[trissim]

Current delivery: db8a6aa

35 commits; 27 changed files; +2971/-1466.

Directed check contract

Tristan directed the required protection setting to NRA gate in56953.
The superseded8498 Debt ratchet job rename is undone. The actual job
now publishes NRA gate; Dispatch owns the protection-setting change.
No protection setting was changed by this PR. Current-main rebase
preserves all35 authored commits unchanged by range-diff. Tools, tests
and the workflow match171 byte-for-byte; its28-control run and hosted
success remain evidence at171, not a new execution at this head.
Current-head hosted status and actual merge are read separately.

Saved paint and current read metadata

Before: reusable serialization recreated suppliers and independent commit paths
could acquire one destination while publishing another. After:
ContentAddressedRenderTask supplies content identity independently of storage;
TranscriptPageRenderTask(ReusableStorage, ContentAddressedRenderTask) retains
original suppliers and attaches each actual read's page metadata. FieldCodec's
declared ContentExclude projection distinguishes content from read annotations.

PreparedPageCommit and PreparedAppendCommit own acquisition and publication as
one family. Shared CommitPlan behavior chooses the source member once; a source
replacement retries through the replacement member. A held reader keeps its
paint; a followed append retires live blocks only after successful destination
drawing and final current-source checks. The historical source trace and controls
below explain the exact guard and cancellation cases.

Observation imports belong to startup

The rejected644 packet could select a tools directory inside a running frontend.
That path is removed. ObserveOperation owns module-location validation directly;
its packets carry resources and process identity. OperationProgram freezes the
measurement dependency and declared package layout before startup, with owned
initializers preventing namespace merging. MeasuredStartOperation composes with
installed and strict-candidate startup/admission through the existing MRO.

Deleted in this correction: the205-line injection controller and315-line remote
collector, plus their current executable references. The correction totals
+114/-658 across8 files. Historical immutable53/644 archives and failed original
runs remain retained. Ordinary observations write data, never select new code.

Evidence and remaining application work

Module-identity controls at171: 28 passed in0.99s, rc0, host lease acquired and
released. The two new controls use Python's actual PathFinder to establish that
both measured MROs resolve the meter from their frozen owned package. Existing
controls verify observation-only decoding, resource changes, candidate admission
and source-owned painted replies. Artifacts:
pi-ui-performance/observer-module-49{,-pytest}.log and its inputs/rc records.

The e066 hosted gate rejected five module-name copies.171 derives those
identities from actual imported ModuleType objects and accesses their
declared spec; the mandatory ToadApp import already supplies loaded-app
evidence. The added control observes real stdlib ModuleSpecs, accepting
their actual location and rejecting foreign-runtime and empty selections.
The original27-case/e066 epoch remains retained. Hosted status is read
separately; this source/control result does not claim a green gate.

The corrected known-gap oracle previously passed once in16.21s: read acknowledgement
stays blocked until native destination paint and source settlement. Its original
source snapshot and failed predecessor remain in gap-contract-27/prepared-current-10.
All32 commits survive the current-main rebase unchanged by range-diff.

The exact-head source verdict is recorded. Installed physical performance and the
configured read/edit/preservation journey remain application work after useful
landing; these controls do not claim those results. The tab-return BlockPosition
reader defect identified after1408 is owned here as subsequent work.1399's useful
changes are retained until verified disposition after this landing.

Assumed: Python ModuleSpec locations establish provenance, not hashes of loaded
code. The meter records UI/input-to-driver handoff rather than terminal pixels.
Historical capture15 remains partial evidence and its input is never replayed.

Historical implementation and evidence: original heads and scopes retained

Current source: 8194baada19dc5ce0e989159b4f32fa8cd7d31ee

28 commits;25 files,+2816/-838. Rebased onto current main and pushed; local=remote independently matched in overlay-evidence-publish-19.log. Latest commit changes only the overlay-sensitive source test marker and the retained capture/control documentation. Not merged, installed or whole-PR accepted.

Correction: source rows retained, marker masked by a designed overlay

Closed-prefix geometry09 reproduced the red on immutable metadata08 source. The same acquired supplier retained3 cached rows at unchanged page/window regions. Painted row30 changed from CLOSED_PREFIX_MUST_SURVIVE to CLOSED_PREFIX_MUST_S ↓ Back to bottom · Esc: the existing3-row floating screen control masks the suffix. The earlier claim that the source paint disappeared was too broad. The long-marker failure remains retained. The test now uses a short distinct marker clear of the control; page/fragment identities, reader equality, no-successor paint and failure checks remain. No CSS, source-admission or reader workaround.

Current-source control10 on22d plus its retained uncommitted marker/doc patch, Core946 and recorded current library paths: 5 passed/1 failed in93.57s, rc1, host lease released. Both closed-prefix following modes, live-message coverage, fresh read metadata/original supplier sharing and restyle passed. The known-gap case still fails assert not history.drawn_end_more immediately after publication, before lookahead. It remains my open source-publication obligation. These controls predate the latest rebase and do not establish exact8194, installed or complete acceptance. The independent Core rewrite-prefix witness remains with Commander; the UNKNOWN fixture operation remains unapplied, unreplayed and open.

Capture15 is retained partial evidence, not a performance pass

The exact14f/Core946 prepared runtime reached saved history, Ready, focused composer and an actual busy/live ResponseStream matching real published st cells. One fresh input, no replay. Held PageUp/PageDown, reversal and End were dispatched. The End image still shows old history/Back to bottom, so End-to-tail is not proved. The subsequent tab-away predicate incorrectly compared workspace app.current_mode and only one tab was visible. This is a harness/setup failure, not a proved product tab defect.

No frame-meter.json survived exceptional teardown. No frame or input-to-paint median/p95 is claimed. The CPU recording is partial:741 samples,0 sampling errors, then selected-process-birth-ended before its24s request completed. Video/screenshots and retirement records are retained, not relabelled complete performance or preservation evidence. docs/performance/scroll-series.md now records those limits and the09/10 source epochs. Protected14/15 inputs/roots remain untouched.

The next1408 question is actual painted reader position across a late first styled thought above a non-following reader, not scroll_y alone. A deterministic native-publication control was prepared against14f: an inherited test gate delays the real first thought render, then calls the unchanged real styling/row/layout path. Attempt11 failed before lease/test execution because I used the wrong TestLease constructor. Attempt12 used current().held() and released the host lease, but failed before test collection on unrelated platformdirs plugin auto-discovery. Attempt13 reuses that unchanged prepared14f control with the established explicit asyncio/timeout test-plugin recipe; its result is not yet claimed here. Neither setup failure is a reader verdict. No provider or physical input is involved.

