# Project Backlog

_This file owns unresolved project work only. Completed behavior belongs in `CHANGELOG.md`; durable contracts belong in `AGENTS.md` and `/docs`._

## Stable 0.59.0 release preparation

Outcome: integrate the retained working-branch changes into `dev` and release the stable minor after exact-candidate CI and the applicable acceptance gates pass. The operator authorizes the normal `dev` → `main` PR, release tag and existing repository-owned npm/GitHub publication workflow; no RC.3 publication is intended. Preserve historical RC.2 commits, original CI and all negative evidence without treating them as acceptance of new bytes. Planned warm custody-preserving recovery and private Input/Attachment foundations are not newly shipped capabilities.

- [ ] Collect all fresh Validate and Recovery diagnostics results for the retained successor and fix actual failures without replacing originals by successful reruns or weakening clocks, authority or case inventory.
  - [ ] Attribute the macOS headless `pi -p` exit failure: the original 20-second guard expired with empty stdout/stderr before the domain bucket ran. Capture fixture/module, session, provider, agent-end and shutdown boundaries through the isolated public-CLI producer without widening that guard or changing natural-exit assertions. Module evaluation follows static imports; missing phase output is not a diagnosed import stall, retained handle or cleanup-default regression. Preserve the original failure and actual signal/exit metadata limits; a later pass does not identify its cause.
  - [ ] Attribute the original macOS original-registration `source/work/connect-session` failure before the held native boundary and intended session replacement. Qualify failure-only counters and original diagnostic-log capture on successor CI; local synthetic capture checks do not explain that original timeout. Preserve the two-second predicate and enclosing startup/drain/job clocks, native concurrency, primary Error and all original negatives.
  - [ ] Qualify the consistent-load successor on supported-platform CI after the physical-read refusals. The local source/compiled native-publisher witness reproduces pre-read `opened-links` through the same original refresh; canonical serialization excludes it without guard recovery, while bypass/unrelated-guard controls retain refusal. This is not historical writer attribution or platform/live acceptance. Preserve the Windows 49/50 pre-fault result, all five failed successor cases, separate Restore ACK/menu and registration-entry timeouts, and macOS job-cap/missing-log negatives; no retry, cold-reader substitution, moved protection reads or relaxed history/identity checks.
  - [ ] Qualify the test-only portable publication witnesses after the Windows domain failures: derive the exact first refusal from the original observations, separate real publisher admission from commit after descriptor closure, and atomically publish the finished readiness PID. Keep the original failures, synthetic field partitions, wrong/bypassed-guard controls and all process clocks; neither a later pass nor the read-side correction attributes the unrecorded original errors.
  - [ ] Attribute the full local source Restore failure after held-menu release (`publicationUnconfirmed: true` despite completed pending work). Retain original source ACK/removal, HTTP-return and publisher lifetimes as separate facts. Failure-only capture must survive the dot reporter before cleanup and preserve the primary Error; it grants no successful-publication claim, replay or common cause with older Restore failures.
- [ ] Resolve applicable shipped-surface acceptance gates before calling the release ready. CI does not itself supply operator-loaded provenance or the separately required live checks below; any unavailable gate must remain explicit.
  - [ ] Qualify the approved new-install cleanup opt-in on the retained candidate: first config publication stores Off, existing files retain explicit values or their legacy implicit On, and a concurrent publisher's preference is not overwritten. Live settings and manual disconnect semantics remain unchanged.
  - [ ] Resolve same-session follower automatic restoration requiring manual Connect after process replacement and after the separately reported reload/resume. Preserve exact surviving Thread/slot evidence without calling manual restoration automatic acceptance. Attribute the original refusal predicate and loaded participants before selecting a correction; returned negative ACKs, explicit-connect readiness clocks, predecessor protection and accepted custody remain distinct. A report of reloading the current instance does not attest that the long-lived leader was upgraded.
- [ ] After required gates pass, merge the verified PR, confirm main/tree/version identity, push `v0.59.0` once and verify the tag-owned workflow's npm `latest` plus stable GitHub Release. Never race the workflow with manual publication.

## Runtime self-healing — high priority

Outcome: make authorized connection and recovery converge to one healthy leader plus acknowledged followers after supported local-state damage, startup races and transient transport failures, without treating uncertainty as lost work or fresh execution authority. This is a first-class reliability property, not automatic deletion of `tmp`. The [self-healing contract](./docs/architecture.md#runtime-self-healing-high-priority-planned) owns scope, current evidence and safety boundaries. Local design, implementation, isolated validation, RC-preparation commits/pushes and bounded independent subagents are authorized. The operator has redirected the retained RC.3 working changes into stable 0.59.0 release preparation on `dev`; the release checkpoint above owns current delivery. Preserve the accepted RC.2 commit and CI as historical evidence, not an immutable PR head. Live runtime-data changes, reload and forced takeover remain separately gated. Retain the adopted Active Drying carrying-cost constraints; do not substitute the currently missing exact Skill source or introduce a new drying refactor under absent guidance. Preserve useful capability, historical evidence and safety contracts; fewer lines alone are not surplus.

### Connection recovery checkpoint

Exit: supported damage recovery is reachable from default and named-profile connect, and a peer arriving before leader readiness converges through authenticated registration without a second poller, false connected status or a misleading takeover prompt. Preserve explicit takeover for genuinely competing live owners and restore-only startup restrictions.

