pin the thinking channel behavior and capture request payloads (#3168) * perf(kernel): defer websearch httpx import to first call - first tool cell 17ms -> 2ms (#2888) Module-level 'import httpx' put its full import chain (~15ms in-kernel) on every kernel bootstrap cell, in every session, even when no search runs. Import it inside _fetch_serper on first call instead. A module-level find_spec guard keeps the import-time contract byte-identical: when httpx is absent, importing websearch still raises ModuleNotFoundError('No module named \'httpx\''), so the kernel's unavailable-skill stub and its message are unchanged. No Rust, API, wire, or behavior change; the first websearch call pays the import once. Co-authored-by: perf-kernel-cell-fast * perf(pa-core): adopt the retained window one-copy - move the trees in, drop the raw duplicate (#2890) * pa-daemon: summary scalars from one borrowed walk, not the materialized fold session_summary folded the whole retained window into a Vec on every read (attach, get_state, roster pushes, list rows) just to read three scalars: the newest message timestamp, the summed assistant usage, and the window's message count. At session scale that fold is the majority of the summary's cost and half the retained-window folds an attach pays (handle_attach's snapshot fold is the other). SessionFile::messages now delegates to one shared windowed walk (walk_message_values): message rows borrow their persisted message, custom_message rows rejoin in their wire form, and a compaction window prepends its summary message with the retained count counted in a borrowing pass. The materialized fold keeps its exact sequence (same keeping-flip semantics on message-bearing rows, same summary-first order) and drops the doubled clones the old retained loop paid. scan_message_scalars walks the same sequence for the summary scalars: the reverse find_map timestamp (last positioned value, not the maximum), the assistant usage sums in fold order, and the message count. session_summary consumes the scan instead of the Vec, so every summary surface derives from the same walk the fold uses - the two can never disagree. Golden equivalence tests pin the scan against the old full-clone extraction across window shapes (non-monotonic timestamps, custom rows carrying usage, kept id on message/non-bearing/missing rows, stacked compactions, empty session, degenerate rows), and boundary tests pin the fold's exact windowed sequence. * perf(pa-core): adopt the retained window one-copy - move the trees in, drop the raw duplicate The worker-rss census (bench hillclimb record 20260926-183300) measured five resident copies of the retained window on the 10MiB canonical fixture; three were derivable duplicates: SessionManager::adopt_window cloned the walk's typed trees into file_entries (B) while the window kept its original (C1, wire-identical) plus the raw JSONL lines (C2, 10.48MiB) - ~29.5MiB of wire-equivalent duplication in the loaded worker, whose same-build RSS band is 182.5-217.9MiB (p50 207.6). - WindowedSessionStore::take_retained hands the typed rows AND raw lines to the owning manager in one move; a detached window keeps its snapshot/settings/metadata surfaces (goal state, refinement history, git state, append-time stats) and asserts that its transcript context comes from the manager. - SessionManager::adopt_window adopts the trees by move (no to_vec). - SessionManager::active_context builds from file_entries with the SAME window settings overlay gate as the old window.context() - the served context is unchanged; the manager's own append_child_usage_attribution fold is the one-copy authority for live rows. - ensure_full_history re-arms the detached copies (historical hydration restores bodies, exactly like a fresh walk). Oracles: adopted-context byte parity vs an un-adopted window (cold+warm), detached-window lookups + should_panic context, live-appends-vs-full- reopen byte parity incl. an in-window attribution target; existing manager/window/byte-parity tests now ride the adopt path. * fix: adopt_window takes the window by mut (take_retained borrows mutably); tests serialize the context field tuple (SessionContext is not Serialize) and fully-qualify AgentMessage * fmt: rustfmt on the new window-scan tests * fix(tests): reference opens first in the cold pass (the adopted open warms the sidecar); compaction_count is the file-level tally (fixture carries a sibling compaction); the retained assistant row needs the required api/stopReason fields or it degrades to Unknown * fix: clippy default_trait_access in the scan equivalence test * fix: clippy default-trait-access in tests (JsonMap::default / MessageWindowScalars::default; the latter is a lint fix on the folded attach-path tests so this lane's gates run green - their lane must carry the same fix on their branch) * fmt: wrap the scan default assert to 100 cols * perf(pa-daemon): collapse fresh-create session-file writes into one durable write (#2892) * pa-daemon: fresh-create single durable write (spawn admission) The fresh-path create collapsed its session-file durability from three sync'd writes (a header-only rewrite, a second rewrite for the prefix + active state, and a persist_entry name append) into ONE rewrite that assembles the prefix, the state, and the session name in memory first. The dropped header-only intermediate has no reader: the durable create stays pathless until the create succeeds, so no replay, scan, or registration consumes the file mid-create. The final bytes are identical to the sequential writes (same entries, same order; the name's line is the exact persist_entry construction via append_session_info). Measured on the spawn-latency VM (hillclimb lane perf-spawn-admission-fast, bench record 20260926-204300): each admission pays ~7 serialized durability round trips; the fresh-write class costs ~38-45ms/op in the degraded host regime (0.3ms quiet) - the collapse removes two of the three writes on the child-create leg. In-crate oracles: the single write matches the legacy sequence's masked bytes; the folded name lands once; a failed write leaves no session file; a legacy crash orphan neither blocks the create nor bleeds into the new file. * pa-daemon: split the create-collapse tests into their own file create.rs grew past the ~800 LoC guidance with the in-file test module; the tests move to worker/create_collapse_tests.rs via #[path] (still a child of the create module, so the module-private append_creation_prefix stays reachable). No product change. --------- Co-authored-by: perf-spawn-admission-fast * perf(pa-tui): handoff exits break the run loop this iteration - chat->agents 119ms -> 67ms (#2893) The terminal loop's exit-key break only left the input-drain loop, so the handoff fell into the select below it and parked on the 50ms idle tick before the loop-tail exit check ran — measured as ~50ms of added latency on every chat -> agents view switch (strace: the key is handled in ~0.1ms, the teardown starts on the next tick wake ~51ms later; the code's own comment already demanded the teardown run "this iteration"). A handoff (agents-back, /resume, the scoped view, /resume ) now breaks the outer loop immediately: the next surface's mount clears the alt screen, so the tail pass paints nothing the user can see. A non-handoff exit (/exit, /quit) keeps the tail pass — its frame gate paints the final chat frame the exit's main-screen flush shows — and headless runs keep the tail pass so captured frame sequences stay identical. * perf(pa-daemon): borrow message content as RawValue - kill the second full catalog parse, cold -25% (#2882) Co-authored-by: perf-catalog-second-parse-fast * pa-daemon: agent_engine.rs split 1/11 - the tests concern moves out of src/agent_engine.rs (#2889) 51bd18583e17merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-cli/pa-daemon): tighten the two cold-open