[trissim]

P1015 app isolation — root-selection checkpoint

5 commits including the main synchronization; 36 files, +115/-96 versus current main. The latest correction replaces consumer-owned root selection with the existing app access owner. This is not complete P1015 delivery.

Pair with agent-comms#3704 (P1026, approved Core head reported as 4cf224558). Never land the Core deletions against Toad main alone. The hidden-channel wait also consumes the public VisibleReadMarking.read_worker in toad#1368 (published head reported as 3e7dac5); retain that change when integrating. No .marking compatibility flag or private-worker probe.

Before / after: route ownership

Before: LaunchRoot.startup was discarded, Toad reread the process singleton, and capture(source) compared the source to an ambient route. The first version of this PR incorrectly claimed that passing the source removed global dependence; that claim is retracted.

The next checkpoint used explicit RouteSelection.of(app_root) but pasted the selection and source check throughout views, commands, paging and ACP. Three replacement checks drifted in their exceptions or retries. That was relocation, not factoring (IMPL-12; paper1 Theorems 4.6/4.7).

After:

• CLI retains startup's returned LaunchRoot and passes it to the app's existing CoordinationAccess.
• CoordinationAccess.selection is the one production RouteSelection.of site. selected(source) owns source refusal; current(source) asks Core's declared instance method. confirm(selected) owns held-selection replacement checks; writes retain that sink validation.
• ACP launch/reconnect/owner updates, transcript access, navigation, target discovery, transfers, thread actions, acknowledgement, relationships and context readers consume that owner. Consumers no longer reach through .launch_root. Target discovery no longer resolves the route again through its separate current() call or raises its own replacement ValueError.
• WireSource retains the access owner, not a second root-selection recipe. Dataclass replacement/restyling retains the same owner.
• About rendering receives the already-selected display path. CLI supplies its startup path; slash-about takes the app owner's selection, not its private launch-root plumbing.

Import correction

CoordinationAccess is imported at wire_history module scope, not added to its TYPE_CHECKING block. The prior guarded import was an avoidable new dependency copy; the reviewer verified the top-level import on the installed runtime. The author did not repeat that runtime check. Current main's NativeContextData consumer migrations are integrated, not replaced.

Caller and guard preservation

All required ToadApp factories and helper callers are migrated, including the original seven named app/about sites. WireSource constructors receive real app access. The child-launch contract uses its explicit launch_root fixture, not LaunchRoot.current().

The hidden-channel no-route-read probe is restored against RouteSelection.root_is_current, preserving its scroll/tab-return assertions. Its obsolete .marking wait now awaits the public worker lifetime from #1368. No author test execution.

Source evidence

• Retained family inventory: 1,832 Toad/Core Python modules parsed, zero omissions; current refresh: 625 Toad src/tests modules parsed, zero omissions. Dynamic/generated bindings and external roots are not a semantic completeness proof.
• Owner-method checkpoint: 26 changed modules parsed through NRA SourceModule, zero omissions; no product imports. The final import-only correction is separately source-parsed and checks that CoordinationAccess has one top-level import and zero TYPE_CHECKING imports. git diff --check passed.
• git grep -n 'RouteSelection.capture\|root_is_current' src has one result: comms_root.py delegates to Core's retained RouteSelection.root_is_current instance method. It has zero capture calls and zero removed free-helper imports. Calling that broad grep zero would be false.
• RouteSelection.of has one production site, in CoordinationAccess; no production LaunchRoot.current remains.

Still open / acceptance owed by integration

No tests, collection, mypy, local NRA gate, runtime imports, build, install, provider input or live application run was performed by the author. No paired behavior or CI success is claimed. Root owns combined acceptance: two apps on different roots despite process-default changes; foreign-source and replaced-bus refusal; CLI startup/about; write sink validation; hidden-channel/tab-return and child-launch contracts.

The remaining P1015 steps are still open: AppPaths/settings/database instance ownership, process-owned heap freeze, child retirement, then deletion of interpreter-per-test isolation. OwnProcessTest is deliberately retained until those owners are fixed. Reported 28-minute baseline is not an author measurement; the under-20-minute result and deleted isolation line count remain unmeasured.

Assumed

• Core #3704 and this consumer land together; P1022: migrate stale Core test callers and verify main pushes #1368's public read-worker change is present for combined qualification.
• Core preserves private-route validation, normalized source refusal and recorded bus identity; process-default callers outside the app keep their actual process lifetime.
• This checkpoint repairs the root owner and consumers, not the rest of app-instance isolation or the live scroll performance target.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.