- [ ] Attribute the missing canonical Workspace target after initial follower connect in the historical failed full Linux gate, before fixture damage/cancellation, using bounded fresh-process CI observations and retained original startup/registration evidence. Retain every failed cohort rather than replacing it by a later pass. Obtain independent review and separately authorized operator-loaded acceptance of execution-exclusion, Root source-reference forwarding, recovery diagnostics and generation-fenced shutdown corrections under the [local support boundary](./docs/architecture.md#runtime-self-healing-high-priority-planned). Keep the failed forwarding run's historical causes explicitly unattributed without same-origin evidence; the passing corrected candidate does not rewrite that run. Review both the original-transport issued-authority refusal and native commit-unknown after lost original IPC reply, without allowing arbitrary root-loss errors or treating pre-publication registration captures, copied transport fields or leader membership as original settlement authority. Preserve original binding/update identity, actual settlement, nonblocking cancellation, independent namespaces, atomic post-preparation recheck, original-authority fencing and refused reference admission before worker source I/O. Author Linux evidence does not certify legacy participants, cross-process exclusion or whole-writer closure; empty reference/execution indexes never grant replay/custody. No generic recovery supervisor, unbounded Pi-wide teardown wait or automatic reload.
- [ ] P1 — Select and implement an admissible warm same-profile reconnect boundary after loss/replacement of shared Workspace Restore evidence. Local/leader refusal attribution is diagnostic only; the live cached revision, process of origin and original private Restore/source/publication lifetime remain unestablished. Compose the actual Root leader live-rebind/warm-source-ACK/held-menu witness with production-root namespace loss. Keep the legacy caller-scoped durable ACK/held-worker witness distinct; establish the actual follower or retained legacy producer separately where needed, without disabling live-rebind capabilities to manufacture parity. Establish positive original reader/writer retirement after this producer's bounded source ACK and actual publication-work drain. Ordinary public Pi reload reconstructs Root but durably disposes waiting receipt groups; it is not a custody-preserving warm-reconnect path. Select a cutover preserving accepted custody or proving that original work genuinely ended; SDK idle and no Pi pending messages alone are insufficient. Keep remaining journal/SDK writer and follower custody closure separate from the local metadata-writer owner fence. Prove irrevocable original source-callable retirement or fenced use through actual Root/SDK/follower lifecycle ports; standalone owner probes, zero participating references and an empty execution index are not that proof. Do not substitute a cold/new reader, cached-reader/projection swap or silent authority recapture for original retirement. Current Root follower/SDK publisher closure and the reported live reader's provenance remain separately unproved. A canonical `finished` row is not publisher drain, and a warm ACK is not cold/durable reader authority. Exact source ACK and actual publisher/worker drain remain separate; private recipients, physical archive inspection and ended callback processing cannot substitute for those proofs. Require positive original-reader/source/publication closure rather than treating copied transport, physical source survival or an empty current root as cache-retirement or re-keying permission. Do not route the refusal into unknown-mode waiting or network retry. Preserve missing/rollback/same-revision and empty-operation ABA protections: absent snapshot, empty queue, equal identity or manually deleted directory grants no namespace rebase, replay or cleanup. Define positively fenced cache retirement/fresh observation versus required operator action, then falsify late completion and cancellation; never fix reconnect by unconditionally clearing `workspaceRestore`, dirty projections, guards or journals.
  - Retained follower producer qualification: establish the intact separate-OS Root follower control before missing-snapshot or valid same-revision faults. Retain real distinct PIDs, original `active-elsewhere` authority, normal capabilities, the actual selected-command plan, exact donor/recipient bindings/digests, held brokered HTTP and independent source/publication/lifecycle observations. The parent P1 safety and closure constraints remain binding.
    - [ ] Attribute pre-registration physical-read refusal and selected-menu `commit-unknown` separately from original failing evidence. Use finite `stateReadCondition` on the next genuinely failing physical read; it identifies the first rejected predicate, not the writer, cause or recovery permission. Use the retained Bus observer to distinguish ACK/rejection/transport from local authority refusal; capture native error/cause and actual issuance/return/ACK boundaries where available. The observer preserves surfaced boundary errors, not an internal cause already converted to a negative ACK; omitted native fields and child-local clocks grant no issuance or cross-process ordering proof. Preserve every original negative, including the model run that stopped before its mutation. No inferred common cause, damage, no-effect or replay grant, unchanged healthy sampling, or replacement of failure by later passes/review approval.
    - [ ] Pin original reader birth/first-observed revision before any status/Restore-view drying. Resolver creation, the first defined private snapshot (read or committed update), the separate parent guard and method return are distinct boundaries; an absent read's synthetic revision zero and a returned operation's revision do not identify that snapshot. Existing exposed ports do not report its installation; require an admissible producer-owned observation contract before adding instrumentation, not an extra list/read or callback retrofit. Keep exact retained-view correspondence separate from reader-birth proof; retain warm ACK, physical HTTP return, publication pending/unconfirmed and terminal original-reader/all-writer retirement as distinct evidence. No cold-reader substitution, cache clearing or rebase; actual SDK follower custody and operator-loaded provenance remain separate gates.
- [ ] Extend remaining multi-root/separate-process reset/profile-switch teardown coverage beyond the locally covered native callback-editor drain. Preserve pre-existing Restore/accepted-work protection and carry source-execution exclusion without treating a same-process index as cross-process or writer-closure proof. Reset itself is synchronous; distinguish genuinely awaited cleanup/publication work from a fabricated asynchronous reset, canceled but unsettled handler, issued SDK HTTP after returned reload or delayed return of settled refresh. Retain original generation/currentness across each real await, including quit-preference reads and disconnect completion. Preserve acknowledged default/named Threaded convergence, explicit Classic takeover behavior and original authority across late completion. Do not treat unit scope-fencing, cold damaged-envelope convergence or warm transport-drain witnesses as whole-runtime acceptance. Preserve healthy state/sibling sections outside the documented whole-envelope reset, accepted journal/queue custody and issued/unknown effects. Run focused falsifiers during edits, then typecheck and build/build-check. Extend the remaining composed reset/teardown cases without treating the passing damaged-envelope/issued-publication/retained-source witness as their closure. Refresh full native evidence after affected runtime/test changes; exact-head package/platform CI, independent review and operator-loaded live acceptance remain separate integrated gates.

### Recovery classification and operator evidence

- [ ] Complete remaining production-producer coverage of the recovery diagnostic matrix: unissued native IPC connection-wait diagnostics and existing transient-network backoff. Preserve finite guard reason/acquire-or-release phase and original API/IPC issuance evidence through existing debug/JSONL events; validate propagation at remaining wrapped/remote boundaries without inventing wire authority. Successful reset, transport acquisition, registration readiness, durable admission and actual execution/drain remain distinct. Unknown delivery outcomes never become retry permission, network/VPN errors must not trigger storage reset, and observed status changes alone do not establish their cause. No second health store.
- [ ] Obtain separately authorized supported-platform and operator-loaded acceptance of the integrated self-healing paths, including recovery outcome, one poller, exact Thread delivery, retained accepted work and truthful refusal. Do not manufacture damage in a live agent directory or treat the operator's manual deletion of `tmp` as proof of the previous fault or automatic recovery.

