-port listeners. Command overrides were reset, hooks remain enabled, Chat UI was restored off, and both replay arms are absent. All 75 selected evidence files passed independent size/hash and exact-file-list verification. Ticket 2151 is released. Hash-only checks found changes to real The quota events were declared success-bound replay fixtures; agent replies, native-file reads, and UI actions were real. The destinations’ raw JSONL output was truncated; successful subsequent parsing and opening-message reads are retained separately. The focused-adoption workspace scan returned exit 1 because the directory had no files; the original-file reads succeeded with exit 0. Beyond-tail Full hand-off from the quota row:
Real Codex recovery of the beyond-tail fact:
Focus B retained while the source-A Full hand-off targets A:
Real adopted-source recovery reply:
Ordinary adopted Chat Settings has no saved-directory editor:
No source changes, sync, retarget, completion marker or final-head reference claim were made. Final base sync and CI remain with the lane owner. Historical results below (the two setup gaps above supersede their earlier incomplete verdicts): A native chat that reaches a usage limit needs a clear way to continue. This PR adds Continue Now, account actions on the chat's host where supported, and Hand Off to Another Agent using its saved transcript or recent messages. October 23 targeted QA result: incomplete; no PR-specific defect demonstrated. This run used exact head
Four targeted recovery/ownership contract files passed 53 tests. All driver phases exited. The app stopped gracefully; the headless old host stopped through its recorded helper identity. Cleanup found no survivor among 40 recorded owned processes, ports 9420/9421 were clear, Command overrides were restored, replay arms absent, and real Claude/Codex config hashes unchanged. Ticket 2019 is released. The source checkout remains clean. The source review remains five rounds. No new fix, main/base merge, retarget, completion marker, final-head reference comparison or readiness claim is made. Final dependency sync and its CI remain with the lane owner. Strict beyond300 and incidental/focus variants remain evidence gaps. Older-host proof: the current client offers focused context and disables Full when the old host supplies no native path.
Older-host real Claude reply:
The independent evidence audit verified all 50 payload files against the manifest with no missing/extra files or size/hash mismatch. Original-file access and real replies are supported; the coverage limits above remain. The adopted reply screenshot was inspected locally; its upload failed. Historical review and QA evidence (earlier pending statements are superseded above): A native chat that reaches a usage limit needs a clear way to continue. This PR adds Continue Now, account actions on the chat's host where supported, and Hand Off to Another Agent using its saved transcript or recent messages. October23 update: targeted QA proceeds on The current QA table requires CI and renderer tests for UI and Settings, plus a quick branch screenshot where appearance changed. It does not require real-agent rounds for those changes. The extra Stop/Interrupted/Continue, saved-unlisted-choice restart, roster and Accounts-routing rounds are therefore dropped; the PR changes only the Continue label, supplementary recovery facts and UI/navigation in those paths. Existing tests and branch screenshots cover their changed behavior, with any missing screen captured without agents. Controlled-delay experiments remain unavailable and are not a required agent round for the UI rows. The remaining real checks are the older-host recovery hand-off, hand-off from a transcript beyond the normal loaded window, and recovery from genuine adopted/incidental-directory state. The OpenCode transcript-import flow already passed on this exact head: real source context, recent-message hand-off without a database path, then a real Claude context reply. It will not be repeated. No completion marker or final-head comparison is claimed. Dependency sync and its CI remain with the lane owner. The evidence below is historical; targeted results will be added to this same comment. When a native chat reaches its usage limit, account switching and conversation hand-off are elsewhere in the app. This PR puts those actions beside a manual Continue Now retry on the warning row. It does not continue automatically. Not ready to merge. Five source-review rounds are complete on Source review corrected account destination checks, unnecessary filesystem scanning, stale hand-off requests, roster updates, native Windows account navigation and native transcript admission. QA found two further failures: Claude Agent Teams remained selectable despite sharing Claude's usage limit, and a chat without a pinned launch directory could omit its readable transcript. The row now excludes the source agent's launch modes; ordinary History hand-offs retain their choices. Transcript lookup uses the owning host's existing directory resolver. That correction failed with the old expression and passed afterward; three named test files passed all 16 tests. Independent review accepted both corrections. Reviewed QA reports and production metadata establish bounded results on the M4Air, using genuine saved state created by the stacked base and carried through full app-and-daemon restart. Selected screenshots have also been independently checked; the builds remain distinct:
