Reconcile reviewed production fixes on current main

[hamzamerzic]

Outcome

Integrates thirteen independently reviewed production fixes onto current protected main after #129 containment and #144 restart-safety revert. Each source PR remains one commit in this branch so scope and provenance stay auditable.

Included reviewed changes:

• Steer composed messages with modified Enter #118 modified-Enter steering durability
• Align sent attachment previews #119 sent attachment geometry
• Resolve Three addons from the pinned app runtime #120 pinned Three addon resolution
• Allow explicit app focus over builder workspaces #131 explicit app focus in Builder workspaces
• Collapse stale composer height on tab return #132 deterministic empty-composer sizing on tab return
• Apply reviewed labels without risking PR creation #138 reviewed-label application without PR loss
• Show durable app activity dots #140 durable app activity dots with version-bounded acknowledgement
• Quiet the empty chat screen #141 quieter empty chat state
• Make Reflection questions opt-in by default #142 adaptive Reflection brief/question contract
• Clarify opaque app authority and lock module loading to the broker #134 broker authority documentation, dynamic-import inventory, and telemetry redaction
• Refresh copied git hooks after platform updates #135 atomic trusted-upstream git-hook refresh
• Align background agent pickers and defaults #136 coordinated provider/background-agent persistence
• Prevent chat restore into reserved blank space #143 live scroll-anchor repair with persisted-state normalization and canonical physical-tail attention nudges

Deliberately excluded:

• Skills platform: directory skills, install API, agent catalog index (backend) #146 and app-skills#4 are held on install/uninstall transaction, trust, revocation, bootstrap, and version-pairing blockers.
• feat(chat): resume automatically after planned restarts #139 was reverted by Revert unsafe automatic planned-restart continuation #144; replacement consent/Recovery-ledger design is issue Separate planned-restart consent and bind resume to the Recovery boot ledger #145.

Integration evidence

• current base: f7548ce859a90debdd725f15085791b7656c07ca
• exact head: 33951d666893fd14e9f5449d6cf3d69a7dd504ff
• git diff --check: clean
• combined frontend library tests: 1,797 passed
• combined hook tests: 47 passed
• production Vite/PWA build: passed
• prior 12-fix head d8d29ce653b6a82d960dcc113567b6a968fa725f: hosted backend and E2E passed

Hosted backend and E2E must also pass on the exact 13-fix head. Do not merge if the exact head changes without renewed review.

[hamzamerzic]

Source-head ledger for exact integration d8d29ce653b6a82d960dcc113567b6a968fa725f:

• Steer composed messages with modified Enter #118 1451383f15d274332d760f6bbac59d89df3fde02 → 41a46d9e
• Align sent attachment previews #119 5c22de243237f4d5decb4e1b7baef6b1cc467fdb → ccb31440
• Resolve Three addons from the pinned app runtime #120 05103902467b47a8dd1ce4c031ffd4cd520e7184 → 963e6bfd
• Allow explicit app focus over builder workspaces #131 d871e5537d779503be41f81b732812f5631797a0 → 6f228834
• Collapse stale composer height on tab return #132 40e3b02fdb446a9464a964009b9edd242c21764f → e6e1a175
• Apply reviewed labels without risking PR creation #138 139fc05ec2561aa3ce673d5802c07fe1e2c2da51 → 72a23eca
• Show durable app activity dots #140 2baca389cd1592f3975ead35423e4b7314f89099 → d2d32c58
• Quiet the empty chat screen #141 1a34261cfa231f0e89cf6cab583b722d4cd61076 → 87b45276
• Make Reflection questions opt-in by default #142 7c5cb2fa3712d903f7a01926bab1f0baff9b5188 → 6efc6b33
• Clarify opaque app authority and lock module loading to the broker #134 6fb79abf13af2e8cf59d70a29bd9e0bb2b2d2df8 → d0719e86
• Refresh copied git hooks after platform updates #135 f5bd032c0adc10376640b376b35a677cd0236cf7 → 0d180bcb
• Align background agent pickers and defaults #136 98ff6428a93a0381b5a15934068d3f41df77703f → 713c21bd

Each integration commit was produced from that PR’s complete three-dot patch, in the listed order, followed by a clean merge of current protected main f7548ce8 (#129). git diff --check, 1,790 library tests, 47 hook tests, and the production/PWA build pass locally.