### Transaction guard resilience — design checkpoint

Outcome: close the live acceptance blocker caused by unidentifiable transaction-guard ownership without resetting journal data or weakening cross-process exclusion. The [proposed hardening contract](./docs/architecture.md#transaction-guard-hardening-proposed) owns design truth; no live storage recovery or new automatic repair is authorized by this checkpoint.

- [ ] Obtain independent review of the local first slice under the [guard hardening contract](./docs/architecture.md#transaction-guard-hardening-proposed). Preserve strict owner validation, no contention sleeps for unusable evidence, native causes and acquisition/release distinction; the native journal/polling witness must retain accepted work, cursor ordering and outer retry. Existing damaged guards remain protective. Local source/actual-dist falsifiers, affected-domain checks and the passing full Node 22 suite are author evidence, not independent review or platform/live acceptance.
- [ ] Resolve the Windows claim-primitive blocker before adopting the proposed owner/claim codec: two concurrent source-marker renames reported success in RC CI. Select and falsify genuinely exclusive cross-platform claim semantics; exercise the actual existing v1 recovery composition to establish whether that raw primitive counterexample reaches duplicate protected execution, rather than inferring it. Independently review the codec and close its native implementation proof before enabling any new writer or metadata-loss recovery. Preserve the reserved namespace, immutable original identity and separate current recoverer; live/current-process PIDs cannot become dead through missing in-memory membership. Prove exact occupied-directory/marker identity, private claim continuation, interrupted release/reclaim and actual loaded/forked-build compatibility. Extend the archived-reader checks to supported platforms; the local tagged-closure, current-reader and real-process filesystem witnesses do not prove the future production kernel or live fleet compatibility. An identifiable absent process may support recovery; a live/unverifiable PID, legacy empty owner, conflicting evidence or a copied locator may not. Do not add a native dependency, hot-path process-spawn requirement, broad registry or capability-as-writer-closure shortcut.
- [ ] Obtain supported-platform and separately operator-authorized live acceptance after reader/writer compatibility is established. Recovering the already damaged legacy guard remains a separate exact-target maintenance gate requiring positive writer exclusion and preservation of all journals, originals, bindings and issued/unknown effect fences. No age-based deletion, state-envelope reset or inferred idle-state permission.

## Declarative interaction APIs minor release

Outcome: ship the declarative-interaction release with simple producer-requested SDK functions, the existing Confirm capability and hidden `/quit`, plus the composed agent UI contract and delivery checkpoints below. Keep narrow APIs rather than a universal dialog factory or general UI/workflow framework. The feature release is not ready until both SDK and composed-surface acceptance pass; version selection follows that stable boundary. Share appropriate mechanics inside existing Delivery, routing and inbound/media owners; do not add an interactions domain, runtime registry or package entrypoint merely because more public functions exist. Producers retain business execution, approval policy, operation/target validity and disposal. Public direction lives in [public-api.md](./docs/public-api.md#planned-declarative-interaction-apis); ownership lives in [architecture.md](./docs/architecture.md#confirmation-requests-planned). No separate design document. Autonomous local implementation and the necessary narrow private original-binding/provider checkpoints are authorized through pre-release preparation; do not request repeated permission for ordinary local design, edits or validation. Preserve existing ownership and no-subagent constraints. Actual quit, live probes/reload, runtime-data changes and external publication remain separate operator gates.