connect-probe grids from 25ms to 5ms (#2891) Cold-open boot-floor decomposition at 7064d039a (bench hillclimb record 20260926-194800-startup-boot-floor-decompose) measured two pure-wait probe grids on every cold launch, each quantized 0-25ms (mean ~12.5ms): - ensure_daemon_running_with polls the freshly spawned supervisor's socket every 25ms; a cold supervisor binds ~39ms after spawn. - probe_worker_socket polls a freshly forked session worker's socket every WORKER_CONNECT_BACKOFF_MS=25ms; the worker binds ~1-3ms after the fork. Both grids tighten to 5ms. Timing-only: probes, 30s budgets, auth floor, and all error paths are unchanged; wire and user-visible behavior are identical (TS polls at 25ms in both places - the deliberate divergence is the perf port's, flagged for review). * perf(pa-tui): return the first-frame heap of a resumed transcript; store settled messages rows once (#2895) * perf(pa-tui): return the first-frame heap of a resumed transcript; drop settled messages duplicate block-cache copy * test(pa-tui): settled messages keep no block-cache copy; streaming keeps its replay cache --------- Co-authored-by: perf-tui-memory-fast * perf(pa-daemon): zero-copy relay for routed responses - share the payload bytes, splice the client id (#2897) * pa-daemon: relay routed responses by bytes - supervisor splices the client id onto the worker line * fmt: the two supervisor.rs forms CI rustfmt wants * perf: the cross-process runtime-ready probe memo - on-disk, same identity key, damage-aware (#2881) * pa-core: the cross-process runtime-ready probe memo (on-disk, same identity key) * pa-core: fix the xproc memo commit's test-module paths and escape damage * pa-core: rustfmt the cross-process memo * pa-core: clippy fixes for the cross-process memo tests * pa-core: move the memo-walk helper to test-mod scope (clippy items-after-statements) * pa-core: fix the disk-memo oracles (missing-dir semantics, fallback sequence) and serialize the memo-state tests * pa-core: the disk-memo repair-to-verified-content hits (oracle fix) * pa-core: the live closure-freeze allowlist covers the real runtime's stdlib imports (18 modules found on first live run) * pa-tui: agents-view summary rows drop the model mix; the inactive line bills the descendant aggregate (operator directive) (#2894) 9168514c8384merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: supervisor.rs facade cut SS3 - the adoption/register concern byte-moves into supervisor/adoption.rs (#2901) 450cf50aeb31merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-daemon): share client-event payloads on the supervisor broadcast (Arc) - sup CPU -60% at N=100 (#2896) * perf(pa-daemon): share client-event payloads on the supervisor broadcast (Arc) Baseline at origin/rust 7064d039a on the concurrent-io lane: supervisor CPU per append_custom_message is Theta(N) in resident sessions - 536us/append at N=1 rising to ~2636us at N=100 live sessions (a+21us*N fits all four N and both trials), because every session event (2 per append: message_start + message_end, each carrying the full message payload) is published on the one daemon-wide tokio broadcast channel, and every connected client's event arm wakes, deep-clones the (ClientRouting, Value) frame, locks its attached-list mutex, checks, and discards. Aggregate daemon CPU for equal per-session traffic is Theta(N^2). Share the payload instead of cloning it per receiver: the channel carries (ClientRouting, Arc). Nothing else changes - same channel, same ring capacity, same routing decisions in the same recv order, same wire frames (write_line serializes from the shared Value; the worker-side EventPump already shares its frames this way via Arc). The per-receiver cost for a non-matching connection drops from a full serde_json::Value deep clone to an atomic refcount bump. Measured on the 16c/32GB ubuntu:22.04 VM (hillclimb-perf-concurrent-io): same-vm ABBA at N in {1,100} follows in the lane record; the claim is daemon CPU per session event, not wall latency (append wall is fsync-dominated on the measurement host). * fix(pa-daemon): wrap the two missed client-event send sites + test compile - supervisor.rs shutdown-signal daemon_closing broadcast and the supervisor_roster.rs RosterSubscribers push missed the Arc wrap; both now share the payload like every other events.send site. - Test fixtures compile against the shared-payload channel: the roster drain helper derefs back to owned Values (tests keep comparing Values), and the daemon_closing assert compares through the Arc. * fix(pa-daemon): compile + rustfmt the shared-payload channel's test helpers - supervisor_roster_seed tests' drain helper takes the Arc-typed receiver and derefs back to owned Values (same pattern as supervisor_roster). - rustfmt the Arc-wrapped send sites (line-width wrap only, no semantics). No product behavior changes: whitespace + cfg(test) code only. * style(pa-daemon): rustfmt the seed-test drain helper + clippy semicolon One-liner receiver type per rustfmt, trailing semicolon per clippy::semicolon_if_nothing_returned. cfg(test)-only change. * pa-core: anchor compaction summaries to kept-tail state and stop re-summarizing file lists (TS #2385) (#2768) a1c236c05df8merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * test(pa-tui): the bang-during-streaming-turn e2e gates the mock's turn end on the ack bang, not a wall clock - every awaited state is causal or terminal, closing the two-channel load red (red-bang-stream-flush-20260926-1) (#2904) a02c3aa25cdamerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-ai/pa-daemon: the faux repeat-last knob + the goal-recovery e2e opts in and pins the exhaustion race deterministically - closes red-goal-recovery-faux-exhaustion-20260926-1 (#2902) 1e236ad703efmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: the inline pickers' selection wash reads off the surface (operator directive) (#2908) c7a54e058c31merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-daemon): return the supervisor relay and catalog-scan heap to the OS (#2899) The supervisor process relays every routed worker response through a serde_json Value tree (from_slice in the worker-frame reader, a DaemonResponse through the pending-reply channel, response_line to the client write) and the saved-session catalog scan folds a parse tree per file line; both phases free their trees when the phase ends, but nothing in the supervisor process ever returned the freed pages, so a grown session relay (a ~9.5MiB get_messages wire leaves +71MiB resident; a routed attach adds +42MiB more) and every grown catalog scan stayed at the arena high-water for the daemon lifetime. Mirror the merged #2872 session-memory pattern on the two daemon-side phase boundaries: write_line reports the serialized byte count and the client write loop trims when a routed line carried >=1MiB (the frame is out and the tree is dropped first), and the saved-session scan trims at its join (the per-line trees are folded and freed inside the blocking task; the per-file cached scan states are live cache and stay untouched). Allocator plumbing only - no data, protocol, wire, or behavior changes; non-glibc/Linux builds are no-ops via pa_types::memory_release. Co-authored-by: perf-daemon-rss-fast * perf(pa-tui): stream the exit/suspend main-screen flush - zero exit RSS spike, byte-identical output (#2913) * perf(pa-tui): stream the exit flush in bounded chunks - the inline repaint never materializes the whole frame * pa-tui: fmt + the flush errors doc (gate nits) * pa-tui: fmt + the flush errors doc (gate nits) * perf(pa-core): serialize same-process auth-lock holders - first-turn slow-class 50% to 12% (#2915) The TS product runs acquireLockSyncWithRetry on a single thread, so the 10x20ms retry only ever fires against another process. The Rust engine is threaded: two worker threads racing AuthStorage::create on a fresh session's