Installeded110/Core,51cf/Toad andda87/Textual are a separate epoch, not this source. No duplicate install. Remaining: known-gap publication, rewrite witness/admission, unresolved fixture operation, actual1408 painted-position verdict, tab-identity/setup and meter exceptional-close repair, configured read/edit/hidden/reopen/selection/editor/draft/undo preservation and complete physical performance acceptance.

Assumed: the existing floating control is allowed to mask underlying cells; this test protects retained source identity/paint, not removal of that control. A marker correction cannot excuse missing source or displaced reader text. No stronger result follows from the limited source controls or partial capture.

Earlier complete bodies follow with their original source scopes; this section corrects their current conclusions.

---

Current source: 22d685fc01d0c7b1d4e32ba77636207555176a22

27 commits;25 files,+2734/-838. Rebased onto the matched Toad1409 main and pushed; local=remote verified. This source is not installed or accepted as a whole.

Reuse content, not an old read descriptor

The2e1 supplier contrast passed3/3, but its direct cache result retained the older page/snapshot. TranscriptPageRenderTask.prepared now owns cache acquisition plus attachment of the current actual page. The model-read, commit, historical-session and affected direct test consumers use that entry. PreparedTranscriptPage.same_source retains original tuple identity and compares Core's declaration-derived ContentExclude projection; no hand-kept field roster or fragment equality weakening. Latest-view reuse keeps the original view/range while accepting the new page metadata rather than replacing it with the old view's wrapper. Serialized siblings retain their existing storage.

Latest actual execution is a pre-rebase source epoch

prepared-metadata-08:7 selected,4 passed/3 failed in110.24s, rc1; host lease released. Inputs record immutable2e1 archive plus SHA256-addressed metadata patch, Core946 and matched pre-ABI Textual fromcb4. This is not an execution claim for rebased22d or installed34b0.

Passed: live-message retained-history preservation; real read-ledger changes retain original suppliers while each result carries its actual fresh page/snapshot; the restyle counterexample; followed known-gap publication (failed in06).

Open failures:

• Closed same-source held-prefix paint still disappears despite retained pages/fragments/reader position.
• Both rewrite cases now expose the actual witness issue instead of stopping at stale imports/read API or a malformed stale-offset read. NativeTranscriptCursor carries path/offset, not an old-byte certificate. PresentSessionCut.contains delegates to FileRevision.holds_cut, which treats a larger file on the same inode as append-only retention; an in-place longer rewrite is accepted by that guard. The test still fails its explicit old-prefix containment assertion before replacement-paint behavior. Commander explicitly took the independent bounded witness/admission repair in #comms56231 after request56218; no full-history hash workaround or claimed rewrite fix.
• One fixture call in tests/support/textual_steps.py remains on the raw preparation entry: its edit outcome was UNKNOWN during the install, old text was read back, and the operation is not counted as applied or replayed. The other two operations reported not started and were subsequently applied normally. This checkpoint is not a delivery closing all caller work.

Capture and installation epochs

Author56168 names1408 head14f05429add046cf81d9535a787e7841fbfdfc82 as the current capture target; it supersedesf9. It retains the wheel-up reader-jump failure and is not landing-qualified. Read-only source retrieval confirmed the exact head. Fresh target capture-1408-build-02 completed through existing WheelRuntime owners: Core946 plus exact Toad14f wheels, target-worker interpreter/native/package/resolution/client probes completed and the lease released. This is preparation only, with no provider input or frontend run in that phase. Resource observation:7.7GiB RAM available,0% memory stalls,8.8GiB swap used (warning); preparation is serial under the existing lease, not another agent or test farm.

I independently read installed build34b0e81189d4. Peers verified its matched Toad58c6ca55b09a/Textualda87b77f22bd. My1393/3825 source is excluded. Captured14 remains failed/unreplayed; no active-answer CPU/frame/input-to-paint distribution or complete physical preservation result exists.

Assumed: ContentExclude remains Core's declared distinction between content and annotations; source admission still owns validity. The7-control pre-rebase epoch establishes only those recorded results. Closed-prefix paint, rewrite witness/admission, the unresolved fixture operation, post-rebase validation and installed/physical acceptance remain open.

Earlier bodies below retain their dated heads and failed epochs; this section takes precedence.

---

Current source checkpoint 2e1bd5e3253d30019a9d783b25c5fe2adea62693

26 commits;23 files,+2711/-816 against main523. Local and remote heads matched. This is a published source checkpoint, not merged, installed or application acceptance.

Prepared content retains its actual suppliers

Before: TranscriptPageRenderTask inherited both content-addressed identity and serialized storage from ReusableRenderTask. Its input identity included read/coordination annotations. TranscriptPageWork also called the raw renderer, bypassing the existing RenderPreparation owner. A separately materialized serialized result produces fresh fragment suppliers even for identical content; the required restyle/fragment distinction cannot be deleted to conceal that loss.

After: TranscriptPageRenderTask.preparation_inputs derives from Core's ContentExclude declaration. ContentAddressedRenderTask factors reusable identity independently of storage. Existing ReusableRenderTask siblings keep their serialized storage; transcript pages compose the existing ReusableStorage/CopiedValue policy with content identity, honoring PreparedTranscriptPage.deepcopy's original source/fragment ownership. TranscriptPageWork enters the existing runtime._prepare(RenderPreparation) rather than a raw-renderer bypass. No second renderer/cache, equality shortcut, compatibility alias or weaker admission is added. A real-source/read-ledger control asserts independent page results retain their original suppliers across read-mark changes.

Source evidence, not a claimed completed repair

• snapshot-content01, rc0: real read-ledger mutation changed only read_revision. Native bytes/events/cursors/bounds and snapshot.same_content stayed equal while full page equality changed.
• snapshot-revalidation02 on source535/Core946:2/2 passed in30.86s with normal-startup process-local observation. Metadata churn alone did not force replacement.
• Original-main523 contrast03:1 failed/1 passed in31.31s. The failing pair had identical events/cursors/bounds and same_content=true; only read_revision/coordination_revision and materialized fragment suppliers differed. The replacement call at+5692ms preceded explicit received/parked validation at+5837ms, so revalidation alone is not the trigger.
• Key-only commit0cd1a3e5: original523 contrast04 still failed the live-message case while the restyle counterexample passed (1 failed/1 passed38.63s). Recorded render inputs were equal, but fragment suppliers were distinct. The key hunk's bounded source OK did not accept the other PR files or prove view preservation.
• Supplier follow-through2e1 is now published. The original523 key-plus-delivery contrast05, explicit supplier-sharing control and restyle counterexample are the next affected execution; no result is inferred from the source change.
• Existing1399 cases were also checked on source535/Core946: known-gap publication passed; closed-prefix held paint still failed. Both rewrite cases first stopped at a stale exception import, then stopped at obsolete read(position=...) usage after the import correction. Current source uses coordination_errors.TranscriptChanged and capture_page_read(position=...) directly, with no Core alias. Those setup failures do not establish rewrite behavior, which remains unverified.