### Declarative interaction acceptance

- [ ] High priority — Attribute the reported roughly 15-minute button refusal to its original lifecycle in the running candidate and correct any remaining defect. The exact control kind, effective original deadline and refusal cause are not yet established; do not treat reported age as a diagnosed TTL bug or the current source default as proof of the loaded runtime. Use the [independent retention/status contract](./docs/architecture.md#independent-menu-and-callback-retention), not a blanket increase in TTL or capacity.
  - Identify one original publication and failed tap with redacted correlation, control kind/namespace, original birth/deadline, effective configuration and actually loaded runtime build. Separate ordinary prompt buttons, agent/SDK questions, app controls and harness menus. Distinguish elapsed TTL and original explicit cutoffs from tail admission, capacity eviction, trimming, group supersession/spending, owner/target loss, session/store replacement and whether the loaded runtime supplies the finite retirement/refusal reasons. Record the actual earlier transition rather than infer it from current equal fields or restore lost authority.
  - Preserve the adopted clock contract: default question birth may allow 24 hours, a qualified predecessor receives only its original bounded tail, and earlier explicit/original deadlines and terminal state win. Tail transition is not a continuously decreasing sliding TTL based only on button age. Fix only the evidenced cause; do not revive spent/lost controls, renew first-physical ancestry or bypass capacity, binding, execution or selection guards merely to keep a button clickable.
  - Remaining falsification/exit: correlate the original failed tap and loaded build. Add a native regression only for a newly evidenced path not covered by `Native button retirement distinguishes early pressure from elapsed TTL`, `Native published defaults do not become fifteen-minute TTLs`, publication-address refusal and existing qualified-tail/lifecycle witnesses. A still-live control must remain actionable through its actual authorized deadline; genuinely terminal controls must refuse with a truthful diagnostic reason. Obtain separately authorized exact-tap/live acceptance after operator-controlled loading; no reload, runtime-data mutation or publication is granted by this report. Coordinate with the existing startup/button acceptance checkpoint below rather than duplicate its delivery claims.
- [ ] Independently review and operator-live-accept the [corrective startup/button checkpoint](./docs/architecture.md#corrective-session-auto-start-local-unreleased): no extra Thread for a temporary unbound same-CWD session before real resume; ordinary prompt-button 24-hour default and visible refusal-only expiry/capacity status; redacted startup/retirement diagnostics. Local native/compiled validation is not proof of the exact reported tap or deleted tab. Do not reload, touch runtime data/tabs, publish or bypass the other release gates without separate authorization.
- [ ] Live-accept [agent Confirm/Choice markup](./docs/public-api.md#agent-selection-markup) after operator-controlled loading: neutral buttons, pressed-only color and exactly one ordinary contextual prompt with captured selection metadata. No new agent tools, hidden SDK waiter or result-inspection API. Source/compiled checks and the earlier SDK-tool demo are not live acceptance of this markup path.
  - [ ] Recheck collector Cancel after operator-controlled loading of the feedback correction: neutral before activation, red after cancellation, preserved option feedback and one contextual cancel answer without a partial set. The prior direct/Threaded live check delivered cancellation but left Cancel uncolored; semantic completion alone does not close this visual gate.
- [ ] Adopt the [shared Input and question lifetime standard](./docs/public-api.md#shared-input-and-question-lifetime-standard-adopted) through bounded local checkpoints; no reload, live probes, production readiness or publication is granted by the implementation approval.
  - Implement the adopted voice-as-text path for explicitly opened built-in and companion Inputs through the existing inbound/STT pipeline, after the accepting-source/private-foundation gates. Capture the original request/source/target before transcription and recheck it afterward; missing support, transcription failure or empty output must leave the original still-live Input available for correction without deadline renewal or model fallback. Late transcription must not answer a replacement or expired request. Apply each consumer's same typed/transcribed value policy: the Name consumer safely truncates to its own name limit, while other Inputs retain their own bounded rules. Falsify with typed/voice equivalence, configured provider selection, missing/failing STT, replacement/cancellation/expiry during STT, and overlong/invalid Unicode names; prove original source disposition separately from value delivery.
  - Complete the remaining original-physical histories under the [pre-release composition boundary](./docs/architecture.md#declarative-interaction-pre-release-composition-boundary). Bounded direct/follower joins now include the [one-attempt timed refresh publication](./docs/architecture.md#timed-refresh-publication-join-root-bounded-original-source-one-attempt), with mixed or pure-question output, no fake callback and original SDK/app/source capture. Reconcile the unsupported histories below against the [production inventory](./docs/architecture.md#question-lifetime-production-composition-inventory-read-only); intentional refusals are not missing master switches. Remaining work is bounded composition/acceptance, not another SDK/worker/finite-event/typed-matcher inventory.
    - Use the [current production support boundary](./docs/architecture.md#question-lifetime-production-composition-inventory-read-only) rather than repeating completed wire/capture/join inventories. Distinguish an unproved positive proposal from mandatory refusal: missing/foreign/incomplete/spent/lost provenance, ACK-time owner substitution and later ancestry renewal must stay refused while independently owned selections/methods/UI remain useful. Preserve the bounded direct/follower first sends, known-parent edits, callback/timed children and one retained native Rich group. For any additional general app-parent, edit-first/footer, state-writing/cold, multiple-feedback/intervening-view or partial/multiple-retained proposal, identify a concrete original producer/physical transition before planning qualification. No flag-only activation, replay through a raw call, equal-field result, current bot/locator, Artifact incarnation or replacement SDK owner supplies that proof.
    - Resolve the producer-contract gate for [native Text/keyboard retention](./docs/architecture.md#retained-textkeyboard-native-root-assessment-carrier-intent-held). Source/actual-compiled Root assessment finds that worker-emitted Rich callback rows do not enter an HTML-rendered Text reply keyboard: the old group is superseded while fresh questions still qualify and answer. The current string-output ABI supplies no original retained-keyboard proposal; lowering the separate follower Rich-only policy cannot repair that absence. Keep the proved Rich subset unless a concrete producer-owned Text representation is explicitly selected within scope. Before any runtime widening, establish original intent/group-to-keyboard transport in existing app/planner/rendering owners, without general old-control discovery, a new retention API or main-side copied-key substitution. Preserve original source/worker/result/publisher/SDK/bot/Thread, whole-roster, clock/selection and actual-drain proofs; non-superseding markup with embedded old Rich rows remains separately held. This is an unresolved design/scope gate, not a missing Root flag or live-test substitute.
    - Preserve original group members, spent attempt, app/SDK/publisher/source authority, birth, deadline and first-physical ancestry across all integration. Original ACK-time SDK/agent cohorts and one authenticated numeric conditional ceiling never reselect newer heads; all included groups qualify together. SDK callbacks precede native app FS and trusted data, with no later provider/getter/FS callback. Earlier producer cutoffs and terminal state win; no pending/reborn/promoted head, extra hour for replaced Input, dummy ordinary control, new registry/timer/waiter/receipt/executor or implicit selection dispatch. A live app-bound first-physical publisher may retain its binding after its original question ends until that publisher's actual drain. Use the [timed source retention/drain boundary](./docs/architecture.md#timed-source-retention-and-drain-native-sourcecompiled) as the established mixed/pure control/result/I/O region; broader histories need their own native witness, never authority clearing/rebasing to satisfy GC.
    - Keep standalone-app retention intent separate from the labeled main-side retained-cell fixture; equal prompts/keys/revisions are not intent or lineage. Obtain independent integrated review, supported-platform and operator-authorized live acceptance after an explicitly loaded candidate; local source/actual-dist/native/GC validation cannot close those gates. Use the existing `Conditional SDK tail`, `Retained question parent`, native graph/GC families and full-package gate to falsify changed composition; do not repeat the unchanged full suite merely for context edits. Local Root/default integration is now authorized subject to those original-authority proofs; public Text/v5/readiness, receiver IPC, reload/runtime-data changes and release/publication remain separately gated.
- [ ] Re-land the private Text Input and Attachment Request foundations after their gates. The unreleased tree that contained them (Text Input kernel, `openTelegramTextInput()`, `openTelegramAttachmentRequest()` preparation, Input custody v4, journal v5 source protection, warm Attachment disposition/reconciliation, captured-file seal and consumer-lease accounting) is preserved as local branch `wip/private-input-foundations`; its code, tests and design records are not part of this release tree, and no public opener or readiness is shipped. Restoring them also restores the `/name` migration to the common Input and the foreign-receiver/custody work, each with its own gates (independent integrated review, supported-platform and operator-authorized live acceptance, exclusion of older writers before any v5 publication). Re-land by rebasing that branch onto the then-current baseline and re-running its falsification suites, not by recreating them from this file.
- [ ] Complete supported-platform and separately authorized live acceptance for [unreleased Artifact Delivery](./docs/public-api.md#artifact-delivery-contract-unreleased) under the [runtime contract](./docs/architecture.md#artifact-delivery-unreleased-bounded). Exercise descriptor identity, symlinks/special sources, pending-I/O cleanup and authenticated follower/socket behavior on supported platforms. Validate real direct/follower Bot API receipts only with explicit live/reload authorization. Local source/native, compiled public-consumer and full-suite acceptance do not establish these gates or authorize publication.