first turn (model-resolution registry build vs a concurrent auth read, strace-verified: openat O_CREAT|O_EXCL -> EEXIST within 47us, loser clock_nanosleeps the full 20ms) pay the TS retry sleep against each other, a ~20ms first-turn latency class in 4/6 msgsettle trials. A process-local mutex keyed by the auth document path serializes same-process callers for the microseconds the small read/modify/write holds. The file protocol, staleness judgment, and retry semantics are untouched: a foreign holder (another process) still surfaces WouldBlock and still takes the 10x20ms retry. The mutex is a leaf (the locked section performs only the document's own fs ops plus the caller's callback; no callback re-enters with_lock), and poisoning is recovered because the file protocol is the correctness mechanism. Co-authored-by: perf-model-resolve-cache-fast * perf(pa-daemon): per-session subscriber registry - send-time attached check, sup CPU -20% at N=100 (#2914) * perf(pa-daemon): share client-event payloads on the supervisor broadcast (Arc) Baseline at origin/rust 7064d039a on the concurrent-io lane: supervisor CPU per append_custom_message is Theta(N) in resident sessions - 536us/append at N=1 rising to ~2636us at N=100 live sessions (a+21us*N fits all four N and both trials), because every session event (2 per append: message_start + message_end, each carrying the full message payload) is published on the one daemon-wide tokio broadcast channel, and every connected client's event arm wakes, deep-clones the (ClientRouting, Value) frame, locks its attached-list mutex, checks, and discards. Aggregate daemon CPU for equal per-session traffic is Theta(N^2). Share the payload instead of cloning it per receiver: the channel carries (ClientRouting, Arc). Nothing else changes - same channel, same ring capacity, same routing decisions in the same recv order, same wire frames (write_line serializes from the shared Value; the worker-side EventPump already shares its frames this way via Arc). The per-receiver cost for a non-matching connection drops from a full serde_json::Value deep clone to an atomic refcount bump. Measured on the 16c/32GB ubuntu:22.04 VM (hillclimb-perf-concurrent-io): same-vm ABBA at N in {1,100} follows in the lane record; the claim is daemon CPU per session event, not wall latency (append wall is fsync-dominated on the measurement host). * fix(pa-daemon): wrap the two missed client-event send sites + test compile - supervisor.rs shutdown-signal daemon_closing broadcast and the supervisor_roster.rs RosterSubscribers push missed the Arc wrap; both now share the payload like every other events.send site. - Test fixtures compile against the shared-payload channel: the roster drain helper derefs back to owned Values (tests keep comparing Values), and the daemon_closing assert compares through the Arc. * fix(pa-daemon): compile + rustfmt the shared-payload channel's test helpers - supervisor_roster_seed tests' drain helper takes the Arc-typed receiver and derefs back to owned Values (same pattern as supervisor_roster). - rustfmt the Arc-wrapped send sites (line-width wrap only, no semantics). No product behavior changes: whitespace + cfg(test) code only. * style(pa-daemon): rustfmt the seed-test drain helper + clippy semicolon One-liner receiver type per rustfmt, trailing semicolon per clippy::semicolon_if_nothing_returned. cfg(test)-only change. * pa-daemon: per-session subscriber registry - session events resolve delivery at publish time (TS handleWorkerFrame parity) TS evaluates the attached predicate in the same synchronous pass that writes the socket (daemon-supervisor.ts handleWorkerFrame l.6353; attach flips the flag and writes session_attached in one tick, l.5586->l.5608). The Rust ring evaluated it at RECV time in every connection event arm - a superset in the attach/detach race window TS cannot produce (an event published before an attach could still land after it, duplicating a row the attach snapshot already carried). Session events now route through a supervisor-side subscriber index (session id -> connection id -> bounded per-connection queue): publish enqueues to the attached set under one lock, unattached connections never wake (the ~5.9us/session/append wakeup floor at N=100 from the concurrent-io lane), per-(session,connection) order stays publish order, and a full queue drops with a one-line-per-stall-cycle log (finding 4a visibility). Broadcast / BroadcastExcept / RosterSubscribers keep the ring; ClientRouting::AttachedSession is removed so a stale session-event publish fails at compile time. Session events without an active session id are dropped (TS l.6296 !activeSessionId guard), not broadcast. The dormant supervisor/clients.rs split copy carries the same change (re-homing at the fold will take one of the two). * pa-daemon: fmt + clippy fixes for the subscriber registry (if-let for the single-pattern session-event relay) * pa-daemon: fix the registry idempotency test - drain the delivered frame before the post-detach empty check * pa-daemon: rustfmt the registry rebind call and the idempotency assert * pa-daemon: rustfmt the registry call sites exactly as rustfmt asks * pa-daemon: convert the zero-copy splice arm's attach push to the subscriber registry #2897's raw-splice attach family added a SECOND attach-success push site on the tip's routing.rs; it arrived through the fold with the old vec semantics (the pre-fold grep could not have seen it). Same conversion as the typed arm: registry + session list in one attach() call, the registry insertion is the delivery boundary. * pa-tui: the operator's touch follow-ups - the card click opens the card, the follow hint re-derives at the mode exit, the prompt bar's indicators paint on the bar (#2911) 0c526d534fcamerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-ai: the codex dead-callback tests stage the registered port checked, not blind (settle-race hardening) (#2906) c38824288cf2merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui/pa-cli: the first-run login frames render the TS login dialog (frame-parity r3) (#2845) 11365e57484dmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: session_ui.rs split 1/14 - the heartbeats concern moves out of src/session_ui.rs (#2886) 9f1cfc73550amerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: the hover affordance - ?1003 any-event tracking delivers the buttonless motion, the hovered clickable card row brightens (muted to the theme fg, dim to muted) (#2918) d81f3d2c7c07merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-ai/pa-agent): StreamingJsonAccumulator - stop re-parsing streamed tool-call JSON on every delta (TS #2783 port) (#2912) dbec3a6eb0b7merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge); optional lane gate evidence: gate_1790470828_1252847 GREEN. * pa-daemon: agent_engine.rs split 3/11 - the artifacts concern moves out of src/agent_engine.rs (#2905) 95e10f8ea95emerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: session_ui.rs split 2/14 - the stream concern moves out of src/session_ui.rs (#2920) 6aecfb087453merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: session_ui.rs split 5/14 - the auth concern moves out of src/session_ui.rs (#2923) 70abcc702d14merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-cli/pa-daemon: implement the RPC stdio mode over the in-process session engine (TS modes/rpc parity, stub S5) (#2801) 25b657908b38merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: supervisor.rs split 2/8 R2 (remediation) - the client-connection cut actually lands on the facade (#2885) 21304589206amerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui/pa-cli: the agents-view e2e settles its daemon-driven rows by synchronization, not a timing budget (AgentsStep::WaitRender - the registered ranked-hits render/data-arrival race closes by