Exact source/commands, original calls, private roots and results remain under the existing pi-ui-performance scratch/worktree owners: snapshot-content-01, snapshot-revalidation-02/03, snapshot-key-04, snapshot-suppliers-05, fencing-source-04/05 and content-*-publish logs. The retained original523 archives are not edits to a peer checkout. All prior failed epochs and protected borrows remain intact.

No1408 capture will run before its author publishes the StyledRows/LinkContext repair and controls (56040/56047). Older d34 capture14 is failed/unreplayed; native wait versus provider cause is not established. No representative CPU, fixed-scenario frame/input-to-paint distribution, configured read/edit or complete physical preservation claim exists. Assumed: source controls cover only their recorded stack and domain; pending supplier and rewrite controls, remaining1399 paint, eviction/retirement and application acceptance are still open.

Older evidence below retains its original head and scope; this current checkpoint takes precedence.

---

Current source checkpoint 535480c4b21ac669c7bff529dde3d0e0b8c0afc8

23 commits; 21 files changed, 2673 insertions(+), 812 deletions(-). The owned branch is rebased on fresh main; local and remote heads match. This is a source checkpoint, not installed acceptance.

Startup, admission and measurement compose

Before: the observation lifetime could start an installed or strictly admitted frontend, but the existing total-frame meter had no normal-startup consumer. The old capture_live --frame-meter documentation referred to a deleted injection path.

After: MeasuredStartOperation uses ApplicationLifetime.observe_next_start and the existing bounded meter; its ExitStack restores hooks when that distribution entrypoint ends. MeasuredTerminalApp inherits the existing terminal/source/resource lifetime. MeasuredCandidateTerminalApp and MeasuredStartAdmittedOperation compose that same measurement with strict candidate admission through the MRO. The read-only connection still decodes only ObserveOperation descendants, never start/measurement execution packets.

The callback counter now selects its captured UI loop rather than counting callbacks from another loop. New observations derive actual composer focus, published composer geometry and current Textual mode from their owners, enabling a real input-box and tab-return qualification instead of assuming a click succeeded. The frontend launcher derives its native entrypoint through RootLaunch.restart_entrypoint for the target runtime; the caller's absolute source-runtime launcher is not copied as target identity. Native command validation is unchanged.

Actual execution epochs

• Installed observer10: published467 tools, Core f03, real saved history plus ACP Ready, no provider input, private copy/st/display retirement, rc0.
• Startup meter11: authored measurement capability on installed f03;83 actual display handoffs,4 physical key arrivals,3 followed by a handoff;10 hooks restored, no dropped/censored records,109328 output bytes, rc0. Startup plus three keys is NOT the fixed active-answer scenario. These figures are not a1408 benchmark.
• Affected source controls15:25 collected and25 passed in1.04s, controller rc0 under the existing TestLease. Covers measured startup codec round trips and refusal by the read-only decoder. Core source was unchanged and was not redundantly rerun.
• Core3825/946 and Toad1408/d34 exact wheels prepared through WheelRuntime, including producer/native/package/resolution/import probes and recorded interpreter observation; no frontend or provider input in preparation.
• Fresh1408 capture12 refused before frontend/input at native_pi.py:224 because the controller inherited the source runtime's absolute launcher. Its copy retired. No scenario/CPU/latency result. The next fresh-source producer forks under the installed source owner, stops that private owner before retargeting, and the frontend uses the root-owned target entrypoint. Capture13 is a separate run; its result is not claimed here.

Evidence: installed-observer-f03-10, installed-meter-f03-11, runtime-observer-15-*, capture-1408-build-01 and capture-1408-d34-12 under the existing pi-ui-performance scratch owner. Historical failures and borrowed archive53 remain immutable.02/04/09/12 are not replayed.

Assumed: startup/model controls cover their stated source epochs only. Composer/tab observations and the loop filter need the actual fresh fixed scenario. Driver-handoff metrics are not terminal pixel timestamps; retain the video and source/paint qualification. Full1408 measurements, warm-M read/edit and1399's four failures remain unfinished. No stronger rooted NRA binding-closure claim survives the context-free map.

Follow-through recorded after checkpoint15

• Capture13 passed strict candidate entry and visibly displayed saved history on the exact prepared Core946/Toad1408-d34 runtime. Its source owner had been stopped before retargeting, so the frontend correctly remained read-only and never reached ACP Ready. No input was sent; it retired. This does not qualify the active-answer scenario.
• Fresh capture14 explicitly started the private target owner through the existing lifecycle after source-owner fork/stop/retarget. It reached strict admission, saved history, ACP Ready and observed composer focus, then submitted exactly one fresh request. No qualifying live ResponseStream/paint appeared within90s. No paging, wheel, End, tab-return scenario or CPU profile ran; controller rc1. The final frontend/frame-meter.json is absent, so no meter output or hook-restoration claim is made for14.
  -14's native request record reaches message_start callback completion at about721ms, not a UI frame or input-to-paint measurement. The retained native session has the fresh user record but no subsequent persisted assistant record. Cancellation was waiting in Backend.receive_record / TurnWatchdog.read; its later authorized-original-turn refusal is separately owned and is not established as the cause of the missing reply. Original14 remains UNKNOWN/unreplayed.
• st1610927, Xvfb1610924, recorder1610926, frontend1610929 and native1612781 were independently absent on later literal-PID readback. Their original retirement records and failed root remain retained. No protected user process was signalled.
• The25-case run15 predates the later composer/mode, loop-filter and launcher changes. It is not a claim that every final535 addition received a fresh exact-head run.
• Snapshot-content01 is a separate real-Core/read-ledger counterexample, rc0: changing only read_revision preserves bytes/events/cursors/bounds and snapshot.same_content, but changes full page equality. Snapshot-revalidation02 ran the two saved-history cases once under the host lease:2/2 passed in30.86s, with ordinary-startup process-local call observation and no product patch. Their revalidation snapshots differed only in coordination/read metadata, but their views were retained. Neither result establishes the cause of the original flaky main523 case, a product repair or physical performance acceptance. The original523 contrast remains a separate epoch.