The integration packet and selected production/native metadata have been independently transferred, checksum-verified and reviewed. Four selected integration screenshots have also been checksum-verified and personally inspected. These are results from a separate build, not exact- Usage-limit events were explicitly replayed through real-agent forwarding; subsequent actions and replies were real. No natural account exhaustion is claimed. The Codex audit retains its user-message frames before the replayed refusal. These subsets do not certify the remaining flows or replace final-head QA after another source change. Managed-Claude sign-in initially failed to save, and another authorization timed out. Independently transferred callback/save receipts now establish two saved, distinct subscription OAuth accounts. Selected real-user security preference hashes stayed unchanged in the supplied before/after receipts. Direct account-switch functional evidence is now accepted on private integration The same integration's ordinary History Full session transcript hand-off started a real Codex destination. Checked production metadata shows the destination read the original native file successfully, then answered a neutral source-marker question; neither user prompt supplied the answer. Its settled reply screenshot was personally inspected. This covers that History consumer, not beyond-loaded-tail recovery or a quota-row alternative-agent test. The integration Pi reply is now independently supported by the transferred driver report and personally inspected screenshot: the real source answered the inventory question and its marker. Native and positive closure metadata, plus a successful harness receipt, establish existing-file admission, missing-file rejection, and restoration/readmission of the same inode and file hash through the production recovery function. That function file matches exact The earlier paired Claude source request failed with an actual upstream capacity limit before replay; the forwarder preserved that failure and emitted no quota frames. The single authorized retry after the reported reset succeeded. Checked source and emitted terminal frames bind the same native conversation and user request: genuine completion was followed by one synthetic quota replay. The actual row showed Continue Now and Hand Off only, using the peer’s zero-account roster while this computer had two managed accounts. A Full native-file hand-off, cancel/reopen, and Start reached a real Codex destination on the same paired host. Selected actual native and tool receipts establish the original source-file read with exit 0, correct owning home/directory, The earlier older-host attempt produced ordinary Codex replies but no verified quota recovery. That historical gap is partly covered by the newer bounded run below; a real alternative-agent reply is still missing. A hidden local Accounts page stayed at one rendered account after the lead added the second through the API. That bypassed the normal UI completion runner, which refreshes local settings, so this observation alone does not establish a user-facing refresh regression. Normal Add completion/return remains unverified. The observer’s long passive timers and the owned test app requiring a verified root-only forced stop are retained as QA setup limitations, without a performance or PR-cause claim. A local recognized Codex terminal source reached an editable, unsent Claude draft and then a real reply after one explicit Send on integration The preserved integration folder-source experiment has now reached a real destination. Its genuine OMP source retained the same native conversation and existing replayed usage-limit row. Full session transcript hand-off started Codex in the original nongit folder; the actual completed read returned all 9,395 bytes of the original native file with exit 0 and a matching digest. Two successful destination turns include a neutral question whose prompt omitted the private marker and inventory answers; the reply supplied both. The original source inode, size, modification time and hash stayed unchanged. Recovered source-specific original and emitted frames bind the earlier genuine successful source turn to its substituted quota result; no new replay was needed. This is private integration The same completed-reply screenshot shows Indexed Session History reporting Codex as zero messages with no preview. Actual destination turn and native metadata establish two successful replies; the stale index display is an unexpected candidate bug, with no data-loss or PR-cause conclusion. The transferred main Floating setup first reached the existing picker-trust boundary and restored the prior