### Minor-release readiness

- [ ] Attribute retained historical native failure classes and establish severe missing-output coverage separately from the accepted [author platform checkpoint](./docs/architecture.md#runtime-self-healing-high-priority-planned). Use original native phase evidence or a causal same-port fault, not more unchanged healthy samples. An accepted retry cannot identify the old cap or SDK cost, certify body/descendant/writer closure, or replace independent review and operator-live acceptance. The one-shot infrastructure retry exception is spent; do not infer permission for another retry, metadata-only CI trigger or clock increase.
  - Attribute the original follower SDK `app-mixed-feedback-child-pure-queued-editor-admission/rich=false` failure using its actual original producer. `two-production-roots-native-carrier-checked` precedes shutdown/cleanup and supplies no elapsed phases or drain proof. The fixture now records bounded PID/monotonic import, connect, publication/editor and shutdown/cleanup checkpoints plus a finite public resource-type census; fifty-four Source/compiled representative cases pass locally. Missing cleanup, private-field/phase and retained-post-cleanup-handle countermodels fail their guards; a deliberately retained timer still hits the original twenty-second watchdog after both shutdowns and cleanup return. Current-head macOS 5/8 passes all 318 registrations including this case and the new parent guards. This establishes observation and a passing sample, not the historical cause or body/descendant/writer closure. Retain all original assertions, exact 2504 registrations and four/eight-way allocation. The old twenty-second whole-child/twenty-five-second outer profile remains historical evidence; the current separately bounded import/work profile never renews execution or runtime readiness. Use the next original phase evidence or a causal same-port fault to select the correction, not another healthy sample.
  - Attribute the original severe missing-output failure class without substituting later successful native receipts. `98811d2` macOS 2/8 starts at 00:09:46 UTC and settles cancelled at 00:44:46 with the authoritative thirty-minute-cap annotation; last API metadata leaves integration active, but individual logs are HTTP 404, the complete nineteen-job archive omits it and no corresponding artifact exists. No actual checkout, compiler, test issuance or active case is established. Preserve this recurrence separately from the earlier pre-test build cap and ordinary follower test failure. Initial three-OS build service receipts now match original native records, including compiler identity/outcome; commit-versus-check and severe evidence-loss durability remain separate. Local Node 22 real-compiler evidence and native fixture falsifiers now establish the eight-record body-free projection, independent invocation identity, unchanged non-CI argv and rollback/refusal behavior; the [author platform boundary](./docs/architecture.md#runtime-self-healing-high-priority-planned) owns that evidence and its limits. Keep `spawnSync`, rollback-safe publication, thirty-minute CI allocation and SDK clocks unchanged. Preserve `1aaf93d`'s authoritative pre-test cap plus missing individual log, nineteen-job archive and absent artifact as an unattributed original: neither later healthy samples, Node preload entry, a detached HEAD observation nor operational public-service status proves its compiler execution, clean checkout, filesystem/CPU/runner cause or process drain.
  - Attribute the original `07c8eb7` `Production separate OS startup converges through original admission (source/work/cancel-before-ready-threaded)` failure: macOS 1/8 returns native 1 with 312 passes/one failure before either Root reports ready or any connect result exists. Use the next genuine failure's original ordered import/checkpoint evidence to identify the ten-second startup stall, not more unchanged healthy sampling. The later `5bd838f` native thirteen-phase pass does not attribute its module or CPU/storage cause. Preserve the first Error through both actual closes; progress cannot become readiness or renew startup/drain clocks.
  - Establish bounded original-progress evidence through the existing CI/test-reporting owner before changing allocation: `07c8eb7` macOS 8/8 and `5bd838f` macOS 3/8 each have only an authoritative thirty-minute job-cap cancellation, individual HTTP 404/`BlobNotFound`, a complete nineteen-job archive omitting that job and no recovery artifact. Qualify `scripts/ci-test-progress.mjs` on the corrected exact head and the original severe missing-log failure class. Completed POSIX jobs and one natural macOS job cap now have matched native/service notice evidence under the architecture contract; that witness does not prove in-flight visibility, every quota case or retention when original logs and artifacts are both lost. The reporter remains beside native TAP only for integration CI with exact `GITHUB_ACTIONS=true`: `test:dequeue` precedes a held body's completion, `test:start` is reporting order and `signal: null` does not exclude handled cancellation. Preserve native code/signal, every exact registration, native test completion and original-body settlement separately; the timeout probe proves completion can precede body drain. Bound labels/fields/output and refuse body/error payloads. Keep the demonstrated service receipt/post-cap retention scoped to its original head, job and captured records; obtain corresponding evidence before extending that claim to another cancellation path. No extra runtime supervisor, renewed deadlines, last-active-case guess or shared module/resource attribution. Require original native progress on a justified changed candidate, complete exact-head CI, all twenty wait/expiry cases per OS, exact existing Windows exclusions and unchanged clocks. Recovery 150/150, later macOS passes and the new ten-second startup-control passes on all three OS do not close this gate.
- [ ] Attribute the historical Linux `Production separate OS startup converges through original admission (source/default/simultaneous-malformed-threaded)` failure: use the next genuine failure's saved original connect results, guarded startup/publication observations and existing bounded JSONL before teardown. The old run retained only one leader creation versus two; the native authentication-rejection countermodel validates the diagnostic/primary-error boundary, not that historical cause. The `9b7fdd1` exact-head platform checkpoint and corrected selected-status fixture are verified under the [author platform boundary](./docs/architecture.md#runtime-self-healing-high-priority-planned), not retroactive attribution. Preserve two distinct acknowledged targets, one poller, authenticated registration and existing clocks; no one-Thread fallback, weakened assertion or unchanged healthy local sampling.
- [ ] Attribute the historical actual Pi SDK `auto-overflow` compaction wait failure from macOS integration 3/8 using original native producer phases or a causal same-API witness. Preserve the two-second completion observation, deliberate 1.1-second compaction hold, thirty-second test cap, exact once-only queued injections, status-command history and real SDK teardown. Retain bounded provider/start/handler/completion evidence before cleanup; request/handler entry and elapsed time are not completion. The diagnostic distinction between held, aborted and never-started compaction is now validated with native public-API countermodels, but does not identify the historical cause. A later full platform pass cannot close attribution; no larger timeout, invented cause or unchanged rerun for green.
- [ ] Attribute the new exact-head `c6b31f0` macOS 8/8 SDK startup failure at ordinal 180 (`source/true/timed-direct-parent-loss/rich=true`): original PID 28467 expires at the unchanged ten-second startup boundary after a 7.739-second outbound import span, with `mock-import-bindings` at 8876 ms and no later phase/readiness. The owning import closure exposes an unnecessary eager Pi SDK barrel load through `outbound → queue → pi`; source/compiled cold-import refusal fails the original adapter, while the corrected adapter defers that dependency until settings use and retains actual installed-SDK persistence. The accepted platform checkpoint does not attribute the historical 7.739-second CPU/filesystem/module cost from this dependency proof alone. Preserve the macOS SDK-root `source/true/retained-text/rich=false` recurrence and first `f3c01dc` macOS 3/8 `source/false/partial-retained/rich=true` startup failure at their distinct original native import/mock stages. The latter's PID-bound phases show a 6.111-second outbound import span and a 2.003-second bindings import span before the original ten-second startup expiry; capture causal module/resource evidence instead of assuming these timings identify the earlier fault. Keep the ten-second startup, ordinary/timed twelve/twenty-second execution/drain, separate hard total and parent caps unchanged; PID-tagged intermediate progress cannot acknowledge readiness or renew a clock. Unavailable cancelled-job logs cannot establish which case was active; later complete platform passes do not attribute that original importer fault. Do not rerun unchanged inputs for green. The original Linux `Production question root uses original SDK binding at birth, not ACK (source/true/lost-sdk/rich=false)` failure and earlier Windows cold-Root expiry remain unexplained; do not transfer the later macOS timing observation to them. RC first-pair dispatch also reached five seconds on all three platforms in one name shard while isolated and nearby-root checks pass. Its fresh agent/token fixture, phase/events diagnostics and abort-triggered captured shutdown must establish whether the shared-state dependence is removed; the original five-second bound remains. Preserve original authority and actual worker/editor/process drain. Passing checks alone do not certify the earlier cause.
- [ ] Complete guarded `0.59.0-rc.2` prerelease publication after final intentional-tree/package checks, fresh exact-head platform CI and operator-loaded live acceptance. Preserve the bounded independent review's scope and the unresolved warm-custody/original-writer limitations; no whole-repository certification follows from approval. Immediately before tagging, bind the approved merge, `origin/main`, package version and immutable tag target. Only the existing Release workflow may publish npm `next` and the non-latest GitHub prerelease. Local/native evidence is not live Telegram acceptance.
- [ ] Promote the candidate to the stable minor version with truthful public schemas/examples, bundled Skill guidance and release notes only after all accepted SDK and composed-surface checkpoints pass integrated acceptance; use the guarded dev-to-main release flow only with explicit publication authorization. Do not reload this Pi session or run live Telegram/deletion probes without separate approval. Any subsequent candidate head requires fresh successful domain/integration CI for that exact SHA; cancelled checks and previous-head results are not success.