[hamzamerzic]

Thorough integration review — round 1/2 (exact d8d29ce6)

I verified provenance and replay integrity rather than trusting the aggregate description:

• all 12 integrated commits have stable patch IDs identical to the final reviewed heads of Steer composed messages with modified Enter #118, Align sent attachment previews #119, Resolve Three addons from the pinned app runtime #120, Allow explicit app focus over builder workspaces #131, Collapse stale composer height on tab return #132, Clarify opaque app authority and lock module loading to the broker #134, Refresh copied git hooks after platform updates #135, Align background agent pickers and defaults #136, Apply reviewed labels without risking PR creation #138, Show durable app activity dots #140, Quiet the empty chat screen #141, and Make Reflection questions opt-in by default #142
• the merge from current main is conflict-free (--remerge-diff is empty), so it did not introduce a hidden conflict resolution
• the branch merge-base is the declared current base f7548ce8 and git diff --check is clean
• the combined feature-focused backend suite passes
• the complete frontend suite passes: 1,790 library tests and 47 hook tests
• the production build passes

I also checked the four overlapping integration surfaces (composer shortcuts/sizing, ChatView quiet state, attachment styling, and Shell focus/activity attention). Their source tests all survive together on the aggregate head. No integration defect found in round 1.

[hamzamerzic]

Thorough integration review — round 2/2 (independent boundaries pass)

Second pass focused on failure domains and cross-feature state rather than patch provenance:

• durability: app-attention acknowledgements remain version-bounded; provider/background saves preserve the authoritative first failure; platform hook refresh remains lock-bound to one immutable upstream object
• authority/privacy: the app-module broker still owns executable loading, telemetry redaction remains fail-closed across the changed reporting paths, and the reviewed-label flow cannot create or publish a PR as a side effect
• UI state composition: explicit focus does not consume the durable app-update signal; empty-composer reconciliation does not change shortcut semantics; quiet empty-chat rendering does not remove attachment or activity ownership
• base interaction: current main changed browser profiles and the Codex runner only; the merge touched no reviewed feature file and needed no manual resolution
• repository hygiene: no generated bundles, private workspace paths, conflict markers, or direct chat-JSON write path entered the aggregate

No code change requested from round 2. This aggregate is review-clear at d8d29ce6; merge should still wait for the exact-head hosted backend and E2E jobs to finish successfully.

[hamzamerzic]

Independent UI integration review on exact head d8d29ce653b6a82d960dcc113567b6a968fa725f: no code blocker found; hosted backend/E2E remain the final gate.

The integrated patches for #118/#119/#131/#132/#140/#141 are patch-id identical to their reviewed PR tips. Relative to current base f7548ce8, the PR has no useScrollMode delta, no #139 automatic-continuation paths/markers, no held #143 scroll patch, and no private .agents/.codex/AGENTS.md/CLAUDE.md leakage. The only skill-named path is the intended product seed backend/scripts/seed-skills/reflection.md from #142.

Cross-feature seams checked: modified-Enter's durable queue→per-row steer path and the semantic composer sizing/reset path coexist cleanly; voice, restore, send clear, hidden pane, visibility, and pageshow sizing still route through the shared helper. Builder immersive visibility feeds the app-activity acknowledgement/dot filter consistently, and the empty-chat prompt removal is orthogonal.

Exact local evidence: 173 focused composer/attachment/activity/Builder tests + 2 voice tests passed; full frontend passed 1790/1790 library tests and 47/47 hook tests; production Vite/PWA build and git diff --check passed. Awaiting the current hosted run before a final merge-ready verdict.

[hamzamerzic]

APPROVED on exact head d8d29ce653b6a82d960dcc113567b6a968fa725f.

I independently audited the reconciliation graph, exact source patches, final merge construction, and the combined backend/process state machines.