Artifacts under /home/ts/.cache/agent-scratch/pi-ui-performance: capture-1408-d34-13, capture-1408-d34-14, capture-1408-14.{log,rc}, snapshot-content-01, snapshot-revalidation-02 and matching controller/source records. Prepared runtime/source archives and all UNKNOWN inputs remain retained. The existing fragment identity requirement is unchanged; page-only reuse remains rejected by its restyle counterexample.

All older checkpoints below retain their historical source and execution scopes.

---

Current source checkpoint 46798742c10cb91a370fdfbcc7cc98436129c579

22 commits; 21 files, +2550/-810 against origin/main. Rebased onto current Toad main with the upstream test cleanup preserved. Local, remote and forge head match; OPEN/non-draft.

The latest commit changes4files,+80/-8. RunObservation.turn_busy honestly reports backend phase, not an answer. Response qualification reads only the live ResponseStream's LineMarkdown source and that body's clipped last-published native placement, then requires the nonempty marker in actual st cells in that region. User echo, ThoughtStream and completed-notice paths cannot supply that source. ScreenCapture.rows_in shares the existing region crop; no renderer or reply cache is added. The old active_response name is removed from current repository consumers, without a compatibility alias.

Affected execution14 actually completed under the existing host TestLease, with repository-specific pytest processes to avoid two independent tools packages sharing one collector: Toad25/25 passed in1.01s; paired Core33/33 passed in12.85s; controller rc0. The six new reply controls include source/busy/paint separation and empty-marker refusal. The real typed UpgradeRefused assertion preserves strict build rejection. Exact paths/logs/input hashes: /home/ts/.cache/agent-scratch/pi-ui-performance/runtime-observer-14-*.

This does not establish a fresh frontend observation, completed provider reply, held-scroll capture, configured warm-M acceptance, CPU or latency result. Capture02/04/09 remains unreplayed; archive53 and borrowed runtime evidence remain retained. Installed f03ec9775 is a separate epoch, not this unpublished-to-install source checkpoint. Assumed: the declared fixture/control domain is the test scope; source and terminal-region matching still require the authorized real capture.

All older heads/counts below are retained historical epochs, not current-head evidence.

Prior checkpoint 3c946d4104431fc9fae50d3803fe105278e79f7b

21 commits; 21 files changed, 2478 insertions(+), 810 deletions(-). Rebased on current Toad main ec4ef382f.
The latest commit changes two documentation files only: caller-owned host lease and actual installed capture08/09 results. No new product repair, test run or performance result is claimed.

• Capture08 refused the copied non-Git project before frontend/fork/input; the private copy retired.
• Capture09 qualified the existing owned prepared checkout and visibly loaded saved history/Ready on installed Core038c. Its one prompt reached ACP identified-input-started (fc3ca84a66414cf595de16f8da929a65) and native provider stream start at742ms from request preparation. No new assistant text was retained before the75s qualification deadline. No gestures/profiler ran; no connection-failure or model-delay cause is established. The owner log also records a cancellation/turn-lease refusal, not a proven cause of the missing response.
• st, display and recording retirement records and private-copy result were read. This releases that controller's lease, not all host leases. Original input is not replayed; completed response remains unknown. No frame/input-to-paint distribution or representative CPU claim.
• The earlier971-module context-free NRA map retains its syntax counts only. Its projected/canonical binding-closure interpretation is withdrawn, pending declared-import-root reconstruction; dynamic/alias/descriptor/effect/foreign/movement limits remain OPEN.
• Archive observer-head-53e04c515 remains immutable/read-only for UI. It is an older borrowed source checkpoint, not this rebased head.
• I own necessary combined execution, integration, merge and supported install, coordinating actual shared resources and independent peer review. No compulsory pi-commander or inactive claude-code approval dependency. The configured active-answer/held-scroll/read-edit journey and Core3825 coupling remain unfinished, not source-publication successes.

Exact capture sources and retained artifacts are documented in docs/performance/scroll-series.md. Prior checkpoint evidence follows with its original epochs and limits; the current qualification and withdrawal above take precedence.

---

Current checkpoint — installed observation separated from candidate proof

20 commits, 21 files, +2434/-810 against current main; head53e04c515.
Latest bounded correction: 10 files, +355/-108. Git local=remote verified.
Core3825 remains independently published atdc44cd1177f5; this observation path
is not held for its integration. Four1399 product failures remain open.

Before / after owners

Before: physical_ui.TerminalApp → RunTarget/AdmitOperation required the unmerged
resolution/interpreter API even to observe installed bytes. Program source was
read at import, and moving strict operations without their namespace would leave
tests and frozen programs describing different Python families.

After:

• physical_ui.ObservedTerminalApp → RunResources / ObservedResult owns the one
  existing st/display/input/startup-pipe/resource/retirement lifetime.
• InstalledOperation → InstalledResult records actual executable/package origins
  through the installed runtime's existing wire probe, with no metadata-parser
  copy or fallback import. This is origin evidence, not candidate byte proof.
• physical_ui_candidate.TerminalApp(ObservedTerminalApp) and
  physical_ui_admission.RunTarget(RunResources) add strict build admission.
  Recorded-interpreter and full entry/final build verification remain strict.
• All tool consumers and staged dependencies use tools.physical_ui* consistently.
  Snapshot source is read once when execution starts, never by ordinary imports.
• The existing ACP boundary now also projects actual Agent.ready and
  current_turn.busy. Saved publication, agent readiness and active response are
  distinct observations; none is inferred from another.

Deleted: the installed observer's concrete new-probe import and implicit strict
candidate requirement, import-time source reading, stale owner imports and the
old unqualified mixed module paths. No aliases, second process owner, renderer,
queue, runtime overlay or installed-package edit. The mutable frame metadata
caller now uses TranscriptReadIdentity.page_bound; frozen inputs stay unchanged,
and no injection path is thereby authorized.