## Composable interaction surfaces delivery

Outcome: deliver the [target contract](./docs/architecture.md#composable-interaction-surfaces-planned), not stop at an exploratory note: composed Markdown UI, producer-adaptive results, optional agent-authored IDs, Choice JSON/CML matrices and single/batched Choice orchestration through release acceptance. This extends the declarative-interaction release scope; it does not authorize publication, live probes or process control. Frozen wire schemas live in [public-api.md](./docs/public-api.md#declarative-ui-markup-planned). Only remaining work lives here; do not add a competing plan/design file or treat a written proposal as working behavior.

Agent selection and companion SDK work are separate planes. The operator now explicitly requests Choice arrays as automatic sequential wizards and exact-N multiselect, with one lightweight ordinary prompt only after completion. No new agent tools or mirrored SDK envelopes. Runtime owns bounded selection/advancement; Skills own when to use single Choice, wizard or multiselect. Local SDK Text Input work is resumed separately; agent Text/Attachment formatting remains deferred. Private SDK source/pin work cannot activate production readiness, reload or live acceptance.

### Remaining Agent Surface Work

- [ ] Obtain operator-loaded live acceptance of the lightweight single/wizard/multiselect contract across direct/follower and Classic/Threaded modes after local package checks. Reload/loading remains operator-controlled. Use a harmless single Choice, two-step wizard with an exact-N step, cancellation and neutral/post-press color checks; require one final JSON result and no intermediate model prompts. Prior live Choice/Confirm proves only the older single-question path. No companion SDK, Text/Attachment, production-v4 or publication readiness follows.
- [ ] Define and implement agent Text/Attachment formatting and ordinary reply-to-prompt behavior separately from private companion SDK collection. Preserve sender/target/reply and media/file-use boundaries; do not expose tools, capture arbitrary next input or route private SDK replies to a model. Falsification: exact replies, ordinary context and existing media admission, no hidden SDK waiter/fallback, bounded files and truthful refusal.
- [ ] Finish supported-platform and operator-authorized live checks for the integrated markup candidate before guarded release. The local source/actual-compiled/public-package gate is satisfied, but Linux fixtures do not establish Darwin/Windows behavior, a loaded running instance or client-visible feedback. Whole-release independent review remains a separate readiness gate.

## Queued prompt editing through shared Input

Outcome: edit the text of one exact waiting queue item through the common Input, using either typed text or the adopted voice-as-text path. This is a future feature, not implemented or included in RC.2; depend on the shared Input's accepting-source and privacy gates rather than adding a separate collector or transcriber.

- [ ] Add the queue item's Edit action and bind the Input to stable item identity, not its mutable visible ordinal. Replace only the editable text; preserve queue lane/order, attachments and durable source/receipt authority. Revalidate the exact item on completion: dispatch, deletion or replacement during typing/transcription must refuse the stale edit, never update another item or mutate an active/Pi-owned pending head. Falsification: text/voice equivalence, concurrent queue movement, removal/dispatch during STT, retained media/receipts and no ordinary model prompt or duplicate task from an editing answer.
- [ ] Decide explicitly whether opening Edit pauses queue dispatch and, if so, its exact scope and release conditions. Voice support does not select a pause policy; retain this design decision before implementing dispatch coordination.