construction) (#2910) f22938c1e0aamerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-tui): packed cached entry layouts - scroll retention RSS -42%, byte-identical output (#2921) * perf(pa-tui): store cached entry layouts packed - byte-exact rows, one blob + dense span records The transcript layout cache retains every visited entry's rendered rows for the process lifetime. A 2600-key scroll walk over the canonical 10MiB session retained 5,428 entries' rows as 604k fragment-sized spans holding 5.2MB of text (+64.6MB heap, fully retained after return-to-tail; the tui-scroll-retain census: 8.3 spans/line, content capacity already exact, 44% line-buffer slack, per-span Vec/String chunk overhead the retained mass). Merging adjacent same-style spans would shrink the storage but changes the exit-flush inline scrollback's ANSI bytes (per-span SGR re-emission; the exit flush is the TS-parity-frozen output), so the cache stores the same rows packed instead: one content blob plus dense (offset, len, style) records, expanded byte-exactly on read - only the intersecting row range is expanded, so a frame inside a huge entry pays its visible rows, never the whole row set. The pad entry's own 109k-span row set (the resumed ready-state footprint) packs the same way. * perf(pa-tui): exact pack blob capacity + size-gated post-pack trim The pack's blob grew by String doubling (2x capacity: 33.6MB held for a 17.45MB row set at 40MiB); the first pass now sizes it exactly. A huge entry's rendered rows are the transcript's biggest single transient and the pack just freed them - the freed pages only return to the OS when the allocator's trim can reach them (the 40MiB ready RSS measured bimodal 181/205 on the same build); the pack now returns them immediately, gated at 8192 rows so ordinary entries never pay a trim. * fix(pa-tui): EntryRows::is_empty for the touch surface's shows-tail peek (fold resolution completion) The #2911 fold introduced the empty-section peek (a window that exactly ends on the final chat entry re-checks whether any non-empty section remains before declaring shows-tail); its section source is the EntryRows handle since the packing fold, which needs the is_empty form. * test(pa-tui): fix the pack tests' clippy findings (untyped Vec::new, shadowed view helper) * test(pa-tui): drop the pack test closure's unused mut --------- Co-authored-by: perf-tui-scroll-retain-fast * pa-daemon: agent_engine.rs split 2/11 - the config concern moves out of src/agent_engine.rs (#2909) 07cbb0febb74merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: agent_engine.rs split 4/11 - the model concern moves out of src/agent_engine.rs (#2907) 5c530e66cef9merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: session_ui.rs split 3/14 - the queue concern moves out of src/session_ui.rs (#2900) e673275046dfmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: supervisor.rs split 7/8 - the update/restart concern moves out of src/supervisor.rs (#2903) 268c1fba26c0merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui/pa-cli: dock panel exits restore the dock's own group, not the prompt bar (operator ruling 2026-09-26) (#2864) a12c2847335bmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: agent_engine.rs split 5/11 - the goalcore concern moves out of src/agent_engine.rs (#2924) c95a239b9eb3merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-tui): handoff drains park on observed input, not a fixed wait - chat-to-agents -79% (#2916) * perf(pa-tui): a handoff drain consumes buffered input instead of parking on the idle window The chat->agents handoff teardown pays the enhanced_keys drain's fixed 50ms DRAIN_IDLE poll on every switch (chat->agents measured 67ms p50 at #2893, ~50ms of it this window). The idle window guards a kitty key release that lands after raw mode is off - a leak that is unreachable on a handoff: raw mode stays on (the adopting surface's reader takes the same tty) and every surface's dispatch drops release events (input::filter_enhanced_key_events, TS tui.ts). The handoff now consumes what the terminal has already written with zero-timeout polls and returns as soon as the buffer is observed empty; only when input IS flowing does it fall through to the bounded drain, so a burst around a handoff is coalesced exactly like before. True exits (drain, drain_for_exit) keep the TS drainInput(1000, 50) contract untouched. Adds a real-pty e2e that arms the kitty protocol, injects the handoff trigger's release in flight, and audits the byte stream (no visible release, no post-exit kitty flags, no echo after the restore). * test(pa-cli): fix the kitty-release e2e gate lints (fmt shape, unit let-binding, unused import) * test(pa-cli): the kitty-release mock supervisor serves every connection in turn The chat surface holds one daemon connection and the agents view opens its own after the handoff; a single-accept mock refused the second (the first run of the e2e failed on exactly that: connection refused at run_agents_view connect). * test(pa-cli): qualify the mock supervisor connection handler call * test(pa-cli): handle the listener incoming result in the mock supervisor * test(pa-cli): the kitty-release editor probe waits for the painted cell The frame paints typed cells as styled positioned cells (escape bytes between characters), so the two-byte zz needle never appears; wait for the painted z cell instead. * test(pa-cli): the kitty-release harness reaps the pty child on panic paths too * test(pa-cli): the kitty-release exit drives the CSI-u escape form With disambiguate armed a kitty terminal encodes its Esc presses as CSI 27 u; the raw lone ESC byte is the legacy form the reader arms its meta-wrapper hold for. Drive the realistic encoding and separate the exit key from the release injection. * fix(pa-tui): the handoff drain's bounded phase runs on the budget the zero-timeout loop left The zero-timeout consume loop can spend the whole DRAIN_MAX under continuous input before falling through to drain_until_idle, which then started a fresh budget - the handoff could block nearly two seconds, past the documented one-second hard cap. The bounded phase now runs on what remains of the original budget (Macroscope thread PRRT_kwDOSXZbXs6mWWqM). * perf(pa-daemon): borrow the catalog fold metadata and single-open the scan - cold scan -7%, syscalls -22% (#2919) * perf(pa-daemon): borrow the catalog fold's entry metadata, kill the per-line tail Vec The post-#2879/#2882 cold roster scan still typed-parsed every line into owned strings and materialized `Value` trees for fields the fold reads once or discards: 3 `String` allocations per line (type, id, timestamp) plus a `Value` tree per message row (role, provider, model, timestamp) and per session_info/state/model_change/thinking_level row. The resume tail added one `Vec` allocation per line sized line.len()+17 to keep 16 bytes. Both costs are gone without changing a row byte: - SessionInfoEntry's scalar fields borrow as `Cow` (zero-copy when unescaped, owned fallback identical to the old String), its object fields ride raw spans like #2882's content: each arm parses back only the span it reads, with exactly `Value::as_str`/`as_u64` semantics (present-and-string/number, absent and non-string both read None, the model_change abort arm keeps its exact two-step None). - advance_tail copies inside the fixed 16-byte window: the same bytes (a rolling-reference lockstep test pins the old Vec semantics), no per-line allocation. Differential ground truth: the new in-tree shape matrix pins every borrowed read to the full-parse Value read per row (escaped scalars, non-string roles/timestamps, null/absent/whitespace names, hidden/sleep states, abort shapes) and folds the accepted rows end to end against the legacy full-parse reference fold; the VM census ran the same differential over 177,798 real fixture lines (100/1000/4096 tiers) with zero divergence in acceptance, fields, or