setting. An explicitly approved offline QA fixture then changed only the stopped QA profile’s saved trusted-directory key; other profile domains and the existing source/journal hashes stayed unchanged. This is not native-picker UI coverage. The final receipt records restoration of only that trusted-directory key after writers stopped; the journal and three selected native files retain identical inode, size, modification time and hash across restoration. Unrelated settings and profile-domain preservation remains receipt-attested. This is not a whole-profile restoration. The independently transferred, checksum-verified packet now supports a genuine floating OMP source at directory A, a real reply and replayed quota, followed by selecting project B while the source remains visible. Some final default/focus readbacks remain report-attested. Its Full context path and start directory remain A. Structured destinations are disabled with “No chat in a subfolder”; the enabled real Codex CLI route reached a settled dialog but did not start a destination before its cutoff. The driver was stopped 17 seconds late; checked receipts support exit 130 and absence of its four recorded processes. The guard transaction itself remains report-attested. The disabled-choice policy exists on inspected main source, but this particular observation is not yet attributed. No completed floating consumer reply is accepted yet. Adopted and incidental-pin variants remain outstanding. The final QA worker reported failed/incomplete. The transferred archive and every content file passed byte/checksum and exact-file-set verification. Checked cleanup receipts show all 216 recorded QA processes exited, 32 supervisors absent, assigned ports clear, and approved QA security artifacts removed; genuine profiles, journals and native histories were preserved. The ticket expired while final evidence was being accepted, after the recorded app cleanup. A fresh Mac QA run has started to cover the remaining flows. A normal read-only journal inspection failed after shutdown; a static immutable read-only inspection then opened the preserved journal without repair. This is an inspection limitation, with no data-loss or PR-cause conclusion. The source usage replay started ten seconds after its internal cutoff, and the driver stopped about four seconds after its target; neither extends the evidence into an unperformed flow. The preserved managed-account identities are still listed, but installed Claude reports both QA homes signed out after removal of the dedicated QA keychain. Earlier actual sign-in and local account-switch evidence remains accepted. A local Claude settings card with no existing environment variables did not expose an editor for adding the first one; source inspection confirms the remote-host editor is available. The isolated-source hand-off is now accepted on private integration Keeping a paired-server chat visible while a different local workspace is focused is not reachable in the shipped UI: switching workspaces hides the peer pane, while floating chats belong to the local host. The remaining ownership checks cover the reachable arrangements: a local floating chat while a paired workspace is focused, and the ordinary paired chat’s account actions against its actual host. Those checks still require real replies; the unreachable arrangement supplies no pass or waiver. The dialog screenshot also shows overlapping label text, without settled-state timing proof, and the completed reader's History entry shows zero messages/no preview. Those observations retain no demonstrated PR cause. The bounded genuine long-context fixture failed its measurement: the real agent read the allowlist and checked only one of 215 requested artifacts, then stopped and proposed batching. The verified packet and independent audit support only 20 decoded items, 14 composed items, no older page and the early fact still present after a normal reload. It stopped before a new quota replay or reader; this supplies no beyond-loaded-context acceptance and no PR-failure conclusion. The driver exited normally and its five recorded process identities were absent; a final supplement now contains the literal named Playwright closure receipt. On the older server, selected native and gateway receipts bind the real Codex completion to its preserved conversation, unchanged model and effort. The transferred screenshot shows the rendered reply. Literal normal-UI readbacks support restoration of both original commands, arguments and environment at 01:40:59Z; selected persisted settings agree. The driver exited normally at 01:42:09Z, its four recorded identities were absent and the named browser session closed. That attempt ran no quota recovery. The newer run below verifies the older-server row and delivered recent-message fallback; the alternative-agent reply remains incomplete. The original 01:36Z restoration deadline was missed; the later prospective extension does not erase that QA boundary failure. The separately registered OpenCode 2 flow was not exercised: its first version-probe output was lost to an