## Slash command discovery

Implemented locally: bare `/` and unrecognized bot-command-shaped slash text answer the full public catalogue before the model; see the [command contract](./docs/public-api.md#user-facing-api).

- [ ] After separately authorized live loading, confirm in the Telegram client that the catalogue renders with tappable command links for a lone `/` and an unknown command, in Classic and Threaded modes. Held/rerouted chooser inputs still bypass discovery and keep the ordinary prompt path; decide separately whether they should answer it. Local native fixtures are not live client acceptance.

## Disposable Thread live acceptance

- [ ] After separate operator authorization, use disposable Telegram tabs to check leader Settings review/Back, one confirmed cleanup of an inactive slotless binding, preservation of its replacement letter holder, and visible outcome/recovery copy. Native filesystem and injected-transport tests do not prove live Telegram/client or native Windows acceptance. Never use production history as the disposable fixture.
- [ ] On separately authorized disposable routing tabs, verify pending-choice protection, Cancel after the view becomes unavailable, expiry notice in the owned leader Thread and no duplicate deletion after an unknown outcome. Local native journal/API-decoder fixtures are not live client acceptance.

## Typing authority during Telegram turns

Live report on package 0.58.2 and Pi 1.4.0: every Telegram turn logged `sendChatAction: Telegram API call authority is unavailable` in a connected, long-lived session. The reporter's leader/follower role and refusal stage are not yet known. Prompt-cache acceptance is complete; this is a separate typing-indicator investigation.

The native expired-loop diagnostic case is corrected: real typing loop/starter, direct API runtime and API client regressions cover mocked HTTP 200 after stop/same-target replacement, with unchanged session generation and transport epoch. A process-local ended-loop observation suppresses only the corresponding typed authority diagnostic; the request still rejects, active-owner refusals remain visible, and no callback crosses IPC. Real-client regressions retain the original HTTP/network failure when authority expires during error handling; a native follower caller rejects a delayed ACK after its local owner ends, without replay. Direct/follower and Classic/Threaded paths remain distinct from live acceptance. This does not establish the cause of the reporter's live failure or prove client typing.

- [ ] Correlate the live report with the corrected native case using only redacted leader/follower role, timing around loop end/replacement and refusal-stage evidence if available. Do not infer transport loss or widen authority from the error string alone; isolate any distinct current-owner refusal before another runtime change.
- [ ] After separately approved live validation, confirm client typing and absence of expired-loop API noise across Telegram turns and loop replacement. Preserve exact Thread targeting, independent Thread requests, best-effort presence and no unhealthy-status escalation; local native fixtures are not live acceptance.

## Stuck forwarded command after Thread re-creation

Evidence (2026-10-23 07:11–07:16): a `/start` sent in a former leader tab moved into a follower's journal as a raw original. After that follower's Thread was re-created by the restore probe, every execution attempt failed with `Telegram bus API call is not allowed for this follower` and retried every 60 s indefinitely, because the reply targeted a Thread the follower no longer owned. Terminal settlement alone is unsafe: the same rejection can be a benign race during a live-rebind pre-dispatch.

### Post-refusal reply-only recovery — deferred contract gate

Remaining scope is recovery after a reply is refused or recipient authority changes during publication, not initial destination selection. The latter is specified under the [reply ownership boundary](./docs/multi-instance-bus.md#reply-recovery-ownership-boundary); its native regression covers a stale source address, not the historical refusal itself or live Telegram restoration.

A target-scoped reply refusal cannot prove that a command made no prior effects. Keep the handler-replay containment while preparing a replacement: unresolved inputs must remain in ordinary durable retry state, not be silently completed or retargeted as whole commands. Ordinary journal execution remains at-least-once, not globally exactly-once.

- [ ] Obtain explicit approval for a post-refusal recipient-delivery contract, then implement recipient-scoped reply-only recovery under the [reply ownership boundary](./docs/multi-instance-bus.md#reply-recovery-ownership-boundary), outside the containment hotfix. No ordinary recipient-scoped send grant is composed today: the local execution fence and queue-owner identity are insufficient, and receipt/admission namespaces cannot substitute for the registered recipient profile key. Ordinary sends return only a message ID, so the menu/delivery owner must participate in any destination change. Reuse selected-menu delivery only with its exact retained live-rebind/source grant; a raw journaled command cannot borrow it. Capture and recheck recipient/profile/session/registration authority at both ends, with no widening of the ordinary proxy.
- [ ] Prove the reply-only path with the real follower API caller and worker: one replacement send before any reply chunk is acknowledged, consistent callback/message ownership and destination across every chunk, no stale reply anchor, no recovery for deletion/editing/unknown or lost ACKs, and no second send after authority changes. A command effect before a refused reply must execute once within that admission attempt; original journal evidence stays unchanged and diagnostics cannot change a successful outcome. Run typecheck and the full suite at the stable boundary. If these proofs cannot be supplied, retain the input without handler re-entry.
- [ ] Live acceptance after the reply-only recovery checkpoint: a forwarded command whose follower Thread was re-created is answered in the current Thread (disposable tabs only).