fold states both directions. * perf(pa-daemon): share one open between the roster header gate and the fold The roster scan opened every file twice: the bounded header gate opened, read its first line, and closed, then the fold opened the same path again for the scan — an openat+close per file per scan (plus the second metadata read the fold always paid). The gate now reads the first line from the same fresh handle the fold rewinds and scans, so one open serves both. The TOCTOU the double-open carried is disclosed: with two opens, a rename/replace landing between them judged one file and folded another; the shared handle pins the judgment and the fold to the same inode — the fold's cursor, generation, and certification re-stat now read the file the gate judged, never a replacement that raced in between. The listing stat (`stats.mtime`, the `modified` fallback of last resort) is read lazily now: the fold only reaches it when a row has neither message timestamps nor a parseable header timestamp, so the eager per-file stat the scan always paid serves only the rows that read it. The `or_else` chain keeps its order and its None semantics (the existing fallback tests pin every arm of the chain). * pa-daemon: fmt + clippy for the catalog fold lane (test-import move, lockstep test polish, matrix lint allows) * pa-daemon: supervisor.rs split 4/8 - the saved-session concern moves out of src/supervisor.rs (#2883) 9f9146b74371merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: the #2921 review follow-ups - RowPack::pack refuses unrepresentable entries, the huge-entry trim drops the expanded rows first (fold of rust 9b62f26af) (#2925) df34ea19dbb3merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: session_ui.rs split 10/14 - the bash concern moves out of src/session_ui.rs (#2928) 481b2f28553cmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * skills/prime-intellect: sync vendored sandbox docs to the VM-only surface (TS #2456 doc half) (#2751) a4e997e2e803merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * fix(pa-cli): remove the duplicated restore_dock_focus initializer the #2751 squash double-applied The #2751 squash (1a9fd16b9) landed the heal rider line onto a tip that already carried the identical line from #2925 (e6e7a26e4) - the squash applied the stale pre-fold diff, duplicating the field (E0062). This restores the fixture to the parent 84dbb51e0 state (exactly one field). The label rider and the docs in the same squash are intended and stay. * pa-daemon: agent_engine.rs split 7/11 - the SessionEngine trait impl moves out whole (#2926) 2b07a22bd1d3merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core + runtime: the harness-digest family - IDF-ranked digest/search, state-fingerprint staleness, newest-only digest contexts, validated kernel harness writes (TS #2392/#2400/#2394/#2463 parity) (#2750) bff9fa6ff122merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * fix(pa-cli): the kitty handoff e2e fixture initializes restore_dock_focus (#2927) 962ff3097575merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: session_ui.rs split 7/14 - the settings concern moves out of src/session_ui.rs (#2930) fd71eaf2dfeamerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: session_ui.rs split 6/14 - the model-picker concern moves out of src/session_ui.rs (#2929) 2038abcf5754merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon/pa-cli: ACP model and effort pickers - configOptions at session/new, session/set_config_option, config_option_update (TS #2455) (#2758) fd977cb13ee6merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-core): consolidate auth-lock reads - 36 lock cycles per first turn to 2, settings mutex closes the unmasked stall class (#2932) * perf(pa-core): consolidate auth-document reads through a validated cache * perf(pa-core): serialize same-process settings-lock holders (the #2915 pattern) The auth read-through cache on this lane unmasks a pre-existing stall: two worker threads racing the same settings.json pay the full TS 10x20ms retry sleep against each other (strace-verified: mkdir attempts 11us apart, the loser clock_nanosleeps the full 20ms; the paired census shows same-process overlapping settings acquisitions 2 on the base and 5 with the auth cache, sleep20 1 vs 2, and the timing legs pay a ~20ms-class stall on 3/6 fresh turns vs 0/6 base). The auth-lock cycles 150-300us same-process serialization was pacing the threads apart by accident; that masking is not a mechanism to keep. TS runs its synchronous settings lock single-threaded, so same-process settings contention is a Rust-port artifact, the exact class #2915 ruled on for the auth lock: a process-local mutex keyed by the document path serializes same-process callers for the microseconds the small read/modify/write holds. The file protocol, staleness judgment, and retry semantics are untouched: a foreign holder (another process) still surfaces WouldBlock and still takes the 10x20ms retry. The mutex is a leaf (the locked section performs only the document's own filesystem operations plus the caller's update callback; no settings callback re-enters with_lock - every callback is a pure JSON transform), and poisoning is recovered because the file protocol is the correctness mechanism. --------- Co-authored-by: perf-auth-lock-fast * perf(pa-daemon): zero-copy worker response path - routed msgs -17%, attach -22%, worker RSS -20% (#2935) * perf(pa-daemon): zero-copy worker response handoff - serialize the line from the borrowed trees, write the frame without re-buffering the payload * fmt(pa-types): the segments test write_frame call in the form CI rustfmt wants * fmt(pa-daemon): the response-path call forms CI rustfmt wants (VM cargo fmt at the exact head) * fix(pa-daemon): restore the response_line TS-key-order test the new-test insert orphaned (clippy empty_line_after_doc_comments was the symptom) * fmt(pa-daemon): the restored test doc comment indent * fmt(pa-daemon): single trailing newline at file end --------- Co-authored-by: wc * pa-daemon: agent_engine.rs split 6/11 - the Turn types move out of src/agent_engine.rs (#2931) b2ca4deea5afmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-daemon): batch the queue-checkpoint journal pair - 4 syncs per warm turn to 2, crash window strictly narrowed (#2936) * perf(pa-daemon): batch the queue-checkpoint journal pair into one durable append The queue checkpoint (prompt/steer/follow-up admission, turn settle, queue mutations) appends two records to the worker recovery journal - the queue snapshot and the busy/operation verdict - as two separate open+write+fsync cycles, paying two journal flushes per checkpoint. Both records describe one atomic checkpoint, and the busy verdict must never publish over a snapshot that did not persist, so the pair can ride ONE open+write+fsync: the batch is all-or-nothing durable, the on-disk line order matches the sequential form exactly (snapshot first, then the verdict), and an unchanged verdict keeps appending the snapshot alone. Measured on the warm-turn admission path (the wave-5 warm-durable-append decomposition): the two journal fsyncs sit inside the TUI-ack-to-user-row phase together with the session append's fdatasync; batching removes one of the three durable syncs per warm turn without weakening any durability guarantee (the session append's per-row fdatasync is untouched). * test: rustfmt the batched-checkpoint test call sites (gate fmt finding) * fix(pa-tui): the exit watchdog holds fire while the flush drains - healthy slow drains no longer truncate scrollback, TS-convergent (#2937) * perf(pa-tui): the exit guard holds its force-quit while the exit path drains - slow terminals keep the whole scrollback flush On a terminal that consumes the exit flush slowly (a laggy ssh at ~0.5-2MB/s), the flush of a large transcript outlasts the 1500ms FORCE_QUIT_AFTER_MS deadline