[trissim]

Summary

1 repair commit, 5 production files, +68/-43 against the synchronized main. Two nullable-root selection callers become two identity-method calls; the wire source is no longer declared to be an asynchronous native loader. No tests changed or run.

This continues P1015. #1365 was merged at 234454f before its later send-back was repaired, so the correction cannot be another commit on that merged PR. The same allocated checkout and branch are reused. This is not completion of app-instance isolation or a performance result.

Identity owns selection

Before: screens/main.py and session_scope.py flattened SessionIdentity into wire_root(): str | None and passed it to CoordinationAccess.selected(str | Path). LocalThreadIdentity inherits the absent wire binding, so that replacement did not preserve its admitted case.

After: SessionIdentity.selected_route returns the app access's selection for local/unbound identities. ThreadIdentity overrides it to require its recorded source through access.selected(self.root). Both consumers call the identity method. No nullable selector, fallback constructor, identity test, or compatibility API is added. The existing require/confirm/write path still validates the selected service and sink.

The page-source family carries the actual loader

Before:

• TranscriptPageWork stored an async native callable; WirePageWork inherited that declaration but used a WireSource.
• SavedHistory stored the same callable declaration; WirePageBuffer inherited it while using a WireSource. Its new loader.access read exposed that wrong parent contract.
• SavedPrefix copied the original loader and made a native/wire work object before replacing its scope and cursor.

After:

• PreparedPageWork owns the shared immutable scope/request/cursor, work key and result accounting. TranscriptPageWork and WirePageWork inherit it as siblings, each declaring its actual loader and execution.
• SavedPageSource owns the shared preparation scope, foreground get, speculative prepare and prefix lifetime. SavedHistory and WirePageBuffer inherit it as siblings, each holding one correctly typed loader and constructing its own work through read_task.
• SavedPrefix holds the original source, not a second loader. That source constructs the same native/wire work directly with the prefix's scope and through cursor. The existing edge routing, replacement, cancellation and preparation implementations remain shared.
• The work class-variable factory is deleted. Known task construction uses keywords after the shared dataclass fields move to the parent.

The wire guard now reads CoordinationAccess through its held WireSource. There is no cast, second source field, callable attribute probe, new runtime branch, or added TYPE_CHECKING import.

Source evidence and scope

Before-map: NRA SourceModule parsed 635 files in Toad src/tests/tools, zero omissions. It enumerates the identity/source/work declarations, ancestry, methods, imports, constructors, loader writes and consumers. Artifact: /home/ts/.cache/agent-scratch/toad-render/p1015-identity-owner-map.log.

After: all 5 changed modules parsed through NRA, zero omissions; git diff --check passed. Whole src/tests/tools search finds no old one-argument read_task call, positional page-work construction, work = WirePageWork or ClassVar[type[TranscriptPageWork]] factory. Source review: /home/ts/.cache/agent-scratch/toad-render/p1015-identity-review.log. These are source checks, not application, MRO, mypy or gate acceptance. Dynamic/generated references and external callers are outside this syntactic map.

Verification still owed

No author pytest, local NRA gate, collection, runtime import, installation, profiling or provider run. The integration owner must check the pushed head with Core's RouteSelection.of/require_source contract; local identity thread discovery and visible-read marking; wire source/replacement refusal; native and wire prefix reads after source growth, replacement and cancellation; and hidden-tab return/read marking with the current #1368 API. No claim that the gate's TypeErrors are zero without its actual result.

Full P1015 still needs app-owned paths/settings/database, process-lifetime freeze and child retirement before interpreter-per-test isolation can be removed. The under-20-minute CI result remains unmeasured.

Assumed: the retained in-tree constructor/factory inventory is the admitted caller set for this change; no separately maintained external consumer of the old work factory or SavedPrefix constructor was identified. Original sessions, uncertain inputs and P924 dirty work are untouched.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[trissim]

Closed in Tristan's board clear (2026-11-02): no activity since Oct 30, and it predates today's transcript-preparation changes. The branch is kept. Its selected_route fix can be re-landed as a fresh PR on current main.

---

Generated by Claude Code