### Remaining routing investigation

- [ ] Close deferred last-Cancel cleanup acceptance under the [native boundary](./docs/architecture.md#deferred-last-cancel-cleanup-boundary-native-assessment): obtain independent review and supported-platform evidence for the composed transport and fresh-session replacement. Before operator-controlled loading, upgrade every shared-state reader/potential successor; v2 advertisement alone does not upgrade old binaries or authorize effects. Live acceptance requires separate approval and disposable tabs: real independent receipt protection, exact-owner disposition, later same-session cleanup, legal replacement vetoes and no retry after an issued unknown outcome. Preserve all originals/custody and keep the broader orphan-to-fresh-tab flow separately gated.
- [ ] Resolve cross-tab historical `retry-wait` protection that prevents last-Cancel cleanup of an otherwise empty unbound/routing tab. The native `Native temporary cleanup census protects` regressions reproduce completed source cancellation with deletion withheld by another session's failed `/start` or callback; an unrelated plain pending input is the positive cleanup control. Generic failure has no original effect/recipient certificate, so source target, elapsed age, absent queue receipt or an empty visible menu cannot safely exempt it. The private exact v1 operator path now handles explicit consent; automatic exemption for unknown historical execution remains unproved and must retain protection. Complete a supported disposition/recovery workflow or earn original recipient/effect evidence before narrowing automatic protection. Preserve unknown effects, retained originals, custody and no-replay; do not erase files, bypass the census or mutate live journals under investigation permission. Recheck fresh complete protection before any separately authorized live deletion. Contract: [failed historical cleanup inputs](./docs/multi-instance-bus.md#failed-historical-inputs-and-last-cancel-cleanup).
- [ ] Find why the temporary tab's selected `/start` stayed unresolved until expiry, and why that Restore moved custody without applying the rebind.
- [ ] Route an input that arrives in a tab bound to nothing through a fresh temporary routing tab (the All flow) instead of publishing the chooser in the orphan, deleting the orphan with it once nothing unspent remains. Needs its own durable-metadata design.
- [ ] Live acceptance on disposable tabs only: Cancel on an orphan tab deletes it; a second unspent input keeps it until the last Cancel; a plain `std::map` option button is delivered as an ordinary prompt.

## Follower liveness under leader load

Local log evidence (2026-11-03, leader plus follower, loaded host): follower heartbeats timed out twice within two minutes while follower `getMe` probes took 1.5–14 s; each recovery re-registered the follower under a new generation, rejecting a callback forward already in flight (`forwarding ownership changed`, then `Stale follower registration generation`). Corrected locally: the follower probes its live registration before re-registering, a slow forwarded tap is released after about 1.5 s, the retryable-forward toast no longer claims foreign ownership, follower callback answers ignore Telegram's expired-query rejection, and the Thread capability rides the heartbeat acknowledgement instead of per-follower `getMe` probes. Responsiveness is the priority: no multi-second caching of capability state, and detection of a dead follower must not slow down.

Measured on a copy of the live state (2026-11-03): reading and parsing `state.json` takes about 0.7 ms, writing and renaming it about 0.3 ms, appending a log line about 0.01 ms, so state transactions hold for a few milliseconds and contended 25 ms lock waits cannot explain multi-second stalls. The leader processes also ran at 60–70% CPU, so busy JavaScript in the same process (the host application's own turn work or rendering) is the leading suspect, which extension code cannot unblock; the stall record's `cpuMs` and `blocked` fields separate these causes.

Finding that changes the earlier hypothesis: heartbeats already use their own connection per request and the leader's heartbeat handler is synchronous, so slow follower API calls cannot queue them. The leader logged `write EPIPE` right after each follower timeout, meaning it answered after the follower's eight-second deadline: its event loop was stalled for several seconds, cause unknown. Leader-lane separation is therefore not a fix.

- [ ] Read the first live `event-loop-stall` records (the local `loop-lag` monitor logs each stall at or above 1.5 s with the synchronous lock waits and transaction hold times that happened inside it) and find what stalls the leader's event loop for several seconds under load (candidates: busy host-application JavaScript in the leader process, journal compaction, OS scheduling or swap pressure; synchronous state and log file work is measured as negligible). Measure event-loop lag and the duration of synchronous leader work around a reproduced stall before changing code; do not infer the cause from passing runs or from `getMe` call counts alone. Falsification: a reproduced stall attributed to a named synchronous operation, then a regression that bounds it.
- [ ] Revisit an immediate retry of a forward rejected for a generation change only if live evidence after the probe fix still shows generation churn; the journal already retries after one second, so the gain is under a second and the retry must keep the same delivery identity and settle exactly once.
- [ ] After separately authorized live loading, confirm on a loaded host that a stalled-leader period no longer produces `Stale follower registration generation` rejections or foreign-ownership toasts, that slow taps stop spinning within about two seconds, and that followers make no `getMe` calls while the leader relays the capability. Local native fixtures are not live acceptance.

## Passive-child cold-import follow-up

The 0.57.8 tag validation failed `Child process sharing the agent dir does not poll while parent owns Telegram lock` even when that file ran alone: `Child process did not exit. stdout= stderr=` at its existing child deadline. The other seven process tests and the identical pre-merge tree passed. That historical failure has no child-stage trace, so cold import, startup and a retained runtime handle remain competing explanations. Bounded diagnostic sampling is exhausted; passing traces showed imports up to 4.37 seconds against the five-second non-Windows child budget and natural exit within 8–14 ms after the event-loop checkpoint. These traces do not identify the original cause. A later main-validation recurrence stopped after `eval` and `import-start`, with parent-clock `elapsedMs=5009` and no import-complete checkpoint. That trace locates this recurrence before import completion, not in natural exit or a retained post-checkpoint handle; the slow dependency/startup cause remains unknown. The minor release's independent tag-owned validation passed the same committed tree, which does not erase that historical failed main check. The initial hotfix candidate then showed the same pre-import-completion state on Ubuntu at `elapsedMs=5026`; the recurrence is not macOS-only. Slow dependency/startup cost remains unexplained, separate from the fixture's corrected startup/exit observation contract.
- [ ] On a genuinely failing cold-import trace under the phase-owned fixture, isolate dependency/startup cost using its actual overall/exit deadline and stage evidence before changing runtime imports or budgets. Preserve natural-exit/no-poll assertions and job budgets. Do not spend unchanged-head diagnostic samples or infer runner contention or the historical cause from passing runs.

## Windows Workspace-gate fixture timeout

`Leader assembly serializes follower provisioning through its shared Workspace gate` once exceeded its generic one-second bus-response deadline. It sends `follower.register` directly, outside the changed API caller; production registration has a separate budget. The later native standalone witness acknowledged at about 90 ms, and the full suite passed, but the original failure has no gate/persistence trace. A synthetic delayed-write probe verifies diagnostic capture, not the native cause.
- [ ] Use the next genuinely failing native trace to distinguish gate wait, persistence and acknowledgement delay before correcting this fixture or runtime. Retain its bounded stage evidence and standalone/full-suite execution; do not spend unchanged-head reruns or infer a cause from passing checks. Any deadline-policy correction must be justified against the registration owner's contract, not a guessed larger timeout.