that arms at the second Ctrl+C, and the watchdog fires mid-flush: strace shows its restore writes winning the pty FIFO race at a flush-chunk boundary, exit_group(0) landing while the writer still holds ~64-82% of the transcript (40k rows: 8.74MB flush truncated to 1.5-3.1MB), 'shutdown stalled; forced exit.' printing on a healthy drain, and the restore bytes queueing mid-stream behind the flushed rows. TS has no watchdog at all (its handleCtrlC second press runs the async shutdown, and slow writes simply wait), so both the message and the truncation are port-only. The guard becomes drain-aware: the flush writer reports progress per completed 32KiB chunk (view.rs FlushSink), the release tail and the resume hint report theirs, and the watchdog holds its fire while progress landed within EXIT_PROGRESS_GRACE_MS (500ms) - the hard 1500ms ceiling stays for the silent case (the wedged loop the guard was built for). Flush chunks shrink 256KiB -> 32KiB so a drain of at least ~65KB/s completes chunks inside the grace window; the flush byte stream is unchanged (the exit-flush lane's byte-identity oracle). The truncated scrollback contract is restored on slow drains: the flush completes byte-identically, the release tail lands after the last row, and the message prints only for a genuinely stalled drain. The exit-guard unit tests grow the hold/fire decision table; a new real-pty e2e (pa-cli slow_drain_exit_guard_e2e, the kitty-release harness pattern) drives the real chat surface over a paced pty master and asserts both sides: a draining terminal flushes the whole transcript with no forced exit, and a stalled drain still fires. Rider (disclosed): kitty_release_handoff_e2e grows the restore_dock_focus field the #2916 squash dropped from its fold-time heal - the tip's pa-cli test target does not compile without it. * test(pa-cli): the slow-drain e2e asserts the forced fire structurally The re-executed test binary's libtest harness captures stderr per test, so the watchdog's 'shutdown stalled' line never reaches the pty in the harness child (the real binary writes it to fd 2 - the lane's VM bench legs assert it there). The stalled-drain leg instead asserts the forced exit structurally: the forced restore's own alt-screen leave lands on top of the exit path's (a clean exit leaves it exactly once), the flush never reaches the transcript tail (one copy of the last user row, the startup viewport's), and the process dies with the guard's exit code inside the stall window. Harness needles use the user-message rows (assistant rows carry per-word SGR spans) and the post-exit drain reads the pty's kernel-held bytes before asserting. * fmt: the slow-drain e2e needles and the watchdog's progress read * clippy: doc backticks + checked Duration subtraction in the guard tests; the e2e's needle check takes the direct is_none --------- Co-authored-by: perf-slowdrain-exitguard-fast * perf(pa-core): consolidate settings-lock reads - 32 lock cycles per first turn to 2 (#2941) * pa-ai/pa-core/pa-cli/pa-tui: grok-4.7 on every serving surface (TS #2505) + Claude Code 2.1.281 + Anthropic subscription ban-risk warning (TS #2645) + one owner for the Prime team header, retry failed !command credentials (TS #2497) (#2755) 7373eb471670merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * test(pa-cli): the interactive_daemon_e2e wedge root-kill - PDEATHSIG + orphan sweep + the 300s headless wall (#2942) dbed1170fa2bmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui/pa-cli/pa-daemon: session opens wait through a daemon update restart (TS #2391) + the failed-restart hint (TS #2515) (#2763) e7a84e749089merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-daemon): the all-idle compaction fires like TS and rides the TS compact sync class - journals bounded (#2944) * perf(pa-daemon): settle-tail compact consolidation - the all-idle compaction fires like TS and rides the TS compact sync class The worker recovery journal's all-idle gate ran BEFORE the record insert, so a single-session journal's own busy admission record blocked every settle's compaction: the compact never fired on the dominant shape and the journal grew append-only for the session's lifetime (TS computes the gate POST-insert and compacts at every changed-idle record). The gate now matches TS, bounding the file. Where the compact fires, its temp sync_all was a sync class TS's compact does not pay (TS worker-recovery-journal: writeFileSync + renameSync, no fsync; the command journal's writeFileAtomicSync counterpart does carry fsync). The Finalize seam now encodes the sync class per owner: RetryBusy keeps its fsync (command journal), Synced keeps the Rust-native terminal-compaction journal's belt, and Bare is the TS worker shape - temp write + rename, no fsync. Durability is owned by the append path (the fresh-write class is untouched): the compacted form holds only records the append path already made durable, so a lost compact falls back to the append-only history, which replays identically. * test-only rustfmt of the new test call site (the gate's one fmt finding) * runtime/kernel: vendored-runtime hardening + kernel stderr owner-only (TS #2372/#2423/#2500/#2471/#2478/#2425 parity) (#2744) ea5abd1bbe1bmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: session_ui.rs split 11/14 - the prompt submit pipeline moves out of src/session_ui.rs (#2943) 3bafbc007b74merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-tui): 8-byte packed span records with per-pack style table - scroll retention -7.5MB, byte-identical output (#2939) * perf(pa-tui): denser packed span records - style table + derived offsets (8B/span), byte-exact range expansion * test(pa-tui): rustfmt the exhaustive row-pack range oracle * fix(pa-tui): clippy - if-let style dedup + drop redundant test clones * pa-tui: fix the submit-outlived-by-switch idle-gate race - the turn-end watermark restarts with the mounted stream (#2945) c661290b1b77merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: hold spawn-name reservations until admission is durable; collect returns cancelled envelopes for just-deleted targets (TS #2396 + #2388 F4) (#2757) 18aa772bd3b2merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-ai/pa-core/pa-daemon: codex stale-chain retry after metadata (TS #2374) + safety failures permanent (TS #2472) + quota park until reset with auto-resume (TS #2375) (#2761) dc9892ffbc1emerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * test(pa-tui): the headless settle bound names its stuck member in 60s - defense-in-depth inside the wedge wall (#2949) The interactive_daemon_e2e exit-gate wedge family is root-killed upstream (#2945: the turn-end watermark restarts with the mounted stream) and the harness carries the 300s wall (#2942). This closes the remaining gap: the headless settle was the run loop's only unbounded wait on the product side — a settle member that never drains parked the run forever with no failure name (TS exits the process at shutdown and lets in-flight work dangle, so the settle has no TS counterpart). The gate's twelve settle members are now snapshotted (HeadlessSettle: settled() is the old gate exactly; blockers() names them), and after the plan completes a stuck member fails the run within HEADLESS_SETTLE_TIMEOUT_MS (60s) with the member named — e.g. 