Transition / owner	Integration result
Codex start, cancellation, SDK exit, process-group TERM/KILL, browser-session close (#129 in protected base)	Preserved exactly. None of the 12 integration patches touches Dockerfile, chat.py, codex_sdk_runner.py, browser_profiles.py, or their #129 tests. The final #129 merge is Git's conflict-free computed tree, with no manual resolution.
Modified-Enter steer (#118)	Adds only a UI trigger into the existing live-turn route; it creates no runner/process path. Stop-vs-steer, force-steer, split, and active-turn registry tests remain green.
App broker/error containment (#134)	Redaction and module-broker enforcement only; no browser daemon/process ownership bypass.
Platform hook refresh (#135)	Separate reconciler authority: bounded fixed Git plumbing, pinned reviewed OID, cross-process reconcile lock plus hook lock, atomic replacement/rollback. It does not mutate chat generations, active turns, PGIDs, or browser targets.
Contribution review/create/recovery (#138)	Separate durable review-record authority with explicit reviewed base and bounded GitHub commands; no chat-runner state mutation.
App activity acknowledge (#140)	Version-gated DB transition; a stale seen request cannot clear newer activity. No runner/process path.
Background defaults/save (#136)	Settings affect future provider selection only; live Codex chats still enter the same #129 lifecycle. Failed companion saves are authoritative before req-id staleness and cannot be hidden by a later edit.
Reflection adaptation (#142)	Static seeded instruction/template change only. The repaired source aligns answer evidence by report date and explicitly removes the deleted verbosity/focus/avoid controls.

Composition evidence:

• All 12 body-listed integrations are intentional. Each integration commit's stable patch ID exactly matches its current source PR's complete patch (Steer composed messages with modified Enter #118, Align sent attachment previews #119, Resolve Three addons from the pinned app runtime #120, Allow explicit app focus over builder workspaces #131, Collapse stale composer height on tab return #132, Apply reviewed labels without risking PR creation #138, Show durable app activity dots #140, Quiet the empty chat screen #141, Make Reflection questions opt-in by default #142, Clarify opaque app authority and lock module loading to the broker #134, Refresh copied git hooks after platform updates #135, Align background agent pickers and defaults #136), with identical changed-path sets.
• Base f7548ce contains the exact reviewed Contain Codex descendants and custom browser sessions #129 tree. git merge-tree --write-tree 713c21b f7548ce equals the committed head tree 239dcffdd2836a767bd3145e71ed9164ea8466f4.
• feat(chat): resume automatically after planned restarts #139 remains reverted. Prevent chat restore into reserved blank space #143 and Skills platform: directory skills, install API, agent catalog index (backend) #146 are absent; no Skills catalog/generated/lock/manifest/submodule drift is present.
• git diff --check origin/main..HEAD is clean and the review worktree has no source edits.

Validation:

• local containment + steer group: 97 passed
• local affected backend integration group: 311 passed
• exact-head hosted CI: backend, E2E, frontend unit, core-app unit/sync, packager, and privacy all green

No blockers found. I did not merge.

[hamzamerzic]

Final exact-head verdict for d8d29ce653b6a82d960dcc113567b6a968fa725f: approve / no blocker. The full hosted run 29948789601 is green across privacy, backend, frontend unit, packager, core-apps, sync, and E2E. Combined with the patch-identity, leakage, composer/Builder/activity seam review and exact local tests/build above, this integration head is cleared as it stands. #143 is intentionally not present and remains separately gated.

[hamzamerzic]

Integrated reviewed #143 exact source 230332e028fe9a3bbca9a0915626f1ece412fc94 as integration commit 33951d666893fd14e9f5449d6cf3d69a7dd504ff. The source patch restores canonical physical-tail attention nudges while separating live off-content anchors from persisted/restore state. Local exact head: 1,797 library + 47 hook tests passed, production Vite/PWA build passed, git diff --check clean. Fresh hosted backend/E2E and exact-head re-review are required.

[hamzamerzic]

APPROVED — narrow #143 delta on exact head 33951d666893fd14e9f5449d6cf3d69a7dd504ff.