evidence-capture assertion before any driver, source or settings change. One authorized corrected read-only probe saved exit 0 and literal The latest floating/peer packet also exposed two report discrepancies: a screenshot contained an existing conversation despite prose saying no chats were open, and recorded handback occurred earlier than its prose timestamp. These are evidence-boundary corrections, not additional test coverage. Floating History also showed “Unavailable worktree / No active worktree matches,” and a settings pane stayed blank until renderer reload; neither has a demonstrated PR cause. An earlier QA driver inspected a global process listing outside its assigned CDP scope and printed an unrelated command identifier; no secret output, real-home file read or process mutation was observed. The lead was instructed to stop it using its verified recorded process identity, and subsequent drivers are restricted to CDP. Raw diagnostic logs stay private. No readiness claim relies on that diagnostic work. The latest Mac worker settled failed/incomplete. Its final archive and all 52 content files plus the manifest passed independent byte, checksum and exact-file-list verification. Transferred individual receipts support final app, daemon and driver exits, clear assigned ports, named browser closure and the limited trust-key restoration above. The final report summarizes a broader 102-identity sweep; that total is not an individually transferred final sweep. Own prior QA keychain/password paths are recorded absent; preservation of the remaining genuine profiles and histories is worker-reported. The original cleanup reserve was exceeded before final absence was verified. The transfer helper also exited and closed its terminal; QA ticket 1238 was released after the recorded cleanup and helper exit were accepted. No completion marker is added. The next older-host run is now checksum-verified and reviewed: stacked-base server Selected settings readbacks match the originals, including absent override keys. Full production journal folds show no pending or queued submissions in the source or failed destination. Literal receipts support the old-server and driver exits and named browser closure; other recorded process dispositions and port clearance remain receipt-attested. That client was retained for the subsequent setup checks and has now been stopped; bounded cleanup is recorded below. The 29 content files and manifest passed exact-file-list, byte and checksum verification; the quota, picker and failure screenshots were personally inspected. No completed marker is added. The independently registered OpenCode 2 remains unexercised after a bounded setup diagnosis. Its installed version is verified, but no compatible sign-in route under the isolated QA home was established. Read-only machine database counts describe only the saved checkpoint while a write-ahead log exists; they prove neither valid current sign-in nor its absence. No credentials were extracted or copied and no shared database was opened for writing. The selected diagnosis packet passed byte, checksum and exact-file-list verification. This is incomplete setup, not evidence that authentication or this PR is broken. The required beyond-loaded-history test also remains unexercised. Initial setup correctly rejected the plain test folder as a Git repository; one corrected attempt opened it through the supported folder route. The actual Claude launch opened an ordinary terminal at default Opus 5.5/medium, without confirming the required 1M model. The driver cancelled without changing model or effort and stopped before any source message or the 180-call fixture. Both saved structured records in this packet are Codex records, so the Claude native-chat surface and its normal composed 300-item window were not measured. No source reply, history-boundary, quota recovery or destination-read acceptance follows. The 22 content files plus manifest passed byte, checksum and exact-file-list verification; three whole-window screenshots were personally inspected. That continuation settled failed/incomplete and its QA ticket was released after cleanup acceptance. Selected raw guards document the owned client and daemon shutdown; the targeted process receipt found all 48 recorded identities absent at 04:12:02Z, and the assigned 9420–9439 listener check found no listeners. This does not claim every unrecorded descendant or ephemeral port was enumerated. All three named browsers closed and their drivers exited normally; driver exit does not mean a tested flow passed. The two old-host and two client structured records had no pending or queued submissions; the Claude terminal queue API remained unavailable. Genuine profiles, histories and folder metadata were preserved according to the selected disposition; prior command-restoration evidence remains separate. Final hash-only comparison found the real Codex configuration changed with unknown cause; no contents were inspected, copied or restored. Existing reconnecting/history warnings, global Connecting while Local was selected, an automatic