Executed scope, not physical acceptance

• observer-installed-06.log/.rc:3 staged request round-trips in fresh installed
  interpreters, rc0; the new candidate probe remains unloaded.
• observer-candidate-06.log/.rc:3 staged request round-trips on the existing
  immutable0402/3475 interpreter, rc0. No build probe or App executed.
• installed-observation-origins.log/.rc:83 actual installed package origins on
  c8, no new-probe import. This is the old protocol exercised, not a UI result.
• observer-result-07.log/.rc:installedCore038c result codec/current-origin
  continuity and changed-executable refusal, rc0. The UI record is explicitly
  synthetic; it grants no mounted-readiness claim.
• Existing NRA SourceModule/syntax/class index covers971 modules,8192 raw class
  declarations and8184 canonical projections,0 parse omissions. Eight raw rows
  are not canonical projections; dynamic/alias/descriptor/effect/foreign-platform
  and movement limits remain OPEN. Full source hashes are retained.
• No author pytest, full suite, local NRA gate or new environment. Commander owns
  the necessary model/real-app selections, integration, merge and supported install.

Receipts live under /home/ts/.cache/agent-scratch/pi-ui-performance/.
An immutable-by-retention-policy source archive of this exact head is at
/home/ts/wt/pi-ui-performance--f885a2f85e6343be886cd3ee761f9de2--agent-comms/platform-source/observer-head-53e04c515/.
Its tool hashes are in observer-archive-07.log. It is source, not an installed
package overlay. Do not edit it while a consumer retains it.

Still open

No new mounted-ready or qualifying active-response scroll capture exists yet.
Capture04 and05 remain failed scope (no active prompt/response in04; gestures
while Connecting and sampler timeout in05). No median/p95 frame/input-to-paint
number is claimed. Original02 UNKNOWN and04 attempted input remain unreplayed.
Warm M read+edit, hidden/reopen/tab-return, full source/lifetime/physical journey
and original-coordinate acceptance remain open. Model/import/source/metadata
checks do not promote themselves into a screenshot.

Necessary remaining risks: execute the existing physical-run model controls for
resource/candidate separation and strict finalization; exercise actual installed
startup/loaded-history/agent-ready/focus before new input and held-scroll. Existing
tests/model/test_physical_run.py contains the model controls. No reassurance
rerun or product-method patch is requested.

Assumed: Linux host for native executable observation; retained runtime/package
inputs remain immutable; package-origin equality is metadata continuity, not
continuous loaded-byte hashing. Strict candidate proofs keep their separate owner.

---

Retained historical checkpoints — their original scopes, not current acceptance

Summary

19 commits, 18 files, +2184/-807. Current source 52750fe4adb6a2613ff95ac547c2fe7f5d6135b2 on P859 main 612df0db0; paired Core#3825 remains 040208ebdc65bf08a56bfa24446537f33f7ba590 on b706aaa14. Latest checkpoints fix the stopped-history probe and retirement fixture, carry1399's acquisition/publication correction, and move bounded pending-source acquisition to the observation owner. No new renderer/controller.

Paint-only #1399 is published for independent delivery,bf87092f4e81,2commits/5files,+273/-36: four production owners plus presentation-fencing tests. The initial65650 carve exactly preserved the five3475/615 paint blobs after the offered handoff remained unconfirmed. The new review correction is now also retained here through fe36; no original implementation was lost. I retain implementation and configured read/edit verification context; the harness must not delay that usage fix. Its authorized app selection actually collected5, passed5,71.91s,rc0, at26a application/fixture + installedceeed Core/Textual—not4/5. This does not establish configured read/edit or physical/performance acceptance.

Dated0ce/615 exact wheels, fresh preparation and own-installed readback passed; physical02 failed rc1. Actual entrypoint/pipe/admission/ordinary observations/initial screenshot executed, but the screenshot shows waiting/not-loaded. Multiprocessing re-imported operation.py as mp_main and executed startup again: bad-FD and repeated exclusive-error writes. An SSL allocation errno12 also occurred under my inherited1.5GiB virtual-address wrapper limit; host exhaustion is not established. The current explicit main fix passes actual stdlib-spawn import/normal import/explicit-refusal controls; no new GUI execution is implied. No readiness retry or guard weakening. Original8f+63af runtime/carry evidence remains at its original inputs.

Current candidate /home/ts/.cache/agent-scratch/pi-ui-performance/p859-runtime-040347-02 now passes supported preparation and own-installed -I record/archive/interpreter/tool readback, both rc0, no Core/Toad source overlay. Core0402 fixes my stale StorageProjection import exposed by the failed58905 preparation01 (prefix absent); lazy command/10-feature-import controls and9module/116class named-consumer map pass. Corrected Core wheel 9f6c8259… was rebuilt; unchanged3475 Toad 833aa19c… reused. Textual9a0501c and stock3.14.8, exact ceeed donor. UI1391 has read-only borrow approval. This is not latest-all-stack/production/carry/GUI/read-edit acceptance. Full receipt details are in paired3825 and scratch p859-runtime-040347-02-{prepare,readback}.log/.rc plus readback.json.

Latest actual active-scroll02: startup qualified, native input UNKNOWN

The fresh02 run passed the corrected source-publication boundary, visibly loaded saved history and bound the intended private ACP. Physical text entry and Return were attempted; input 18496848703c40afab7deab2a7c8993e remains UNKNOWN and is NOT replayed. The editor was in normal mode, so the initial R selected Replace mode and the actual ACP prompt began ead. No successful configured read/edit or provider response is claimed.

Native inspection/prompt preparation then failed at ThreadCatalog.publish → NativeRequestTools.catalog → FieldCodec: _OpaqueDecoder declares no JSON schema. A separate read-only declaration/schema check executed65 native tool schemas and found exactly one failing declaration: CommsOrderDoneTool.delivery / OrderCompletion. Commander54025 assigned the complete schema owner/current-main comparison to claude-ai; this PR does not delete a tool or add an opaque fallback. NativePiUnavailable: Configured command is not a validated native Pi launcher remains a distinct diagnosis. Profiling never started, so this is NOT a negative notification result.01 and02 remain immutable, with their exact native host/frontend/st/recording/Xvfb births independently absent; private-root retirement passed.

This checkpoint renames the misleading raw typing method to TerminalApp.type_prompt and uses the real prompt's normal-mode i action before literal input. The one live repository caller in acceptance.py is migrated; no compatibility alias. Native editing remains owned by Prompt.enter_insert → NeovimEditing.enter_text. NRA's existing27-module query has466 raw/canonical classes,0 local omissions,14,333→14,334 syntax sites; dynamic/effect limits remain OPEN. Two compiles and actual tools imports passed; no pytest. Fresh editor-input-040347-01 visibly inserted the complete Read EDITOR_INPUT_... token in INSERT mode, native undo restored the empty prompt/placeholder in NORMAL mode, and redo restored the token. All three physical screenshots were read. No Return/native owner/provider was used. The OVERALL RUN EXITED1 on final AdmitOperation: FileNotFoundError for frontend-home/toad. Existing private-root retirement passed; I retain diagnosis of that final-admission failure. These are working editor controls, not a passed full run, active-agent profile or arrival qualification.