Delta from the fully approved d8d29ce653b6a82d960dcc113567b6a968fa725f is exactly the repaired #143 source head 230332e028fe9a3bbca9a0915626f1ece412fc94:

• stable patch ID matches: a4e45700fd3fb63c97160eff5d526253266b7d74
• the full binary diff SHA-256 matches byte-for-byte: 10007caff434877983e5eda58ac6a4b25fbdbf01243e3d7a876a8e000b0f0c70
• both pre-delta file blobs equal Prevent chat restore into reserved blank space #143's source base, and both post-delta blobs equal the repaired source head
• scope is exactly two frontend files: useScrollMode.js and useScrollMode.test.js

There is no backend, Docker, recovery, settings, runner, process, database, or durable state-machine delta. The approved #129 containment and all other d8d29ce backend transitions are byte-identical. Because the delta is only the exact two-file #143 patch, #139 remains reverted and #146 remains absent.

The repaired behavior retains live physical-tail attention nudges while normalizing off-content anchors at the single persistence/restore gate. Targeted exact-integrated-head test: 71/71 useScrollMode tests passed. git diff --check d8d29ce..33951d6 is clean.

Hosted status at review time: privacy, frontend unit, packager, core-app unit, and core-app sync are green; backend and E2E are still in progress on this exact head. Code delta approved; required hosted checks still gate merge.

[hamzamerzic]

Re-review of current exact head 33951d666893fd14e9f5449d6cf3d69a7dd504ff: approve / no code blocker; the current hosted backend and E2E jobs remain the final gate.

The new integration commit is patch-id identical (a4e45700…) to the full reviewed #143 source diff at exact 230332e028fe9a3bbca9a0915626f1ece412fc94; no conflict resolution or semantic rewrite occurred. The final state preserves the owner-authoritative scroll split:

• explicit question/paused attention nudges use physicalBottomAnchorModeFromScroll, stay live ANCHOR_AT, and reach the true physical tail;
• live off-content anchors may retain reserved-room geometry;
• every stored ANCHOR_AT passes the content-intersection gate, while mount restore also validates old state, so off-content/blank locations normalize to the real-content tail;
• live FOLLOW_BOTTOM/pin state remains observable during the mount but restores only as settled hold state.

The #143 delta touches only useScrollMode.js and its unit test. It composes cleanly with the already-reviewed composer sizing/pageshow listeners, modified-Enter queue→steer path, durable app activity, and Builder immersive focus: retained-chat hide/return still crosses freezeChatExit, while composer foreground sizing owns only textarea/footer geometry. The diff contains no #139 automatic-continuation paths/markers and no #146 skill-platform files or hunks; #146 is not an ancestor (its only overlapping filenames, ARCHITECTURE.md and models.py, contain unrelated existing integration changes).

Exact local evidence on 33951d66: 224 focused scroll/composer/activity/Builder tests + 2 voice tests passed; full frontend passed 1797/1797 library tests and 47/47 hook tests; production Vite/PWA build and git diff --check passed. Current hosted run 29949662882 has privacy/frontend/packager/core-apps/sync green; backend and E2E are still running.

[hamzamerzic]

Final exact-head CI update: 33951d666893fd14e9f5449d6cf3d69a7dd504ff is unchanged and all hosted checks are now green, including backend and E2E. The narrow #143 delta approval above is therefore fully merge-ready; no caveat remains. I did not merge.

[hamzamerzic]

Final integrated verdict: exact head 33951d666893fd14e9f5449d6cf3d69a7dd504ff passed hosted run 29949662882 across all seven jobs, including backend and the full E2E suite. Source #143 exact 230332e0 independently passed the same complete gate in run 29949521522. No remaining review finding. #147 merged as main 226106c46e83b776cc89c6d84daec820eee932a7; the new main push run 29950348376 is now the sole post-merge verification gate.

[hamzamerzic]

Post-merge landing verification is complete: main 226106c46e83b776cc89c6d84daec820eee932a7 passed run 29950348376 across all seven jobs, including backend and E2E. Source #143, integrated #147, and merged main have each independently passed the complete hosted gate.