'a turn still active' — instead of waiting out the harness's 300s wall with a generic timeout. Green settles are milliseconds after HeadlessDone (the suite's green wall is ~15s; the last submit's own ack bound is 10s), and terminal runs never arm the bound (HeadlessDone exists only on the headless harness; a live terminal ends the run on exit_requested + the exit guard). Proven end-to-end by the lane's matrix: the wedge converted to a 98.4s attributable red naming the latched member (the bound-only diagnostic arm), and the full candidate stayed clean at 30/30 interleaved trials vs 3/30 wedges at the lane parent (record 20260927-085200-interaction-exit-gate-hang-remediation, bench hillclimb). * perf(pa-daemon/rpc): warm the model registry at RPC session boot - first get_available_models 1170.6ms to 58.9ms (#2953) TS session boot resolves the initial model through refreshAvailableModels (model-resolver.ts), which also fetches the live Prime Inference catalog in the background and caches it on disk; the daemon worker fires the same fire-and-forget refresh from its create path (worker/create.rs). The RPC mode hosts the session in-process with no create command, so nothing warmed the caches: an integration's FIRST get_available_models call paid the whole awaited refresh chain on its response path (measured 812-1296ms on the bench VM; the 15s fetch-timeout worst case on a degraded network) while the same command on the daemon and ACP surfaces answers from the validated snapshot. Mirror the daemon worker boot spawn: the caches warm during the session's first turn, and the first call serves the same snapshot. Write behavior is unchanged: the same cache files, the same write-on-fetch-success conditions, the same cadence (hour-gated catalog refresh, 5-min private-authorization TTL), only started at boot. Co-authored-by: perf-rpc-models-persist * pa-tui: session_ui.rs split 4/14 - the share concern moves out of src/session_ui.rs (#2922) b0d72b29a700merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: agent_engine.rs split 8/11 - the turn-execution impl moves out (#2934) a59d3389dfbamerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: supervisor.rs split 5/8 - the worker-lifecycle concern moves out of src/supervisor.rs (#2956) 205f4d0f469cmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: session_ui.rs split 8/14 - the sessions concern moves out of src/session_ui.rs (#2957) 7d19e9832120merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: supervisor.rs split 6/8 - the signals concern moves out (#2960) a6562bc252efmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: agent_engine.rs split 10/11 - the lifecycle concern moves out of src/agent_engine.rs (#2962) 17d3573c5a58merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: session_ui.rs split 12/14 - the keys concern moves out of src/session_ui.rs (#2958) bc6b7d82cb0bmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: agent_engine.rs split 11/11 - the facade trim: the last product free fns move out; the file ends as the composition root (#2964) 1fe6a6791030merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: supervisor.rs split 8/8 - the facade trim: the notes concern moves out, the test battery re-homes (#2963) 8a5274baa0d9merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: session_ui.rs split 9/14 - the panels concern moves out of src/session_ui.rs (#2961) 377eda9ded15merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: session_ui.rs split 13/14 - the apply concern moves out of src/session_ui.rs (#2965) c10a44e407cdmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: cap kernel host-request cell source at 2 KiB (the TS #2475 port) (#2966) 96f689fc38femerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: the /model picker resolves by provider, never the first same-id catalog entry (fixes the operator report) (#2967) 24411964739emerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: session_ui.rs split 14/14 - the facade trim: the file ends as the composition root (#2968) 60cbb4fbb642merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-core): the oauth refresh leaves the auth lock - fetch under single-flight, hold-sum 396ms to 0.09ms (#2971) An expired stored OAuth credential refreshes its token inside AuthStorageBackend::with_lock: the OAuthIntegration seam is synchronous by contract, so the network round trip runs under the document lock AND under the process mutex that spans the whole critical section, stalling every other same-process auth read and write for the fetch (the RPC cycle_model path measured 194-201ms auth.json.lock holds per switch on the bench VM; the assembly read pays one ~0.2ms cycle, the switch pays the fetch). The TS product holds its own lock across the same await (refreshOAuthTokenWithLock -> withLockAsync), but its single-threaded runtime never blocks other work on it; this engine is threaded, so the port narrows the lock scope instead: load-then-lock. The document loads through the consolidated read arm, the token fetch runs outside every lock behind a per-provider single-flight gate (the in-process serialization TS gets from its single-threaded runtime, with the expiry re-checked under the gate so a second caller never spends a single-use refresh token after the first flight landed), and the write re-enters the same locked read-modify-write protocol - now held only for the re-read, insert, and atomic write, and skipping the write entirely when a peer refreshed while the fetch ran. File protocol, read results, and every resolution outcome are unchanged. * pa-daemon: the supervisor roster broadcasts only on content change (the TS #2481 port P3) (#2974) 054553b8ca12merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-cli/pa-tui: prime-agent update - the TS->Rust migration path (uninstall TS, install Rust, sessions preserved) (#2981) 739ed7f7d015merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-core/pa-daemon): a settled RLM child releases its kernel at the settle park - ~27MB reclaimed per settled child, TS #2483 port (#2983) * perf(pa-core/pa-daemon): a settled RLM child releases its kernel at settle - snapshot-flushing stop_kernel, revivable (TS #2483) The rust port of the stale perf PR #2483's inline arm (the supersession analysis: the not-superseded claim - settled children hold a worker and a kernel until parent close; nothing at the tip releases them; the daemon-mode whole-worker passivation stays deferred to the orchestrator): - IpythonKernelProvisioner::stop_kernel (TS stopKernel): shuts the owned kernel down with a final namespace snapshot WITHOUT marking the provisioner disposed; a kernel still starting up is joined first and shut down the same way (the TS managerPromise arm). The stop records a pending-stop gate (TS pendingStop) that the next start_kernel_impl awaits before reading the snapshot back, so a follow-up turn's fresh boot revives the flushed namespace instead of racing the flush; a completed stop awaits instantly and each stop supersedes the previous (a clonable watch receiver: multiple revival waiters gate on it). - The session engine gains stop_kernel_snapshot (the TS stopKernel({snapshot:true}) seam beside dispose_kernel), and the SessionEngine trait gains release_settled_child_kernel (default no-op): the AgentSessionEngine arm evaluates the canPassivateSettledSession gates engine-side - no unsettled descendants (has_unsettled_rlm_work), no registered cron/heartbeat jobs (a worker-wired probe over the shared cron store) - then fires the per-build release probe (a weak provisioner reference, the background-bash-probe adoption pattern, cleared on retire/close). - The turn runner's park arm fires it best-effort when the worker core proves the parent-owned, unattached, unqueued idle state (rlm_depth>0, no attached clients, not compacting, no lane work - the park arm's own construction). The divergence the port discloses: rust children are worker processes (the parent has no in-process reach and the wire is frozen), so the release triggers at the child's own idle park instead of the TS parent's run-settle hook - the same revivability semantics (the next kernel use boots fresh from the flushed snapshot), and the roster/collect surfaces are untouched by design. Tests: the provisioner stop flushes the snapshot and the next ensure revives the namespace (live-kernel, ambient-venv-gated); the park arm's policy matrix (a parent-owned child releases, a root/attached/compacting