Earlier actual active-scroll01 startup failure and owned correction

active-scroll-040347-01 used a NEW outgoing-created two-thread CheckRoot and the immutable0402/3475 prefix. Two logical native owners started on one shared native-host birth. No ControlledProvider/configure_provider was called. Native discovery pointed to the existing configured directory; that observation alone is NOT provider/authentication proof.

The controller exited1 BEFORE physical input/sampling. Its retained fresh-input.json is NOT_SUBMITTED. Initial runtime/source admission succeeded, then ACP entered its real pending-coordination transition and TerminalApp._observe propagated PendingRun: A bound ACP has not published its coordination root during terminal capture. Existing root retirement completed. This is neither a negative notification profile nor configured read/edit acceptance.

Before: only the initial AdmitOperation loop waited for pending source publication; later observations treated the same startup state as a fatal result. After: _observe owns one deadline for fresh read-only observation packets while PendingRun holds, and the admission-only loop is deleted. Exact process/display/resource checks remain. Foreign-root and other errors are NOT caught; xdotool input is outside the retry, so no failed/UNKNOWN input is replayed.

NRA's existing source/family query:27 modules/466 raw and canonical classes/0 local parse omissions;14,332 to14,333 syntax sites. Existing dynamic/alias/effect limitations remain OPEN. One compile and actual0402/3475-dependent tools import returned0. No pytest run. The NEW active-scroll-040347-02 attempt qualified this startup boundary and then failed at the distinct native catalog path described above. No notification/product change was made. The read-only sudo py-spy help/version preflight passed, but help output is not a performance capture.

1. Append/publication: preserve the painted prefix

Before:

• FollowTailCommit.extend → PreparedPageCommit.capture → PreparedReplacementViewportRequest → _publish_latest replaced preceding pages even for a bounded saved-source append.
• Access-only extension success was weaker than actual destination publication. It could permit live retirement before the known destination was painted.
• A cursor-after acquisition supplied ClosedHistory only a partial replacement, losing its prefix.
• Conversation.check_prune counted saved history as native/live pressure.

After:

• PreparedAppendCommit(PreparedPageCommit) inherits capture/draw/source-cut evidence and owns cursor-after acquisition. CommitPlan captures the read's publication member; TranscriptChanged fixes it to existing PreparedPageCommit for both full acquisition and later publication. The default remains complete acquisition.
• The source's declared commit_preparation chooses its acquisition contract: saved history appends; closed history acquires a full replacement. No consumer type roster or read-mode flag.
• TranscriptSourcePreparation.publish_append shares the existing bounded extension algorithm but requires current publication, no remaining known gap, and the requested actual published endpoint before destructive retirement. Access-only consumers retain their weaker contract.
• Live pressure derives from actual laid-out contents minus bound saved-history height. There is no mirrored counter.

Strict fragment same_source, inherited outgoing/native/source-cut capture, current/ready checks, locking, commit and retirement fences remain. Initial8739's two broken contracts were corrected in78e8, source-reviewed separately; no claim that its first local result was correct.

2. Actual app controls, including the admitted-read gap

The original five executed cases in tests/textual/test_transcript_presentation_fencing.py cover:

1. Original history/page/fragment identity and preceding paint after a real saved-journal append.
2. Known undrawn gap publication immediately after a witnessed admitted real read, before later lookahead can hide premature settlement.
3. Complete prefix acquisition after closing the same source.
   4–5. Actual laid-out live pressure below/above its declared threshold, excluding saved height.

History is not rewritten to make these pass:

• First run: 5 failed in31.94s, rc1, all in my stale Thread.project setup; no app assertions reached. Four callers now use the existing Thread.project_path declaration.
• Second run at0c987: 4 passed/1 failed in71.34s, rc1. The gap's publication attempt had not witnessed actual admission. publish_applied returning true can mean a guarded no-op; that source fact alone did not establish the prior failure's cause.
• Revised26a fixture uses existing HeldSourceCase: wait for actual read entry, form the known gap while held, release/join in finally, then assert immediate destination publication.
• Third run: 5 collected/5 passed in71.91s, rc0, setup/teardown complete. No implementation method patches, guard weakening, obsolete footer or compatibility property.

The existing pytest_session/TestLease, actual ceeed interpreter/Core/Textual, this checkout's Toad src/tools/tests and borrowed read-only pytest dependencies were used. Background INT300, no xdist/full suite/local gate. Origins and full output were personally read; inspected ac-private process query was empty after completion. Evidence under /home/ts/.cache/agent-scratch/pi-ui-performance/dm-app-controls-03/{origins.log,pytest.log,pytest.rc}. The two failed earlier runs remain alongside it. The lease was returned to the commander for combined main integration.

3. Startup observation replaces debugger attachment

Before:

ExecOperation → ptracer grant → exec launcher
TerminalApp observation → copy executable program → sys.remote_exec
capture_live → optional injected frame/heap/trace mutations

After:

OwnedDisplay(XvfbDisplay)
TerminalApp → StartOperation(PhysicalOperation)
            → one inherited read-only connection in the NEW frontend
            → installed distribution's declared Toad entrypoint
observation data → FieldCodec(ObserveOperation) → Textual.call_from_thread
AdmitOperation(ObserveOperation) → full entry/final runtime verification
StopRootOperation → existing private-copy retirement

No running-process injection, ptracer grant, signal handler, periodic wakeup, new controller or fallback. Only the selected new frontend inherits the reader; the descriptor is non-inheritable before later execs. Ordinary observations carry paths to bounded fresh typed data packets, not executable program copies. The declaration module stays alive while the entrypoint runs, avoiding a replaced __main__ codec namespace. Start/stop records are rejected by the observation family's existing decoder, not a manual operation roster.

The existing TerminalApp owns writer, st/frontend process lifetimes, current resource/source admission and cleanup. Exception/uncertainty retires the owned child without further observation/input. AcpRoots(MroProjection) is now declared once instead of reconstructed/registered on every observation; boundary answers remain unbound (), pending refusal, actual Agent coordination or foreign-type refusal.

capture_live.py now exposes read-only py-spy only. Injection, heap and arbitrary trace options are deleted, not hidden behind a permission flag. Frozen frame_meter.py, capture_history.py, history_capture_remote.py bytes remain unchanged and unrun; their historical injection route is forbidden by the current host permission. Their documentation is marked historical, not launch authority.

