[trissim]

Summary

27 files, +272/-92 against main. Preserves the original refusal checkpoint and #1378 salvage ancestry. Paired Core: OpenHCSDev/agent-comms#3816, exact head 890cca9e8901622dd295b990255064c8beb970e5. Toad checkpoint: ce213aedd93bfb3f952e3916c59efceeaee50c60.

This is the refusal/queue-crash checkpoint and retained test migration, not completion of native/channel/CLI queue unification. The expanded implementation, editor intent, cancellation and long-reply source acknowledgement remain with pi-toad-errors on #1389; those later production changes are not silently included here.

Goal refusal: keep the actual capability

Before: a RuntimeError/Refused response was relayed through ValueError, and UI callers interpreted goal-failure strings again.

After: Core's existing Refused capability reaches owner RPC and UI unchanged. GoalRefused(Refused, RelationViolationError) preserves both contracts. The string relay/policy is deleted; unexpected failures still escape and owner readback still occurs.

Source views and notification evidence

Before: sibling goal/queue modals repeated composition and lifecycle work; source contracts claimed generic widgets could publish Core events.

After: GoalDetails and QueueInspection inherit SourceModal, sharing existing event/project/dismiss behavior. Its source requires the actual CoreEventReceiver; VisibleReadMarking inherits ToadNode. Dependencies are ordinary runtime imports, not guarded-import facades. Live outgoing entries derive original message references and existing notification status; captured display identities and fabricated queue evidence are not substituted.

The painted-read worker reports real maintenance refusal without claiming the mark succeeded. Its application control uses the actual barrier/read ledger and fresh work after relief; it does not certify every cursor-admission path.

Notifications must not cover active controls

An actual enabled GoalControl at Region(73,31,5,1) hit an informational Toast, and pilot.click returned false. The original Button-selector/active-effect assumption was wrong; an unsupported wait would only hide the obstruction.

The existing ToastRack now reserves bounded bottom space in the default layout layer (split: bottom, no independent dock), rather than painting over controls. Nine CSS insertions; notifications remain interactive. The refused-goal application control now passes with the real control and unchanged refusal/draft assertions.

Preserve existing salvage and current lifecycle callers

Original #1378 commit 55cf042f remains in the preserved ancestry through 2dc2102b. Tests consume current CommsUpdateConsumer, captured claims, standalone completion and nominal AcpSessionId; deleted APIs are not resurrected. Three removed OwnerLifecycle.start fixture calls migrate to start_many(tuple).

Native send-now control declares its actual interruption

The saved failed attempt proves Send now deliberately aborts request1 before the selected queued input starts: first input -> assistant stopReason=aborted -> original queued native input -> second answer. The control had required that deliberately aborted provider stream to stay open.

The isolated final test correction uses the provider's existing request-specific expected_disconnects={1} contract, additionally asserts the saved first answer was aborted and exactly two provider requests occurred, and keeps every original saved-input/history/reconnect assertion. Other disconnects and provider errors remain loud. No production queue behavior changed in this correction.

Verification and preserved failures

• Core affected selection: 8 passed in a separate interpreter.
• Distinct Toad affected-selection coverage: 34 passed across 34 cases, accumulated across source-compatible runs. This is not a single all-34 final-head execution or a full suite. The isolated final native control at ce213aedd passed 1/1 in 33.87s, exit0; that last commit changes only this control, not production.
• Actual native goal identity/stale edit, live queue readback and goal setting reached the controlled native process and passed. The refused-goal click passed after the common ToastRack allocation repair.
• The corrected final queue journey passed send-now, both answers, original saved native input identity/text, saved-history rendering, same-owner ACP reconnect and empty queue. It also verifies the intentional first interruption and exactly two provider requests. The earlier provider-failure attempt remains retained; it is not silently reclassified as a passed run.
• Initial nonexistent-path and cross-repository bare-conftest collection collisions executed zero cases. Earlier click/selector failures and native setup failures remain preserved, not relabelled as product successes.
• The owned verification interpreter now has the real editable package entrypoint, existing frozen dependencies, qualified native package binding and generated unit instructions through cli_native_package qualify. No handwritten entrypoint or installed-package patch.
• Failed/UNKNOWN private roots remain immutable. Fresh checks are separate attempts, never replay of those inputs.

Artifacts are retained under /home/ts/.cache/agent-scratch/pi-commander/heartbeat-publication/: paired-core-controls.log, prior paired-*-controls.log, paired-remaining-three.log, paired-prepared-native.log, and paired-interruption-control-review.log / paired-interruption-control-integrate.log and the final paired-interruption-final.log/.rc. Actual command exit codes/counts accompany each run; source maps/imports/MRO evidence are not installation proof.

Delivery boundary

Commander owns the remaining combined qualification, paired Core/Toad landing, installation and affected installed-path acceptance. No full suite or local NRA gate ran. Original sessions, drafts, undo, history, reader positions, phone SSH Toad and editors are preserved. This PR does not close P867, mobile #1391, the shared physical-run owner, or expanded queue #1389.

Assumed: #1378's current claim-separation/queue-replacement intent remains required by its production ingress. Native Send now intentionally interrupts the held model request, as the existing Core/native implementation and saved attempt establish. No sandbox/source/component result is presented as installed acceptance.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.