unsent Codex draft, an empty Quick Command draft and console errors were observed without an established PR cause. Required remaining flows are unwaived. Full exact-head PR checks were reverified green, and GitHub still reports this reviewed head clean and mergeable; these facts do not replace missing QA. The preserved floating-source hand-off now has a further bounded result on private integration Group 4 remains incomplete. The first reliable Settings-page readback of the different default folder came after Start, although its production setting value was captured before Start. Genuine adopted-source and incidental directory-pin variants, ordinary paired account controls, native-picker interaction and a different previous-build creator remain unverified. Default-folder and directory-trust setup used declared test fixtures. The driver exited and its named browser closed; the test apps were retained idle for separately gated checks, so final process shutdown and trust-key restoration are still owed. Unexpected observations were a generated non-git diagnostic followed by successful file reading, copying the last QA reply to the clipboard, and History labels/previews differing from the open source. The driver briefly explored History/tab menus after a hold instruction; that scope deviation produced no adoption, pin change or additional hand-off, and is not coverage. No PR cause is inferred. A diagnosed driver-bootstrap issue was handled with one documented private timing correction; the installed tool and PR source were unchanged. Group 5 remains incomplete. A read-only check found no genuine choice saved by an earlier build that is absent from the current model list. The inspected floating OMP chat kept Gemini 3.1 Pro Preview/high/1M; that exact model was listed in its source-bound production options and shown selected in the normal model menu. The returned catalog was not newly refreshed, and source and reader were both private integration Group 6 remains incomplete. On private integration The 60 content files plus manifest passed exact file-set, byte and checksum verification, and an independent audit agreed with these limits. Five whole-window images were personally inspected. Normal Settings UI and leave/reentry receipts establish restoration of the temporary OMP command; the floating chat covers that field in the restoration screenshot. Selected settings equality is receipt-attested. Both drivers exited, their named browsers closed and five recorded targets per driver were absent. Final rig shutdown and restoration of the temporary trusted-directory key remain under separate cleanup validation. History changed from Local Mac/All/23 entries to the paired workspace/4 entries without direct History interaction; cause remains unknown. The 27 current-epoch session audit folds report no pending or queued submissions under an explicitly separate reviewed-head reducer; terminal queues remain unobservable. None of these results completes the missing loading, account, upgrade or ownership cases. The final Mac continuation settled failed/incomplete, and QA ticket 1333 was released after cleanup acceptance. The final archive and all 59 content files plus manifest passed exact file-set, byte and checksum verification; independent review found no blocking cleanup mismatch. Receipts show 80 recorded process IDs absent, the assigned ports clear, all four databases unused, and no remaining write-ahead or shared-memory sidecars. The first child-stop batch lost its partial signal receipt; those actions remain unknown. The replacement procedure used three freshly guarded root stops. Two later helpers stopped before opening a database because of timestamp precision and a normal native shutdown append; their failed receipts are preserved. One approved SQLite open/read/close removed empty sidecars without changing the journals. The temporary trusted-directory key was then restored with an exact revision check; the original settings content hash, other settings, other profile domains and native history were preserved by the checked receipts. Genuine profiles remain in place. Hash-only checks found changes to the real Codex configuration and installed QA driver with unknown causes; their contents were neither inspected nor restored, and the approved private driver copy stayed unchanged. These are bounded cleanup results, not missing functional coverage or a ready verdict. Account sign-in completion and repeated switcher testing waived by Brennan (October 22): “Why do I need four claude sign ins??? Isn't this reusing this existing claude switcher? This doesn't need to be tested if reusing the same code”. The row reuses the existing account list and switch action, and Add completion uses the existing sign-in flow. The earlier real managed switch 1→2→1 with real replies remains accepted. The repeated human sign-in batch is cancelled; these waived checks are not reported as newly passed. Remaining checks need no sign-in: row Add opens local Accounts at the add entry; paired Manage and Add where shown open Accounts on the chat's owning host; the row