Adjacent old caller defect repaired: plain acceptance supplied no PATH although the existing CLI requires one. It now supplies the private home; ACP uses its own declared argument vector. The actual expandable Ready footer remains unchanged.

Execution limit: startup03 on installed0402/3475 executed the transport/admission and visibly loaded stopped saved history, then exited1 at the incorrect Ready-label probe described below. The new source-readiness probe remains unrun. Calling the distribution entrypoint does not qualify the separate toad-comms shell launcher; no shell-launcher proof.

4. Source evidence, not an execution passport

Before startup edits, the bounded NRA parser/syntax/family map covered14 modules,193 raw classes,192 canonical,1 OPEN,8337 sites,0 parse omissions. The broadened after map includes the real codec, family, dispatch and ACP dependencies:20 modules,406 raw/406 canonical,11751 sites,0 omissions. Two final diagnostic-message changes received targeted syntax reproof; unchanged records were retained. All maps keep hashes and original epochs. Later main-rebase dependency differences are explicitly listed in the pair qualification instead of silently treating old hashes as current.

Five changed Python files compile; actual owned imports, Observe/Admit codec roundtrips, Start/Stop refusal, StartedResult roundtrip, shared AcpRoots MRO and actual unbound/pending answers passed, rc0, before rebase. The first source controller caught the wrong unwrapped exception and failed; FieldCodec correctly returned MalformedRecord. Its failed log remains separate from the corrected result.

Evidence: owned Core platform-source/physical-startup-{before,after,final-source-map}.json, physical-startup-source-proof.json; scratch physical-startup-qualify-02.log/.rc, physical-startup-final-reproof.log/.rc. Rebase/import/native-input qualification passed rc0 at the stated0ce/615 heads:7 Core/14 Toad patches equal,12 Core/16 Toad retained feature blobs unchanged, main's DealPrompt fixture change retained, shell-script deletion preserved, owned imports/shared completion checked and native tree fb47af0285bbe987 pinned. Result: platform-source/current-main-pair-source-proof.json, scratch current-main-pair-qualify-04.log/.rc. Three earlier checker failures remain failed (whole-file assumption, mutable ref, deleted-file handling). The two changed mapped dependencies are Agent's GoalId annotation and AgentConnection's inherited goal defaults; their exact source diffs were read and no ACP-root declaration changed. Source map enumeration is not whole-package/dynamic/native/behavioral completeness or an authenticated method/default/alias movement certificate. Zero automatic moves admitted. The newly added observation-boundary pytest case and earlier17 model scenarios remain UNRUN.

5. Exact current-pair artifact and preparation

New genuine wheels at the dated0ce/615 source heads were built through existing cached Hatchling1.28, rc0, and made0400:

• Core:5,084,382bytes,636 Python members, real0ce WheelStamp/13 producer digests, SHA256 6701df2384ad6fe0c4953898b0e2924f0a53e5cc5d0fc1a1f7904d51b00fb52e.
• Toad:2,373,834bytes,312 Python members, SHA256 450bc2278c0260db8875a385cf3dce8a042d821b6ab963b5c5873a341e0d7bad.

Actual source members/duplicate and missing/extra Python checks passed; protected source/frozen inputs unchanged. Build receipt: pi-ui-performance/startup-pair-wheels-01/build-result.json, sibling log/rc, under owned scratch. No new environment/dependency install or production-root operation occurred during build.

The source-selected existing prepare-runtime CLI used actual ceeed Python, stock3.14.8 and the recorded ceeed dependency donor into NEW pi-ui-performance/startup-runtime-0ce615-01. Offline venv/install/check and native/package/runtime-resolution/client-import phases returned0. RuntimeStack reused the existing native cache; the historical custom debugger interpreter was not selected. A separate -I execution from the new prefix matched RuntimeResolutionProbe against its record, including exact retained archive bytes and stock native image, and imported actual installed Core/Toad/Textual plus the current tools snapshot with no Core/Toad source overlay, rc0. This is artifact/preparation/readback, not physical or production installation. The source-selected preparation parent is not an installed-CLI qualification claim.

Outgoing installed ceeed CheckRoot captured at most200 bus messages plus per-thread native history capped at200 records/1MiB into NEW startup-physical-0ce615-02/bus; its RootRuntime.publish then bound only that stopped copy to the new prefix, rc0. Original runtime-marker SHA before/after matched. The first standalone copy controller failed at unselected LaunchRoot before root creation; corrected02 uses the existing explicit selection context, no old-root reuse or model input. Original input/goal/native authority does not travel. Physical02 then failed rc1 as described above. Initial.png, complete ready-changes, startup/error.json and original traces are retained; its failed root is not reused. Existing owner/host cleanup completed, Xvfb177859/recording177861/st177862 have retired receipts and frontend177864 also checks absent. Literal PID checks show all four absent; no cleanup is inferred from a refused command.

Explicit entrypoint correction

The module footer used adjacent JSON existence to decide execution, so multiprocessing's actual _fixup_main_from_path re-import executed the startup request in a child with no inherited descriptor. The explicit Python main boundary now owns both startup and shutdown; ordinary and mp_main imports only declare classes. No manual roster or input-permission cache.

Four fresh isolated controls ran rc0: old real stdlib spawn-import writes its synthetic MalformedRecord error (demonstrated bad side effect); new real spawn-import and normal import write none; explicit execution still refuses the synthetic unadmitted operation. These are actual import/execution controls with no root/session/model packet, not replay of02. NRA retained20modules,408original/408canonical classes,0unprojected/0parse omissions (dynamic binding remains unproved);11758→11756sites, all class declarations/bases unchanged. Current-source compilation/import/native pin passed at ac062/8c8+guard; later Core-main cleanup is a separate source epoch. Receipts: platform-source/physical-entry-{before,after}.json and scratch physical-entry-controls-01/result.json, physical-entry-qualify-01.log/.rc. This is bounded syntax/family/import evidence, not a whole-program dynamic/MRO/effect certificate or installed new-pair proof.

6. Runtime/provenance and preserved isolation

RunTarget retains intended resources and recorded interpreter evidence. AdmittedResult belongs to one exact FrontendIdentity; ordinary RunObservation cannot substitute for build admission. Every physical input still checks current process/module locations, HOME/XDG/database/palette, actual storage rule, opened source, saved entries and bound ACP roots. Full archive/native hashing occurs at admission and successful retirement, not every key. These disk observations do not prove arbitrary intermediate mutation impossible or complete loaded-code equivalence.