Switch list matches the status-bar switcher. The latest routing-only Mac attempt on private integration The final Stop-only attempt on private integration Further functional QA is on hold until #30955 merges and this PR is retargeted and synced with main. The remaining driver steps, prerequisites and exact pass criteria are prepared for that final head. No new app, machine ticket or worker will start before the lane owner’s signal. Existing integration results remain preliminary; mandatory unexercised flows keep this PR not ready. Other outstanding coverage includes the older-host alternative-agent reply, paired Accounts routing and account-list parity, remaining OMP ownership variants, cold/stale-owner/roster and cancellation paths, and Windows/WSL. Context beyond the normally loaded conversation remains unproven: the required earlier fact must be absent from the renderer’s normal composed 300-item window, then available to a real destination through the native file; raw file-line or DOM counts do not establish that. Requested unlisted model aliases normalized to a listed model before sending, so those attempts do not prove alias continuity. Grok and Antigravity code are unchanged by this PR; their separate sign-ins and runtime installations are outside this QA scope. Only the repeated account sign-in/switcher checks described above are waived by Brennan; the other required changed flows remain unwaived. Inherited observations remain separate: STA-11573 covers loss of an untouched hand-off draft after full app-and-daemon restart on main; STA-11589 covers generic context wording when no transcript file exists; STA-11590 covers an actual OpenCode quota error classified as a generic error; STA-11596 covers a delayed generic-dialog layout shift. These are not repaired or silently accepted by this PR. Source identity, rather than a second main UI run, establishes the latter classifier/layout inheritance. The unrelated socket-test flake was repaired in merged #31520. Database-backed chats passing recent messages is a temporary limitation tracked in STA-11454. File-backed chats intentionally pass their existing live native file, with no export or snapshot. Account selection remains scoped to the chat's host and requires an explicit Continue; a Claude hand-off opens an editable draft requiring Send. Merge #30955 first, then retarget this PR to main. #30982 is also required. No completion marker is claimed. For Brennan's review Main
Current-head warning row (exact
Current-head OMP native-file hand-off, after explicit Send to Claude, with a real context reply:
Private integration
Private integration
Private integration
Private integration
Private integration
Private integration
Private integration
Private integration
Older stacked-base server
Older stacked-base server
Private integration
Private integration
Private integration
Private integration
Private integration
Private integration
The three judgment points are the reset deadline and shortcut, owning-host transcript directory, and chat-owned Accounts visit. |
ELI5
When a chat hits its account's usage limit, its warning row only offers Continue. Using another account or handing the work to another agent requires leaving the conversation and finding those actions elsewhere. The row now offers an account action when this open chat can follow the selection and Hand Off to Another Agent, plus Continue Now once the limit's reported reset time has passed. Before the reset, or when the provider reports no reset time, Continue Now stays hidden because the same limit would refuse the message; after switching accounts, the next message the person sends continues on the new account.
What Changed
The warning keeps its reset time and adds “Continue this chat without waiting:” followed by small outline buttons. Switch Account opens the existing account menu. With one signed-in account on this computer, Add Account… opens this chat’s native account settings. A paired host with at most one signed-in account offers Hand Off only; eligible paired hosts with two or more still offer Switch Account. Hand Off opens the existing dialog using this chat’s title and owning workspace, with a different available agent selected. File-backed sources pass their existing admitted native transcript; database-backed sources pass recent loaded chat messages. Full saved history for database-backed sources is a temporary limitation, tracked in STA-11454. No export files or retention mechanism are added. Without another available agent, Start is disabled. A Claude destination remains an editable draft that requires Send; other agents keep their existing submission behavior. The execution host resolves the file through the same account-scoped transcript importer used to open a chat in the command-line interface. The row reads the current options response on click so a newly created chat gets its saved transcript too. Older hosts or providers without a saved path use loaded chat context, labelled as chat messages. These controls disappear with Continue Now once another message is sent, and loading controls remain disabled.