Archive inputs grant neither Git ancestry nor production-lock reuse. Core#3825 separates recorded completion's exact-input reobservation from preparation/build's production-lock eligibility. Existing RuntimeStack/WheelRuntime/TargetStack behavior owns UV, completion, native preparation and worker retirement; no second installer.

Original8f runtime02 passed supported fresh preparation, own-installed completion, production-lock/repository refusals, modeled missing/changed interpreter-proof controls, second-generation preparation/completion and a real changed-member refusal by a NEW worker. Core wheel SHA 44270fd8fe394925925676cce891b49559251f2b2ab085bae3841e9ad5b4bd3e; Toad input was63af, not this PR.278 protected inputs unchanged. Its deliberately modified prepared/ remains negative; distinct for-carry/ is positive.

Original carry02 passed own-installed TargetStack.complete → ordinary stopped CheckRoot history → PracticeCopy/PracticeBus/PreparedMigration → one actual bus.sqlite3 reconcile/readback.22 declared steps were already current/0 pending and post-dry checks changed0, not22 historical conversions. Original source-copy files/three prefix inputs unchanged; workers/lease retired. It is not full InstallRun publication/rollback/harness, P867 original-coordinate retention, or frontend/native/provider acceptance. Earlier runtime01/carry01 controller failures remain failed; no replay/retrofit/relabel.

7. Historical physical and pager evidence — narrower epochs

Earlier7d0d-controller runs12/13 completed bounded stopped-history PageUp/PageDown/reversal/End/wheel and48×48→140×40 geometry in owned1600×1200 Xvfb, with actual package origins, private source/HOME/XDG/palette and exact child-retirement records. They had zero bound ACPs and do not qualify this startup replacement or incoming native tools. Run14 callback timeout remains inconclusive.

The historical CPython debugger-loader proposal and18 native controls/private functional stopped-history journey retain their own native/source evidence in the existing documentation. They are not permission to resume forbidden attachment experiments. No cap increase, global ptrace change or original-session replay follows.

Pager retirement's independent join copied the failed worker's active identity, causing Textual's genuine self-wait rejection. The existing preparation parent now creates its independent AwaitComplete in an empty native Context; all six descendants inherit it. Revocation, subscriptions, cancellation, joins and errors remain owned. That cleanup landed separately as#1394. Its exact59d app controls passed2/2 in31.58s with the earliera5b Core lifecycle source—not current installed/physical acceptance.

8. Physical03: saved paint works; the old probe was wrong

Fresh outgoing-owned CheckRoot copy physical-040347-03 ran the real installed0402/3475 entrypoint in plain st/OwnedDisplay with the existing TestLease. Original marker hash stayed unchanged. Inherited address-space limits were(-1,-1), not the old1.5GiB build wrapper. Startup/read-only pipe, build/resource admission and actual observations worked. frontend/ready-failed.png plus its st capture show real source rows and the expandable footer Stopped · … Saved history available; initial.png is the earlier waiting frame. The recording retains that transition. This is actual installed saved-history paint, not configured-native or full-journey acceptance.

The run exited1 because TerminalApp.show_thread demanded ▶ Ready from a copy CheckRoot deliberately stops. New RunObservation.history_published derives from the registered pagers' original state.reports_coverage; agent status is not consulted. All published-window geometry remains, including unready windows for blank-frame analysis. ScreenCapture retains the original RunObservation rather than copying its geometry. No product footer was changed, no stopped view was declared running and no failed03 root is reused. The replacement probe still needs a NEW run.

StopRootOperation returned Stopped. Exact-birth checks show frontend630570, st630568, recording630567 and Xvfb630565 absent, and private root host dead; retirement/process-absence.json, physical03-retirement.log/.rc0. Full result: owned Core platform-source/physical03-result.md. No UNKNOWN/provider/model input was replayed.

Source-readiness/retirement map:27whole modules,466original/466canonical classes,0local parse omissions,14341→14332sites; class/bases unchanged. Dynamic bindings/effects remain OPEN. Four files compile; actual tools import and two SYNTHETIC false/true publication codec states passed rc0, preserving the original observation and geometry. This is not physical acceptance of the new probe. Artifacts: platform-source/physical-ready-{before,after}.json, scratch physical-ready-qualify.log/.rc.

Errors53907's adjacent retirement fixture patch is deleted here: no patch.object, wrapper, entered-event or copied covered dictionary. The test holds the real output lock, waits for synchronous withdrawal of both original resources, verifies both remain attached while source/tree locks can be acquired, cancels the real worker and checks eventual teardown. Its coordination setup remains Errors1389's separate hunk. This changed app case remains UNRUN.

The1399 read-failure correction carried here shares PreparedCommit.capture and deletes both viewport-specific extend methods. Three NEW app counterexamples remain UNRUN: held closed-prefix[False] and same-path growing-file replacement[False/True]. The old five passes remain26a/ceeed only. No per-head reassurance run.

Still open — same owner

• A NEW candidate/run incorporating the publication-readiness probe and fe36 paint correction, with exact provenance and original sessions preserved.
• Actual configured read AND edit arrivals in the already-open warm one-to-one M view; appropriate identity, preceding paint, reader position, selection, drafts/undo.
• Hidden/reopen/tab-return plus the continuous saved-history/channel/tab/fork/first-message/arrival/scroll/reversal/End/resize/retirement journey; real visible frames and interaction/CPU measurements.
• Distinct default shell-launcher and remaining isolation/installer acceptance. Source locations/imports/screenshots alone do not establish these.
• New53577 ownership after this checkpoint: inspect retained Core3607+Toad1361 wire-cut lifetime and Toad1371 local identity reaching Path(None), without duplicate writers or abandoning read/edit preservation.

Assumed: candidate inputs remain immutable; the paired Core supplies the declared storage/interpreter APIs; ordinary CheckRoot imports stopped history and does not preserve original native/input authority; UI1391, Errors1389/3842, Shell1398 and Carry3829 retain their own changes. No new fleet, installed-package hand edit or physical acceptance from another head.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[github-actions]

debt-src at db8a6aa passes.

Warn-only, never blocks (3)

src/toad/widgets/conversation.py: GodClassExcess +6
src/toad/transcript_source_preparation.py: LintFindings +1
found LintFindings:src/toad/transcript_source_preparation.py at src/toad/transcript_source_preparation.py:325 (SIM102 Use a single `if` statement instead of nested `if` statements)