Account eligibility comes from the chat's host: it verifies that launches follow account selection and that this conversation's projects store is shared with System default and every native account destination. An isolated or unverified store offers Hand Off only. Shared custom folders remain eligible. The options response carries optional canSwitchAccount and transcriptPath fields; neither is saved, and older peers safely omit or ignore them. A fresh eligibility read before each switch covers new roster destinations. Ordinary options reads outside a stopped usage-limit turn do no recovery discovery; lookup remains outside send/Stop serialization. Mounted paired rows observe their host’s account roster. A single current hand-off request prevents a late response reopening a cancelled or superseded dialog. Codex and OpenCode offer Hand Off only on this dependency base. The existing account menu, switching action and settings navigation target the chat’s host, including paired servers. Add and Manage open its native account view even when Windows Settings normally prefers WSL; explicit account-location choices and ordinary Settings visits retain their existing behavior and defaults. Chat-row switches skip terminal restart offers. The account slot keeps a fixed width through loading, Add/Switch labels, and ineligible states so Hand Off does not move; switcher instances are keyed to their owner. The phone stays unchanged. No automatic continuation, saved field, new operation, or new runtime capability is added.
Why
Changing the selected account helps only if this exact conversation will use it. Reading the host's per-chat proof keeps the button honest for shared and isolated history, including with older servers. Reusing the existing account menu and hand-off dialog keeps their sign-in, switching, and launch behavior consistent. The common pattern derives recovery controls from the current stopped turn; the extra row entry points are an intended difference: the common pattern offers those workflows from a composer picker or plugin, while Orca's existing equivalents are the status-bar account switcher and hand-off dialog. Brennan chose the row to reach them. Account recovery keeps Orca's existing native resume and separate explicit hand-off, an intended mechanism difference from the common pattern that preserves the approved conversation behavior. Passing the saved transcript file is an intended transport difference that reuses the existing agent launch flow. Automatic retry and scheduled continuation are excluded by the approved product scope.
Linked Issue
Follow-up to the usage-limit warning introduced in #30396, tracked in #30955 for moving open chats to the selected account.
Visual Proof
The review status comment contains the accepted real-agent evidence carried from
8fe9e7e030eaand before/after reset screenshots on323e395a842. The new images use the actual notice row in a declared hidden renderer fixture, with no provider or agent run. Final dependency sync, CI and readiness remain pending.Testing
Review
Five original source-review rounds and the incremental reset review (round 6, including fix verification) are complete. The reset review fixed stale mounted-clock eligibility and timeout overflow for supported monthly resets; two independent reviewers verified the fix at
323e395a842with no new findings. Both named renderer suites pass 56 tests, including clock corrections, unknown/replacement resets and timer bounds at 1 and 10 mounted rows. The required pre-commit hook passes. Current-head CI is blocked by the unchangedstructured-agent-session-options-read.tsexceeding its line limit (303/300). The final reference comparison, marker and readiness pass remain deferred until #30955 merges. This is not a ready-to-merge claim.Agent skill upstream boundary
Notes
Stacked on #30955; merge #30955 first, then retarget this to main. If the saved-chat Continue QA requires #30982, this PR must merge after both #30955 and #30982. Until #30955 lands, existing Claude chats keep their old account. Merging this alone would offer account switching without moving the conversation to the selected account.
Folder workspaces and git worktrees use the same owning-workspace hand-off path. Remote chats switch accounts only on their execution host, when that host verifies this conversation can move. Codex remains hand-off-only until the #30957 follow-up supplies account following. Older peers omit or ignore the optional response fields. The Session History list was considered for transcript lookup, but its scan roots omit isolated workspace account stores; the host importer already has the record-scoped lookup that covers them. Mobile behavior is unchanged.
Author: @BrennanKB5
Checklist