session stays resident); the engine gates (a registered-jobs probe defers the release, the probe fires otherwise). * test(pa-daemon): the park-arm release test waits on observable readiness (the review advisories) Two BUGBOT test advisories on the first review: the park-arm test's bounded poll used fixed sleeps (a retry-to-green readiness wrapper). The recording engine now notifies on every release fire, so the test waits for the observable readiness - the notification is the pass condition, the bounded timeout is only the failure bound for the positive arm and the absence bound for the gated arms (no fixed sleep ever makes a pass). The commit also lands the VM's cargo fmt output on the touched files (the first commit's hand-written formatting failed the review's fmt pre-flight: the lane builds on the VM only, and the formatted sources must sync back before every commit). * perf(pa-core): provider auth answers once per provider - the #2479 memoization ports, per-model probe -66% (#2973) * perf(pa-core): provider auth answers once per provider and the private PI authorization cache parses once per file identity (TS #2479) The rust port of the four unclaimed mechanisms of the stale perf PR #2479 (the supersession analysis: the rest of that PR's premise landed via #2932's storage read-cache): - get_available's per-model has_configured_auth becomes a per-provider memo: the catalog walks hundreds of models over a few dozen providers and each probe rebuilds the provider's auth-source candidates, while a same-registry probe is stable by construction (&self, no mutation between models). TS getAvailable's authByProvider map. - get_rlm_searchable_models' per-model get_auth_status becomes the same per-provider memo (TS _authenticatedRlmModels' selectableByProvider). - read_private_prime_authorization_cache serves from a process-wide stat-identity snapshot (dev/ino/mtime_ns/len, the TS CatalogFileIdentity) while the file is unchanged; the port builds a fresh registry per resolution touchpoint (the TS session kept one long-lived registry), so the parse would otherwise re-run on every resolution. Only a successful parse bracketed by one identity is pinned, a failed read unpins (retries), and the write path's atomic rename supersedes (new identity). - AuthStorage memoizes auth-source candidates keyed by the hashed material itself (TS authCandidateMemos): reuse skips only the SHA-256 work, env values are deliberately re-read on every call, command values resolve before the memo, and stale checks run against the memoized candidate (candidates are immutable). Tests: the per-provider status memo gates one stale provider across all its models while a second authed provider keeps its models; the private-cache snapshot pins stable parses, re-parses rewrites, and never pins a failed read or resurrects a deleted file; the candidate memos supersede exactly when the hashed material changes (a stale marking from an old value never gates a changed one). * test(pa-core): the stale-provider memo test asserts the tip's stale-aware has_auth The memo regression test claimed a stale-marked provider's models stay in get_available ("stale is only the searchable-set's gate") - but AuthStorage::has_auth is stale-aware at the tip (available_candidate skips candidates matching a marked stale token), so get_available gates the stale provider too, and the tip's get_rlm_searchable_models gates it twice over. The memo preserves exactly those semantics; assert them: the stale provider is gated across all its models from BOTH sets, and a second authed provider keeps its models. Discovered by the full-suite fleet gate (gate_1790546015_945232) - the lane's local legs had not run the test suite; the three other gate reds (kernel_restore_guards x2, tui_prime_login_escape) are SOLO-GREEN on the exact head content (co-scheduling class, the standing family from gate_1790531716). * test(pa-core): behavior-focused wording in the candidate-memo test comments (the review advisory) The BUGBOT history-narration advisory asked for comments that state the current behavior rather than the sequence of edits: the env-change arm now says what the memo key does (a changed value changes the key, so the rebuilt candidate's value fingerprint differs from the stale token's) and the return arm says the marked material's candidate re-serves when its value returns. * pa-cli/docs: the update fetch source flips to the official domain at the rust-to-main merge (#2984) 309dd96b1f96merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: agents_view.rs split stages 1-2 - the test mass re-homes + the delete concern moves out (#2985) bd221cb5e70amerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-daemon): saved_session_context reads windowed-first - worker resume CPU -140ms, the parse signature (#2969) * perf(pa-daemon): windowed-first saved_session_context - the create-path model restore reads the windowed store (restored_settings + has_thinking_level) instead of full-parsing the session history; open_windowed's full-open fallback keeps unsupported/malformed files identical; differential oracle keeps the pre-change full-parse reader as the reference across no-boundary/in-window/model-only-before/thinking-only-before/malformed-prefix fixture classes * perf(pa-daemon): address the Bugbot findings on the windowed saved_session_context - comments describe current behavior only, the oracle helper returns the owned TempDir so fixture scratch trees clean up at test scope end --------- Co-authored-by: perf-launch-open-fast * pa-core: compact_session.rs split - the tests re-home + the summarization, anchor-selection, and boundary cuts (#2987) f43aebc9c50dmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: agents_view.rs split stage 3 - the render concern moves out (#2988) 03a6fcc07793merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * install: the Rust port takes over the prime-agent keyword - clean TS daemon shutdown, config preserved (#2972) 737e52dc7695merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: the scheduling catalog fans out per-worker (the TS port P4) (#2979) 1e78bb715fddmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: agents_view.rs split stage 4 - the open + incident concerns move out (#2991) 0ef076a06131merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: session_store.rs split - the index, read, write, view, info, tests children (#2990) 7b58b0acb457merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: agents_view.rs split stage 5 - the data + input concerns move out; the file ends as the composition root (#2992) cadb8b4f33d6merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * docs: the README becomes the Rust product's own; the port-process docs are removed (#2993) fe891d188ad0merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: snapshot.rs split stages 1-2 - the test mass re-homes + the tool-fold concern moves out (#2995) eaa4b672f2f8merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: snapshot.rs split stage 3 - the decoder concern moves out; the file ends as the composition root (#2996) 1564648986edmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: rlm_children.rs split - the composition root (host, lifecycle, usage, registry, tests) (#2997) 4ee722d403b6merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: interactive.rs split - the tests, onboarding, headless, render, reconnect, run children (#2998) d592a0672d5dmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-daemon): share the open's artifacts + skip the depth scan's full parse (cold-open-residual) (#2970) 5b75513ff7fbmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: every session-exit route restores the terminal - the kitty-mode leak into the shell is fixed (#3001) 8f84a46233cdmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-cli: the family-seeding e2e spawns pin the daemon's session dir (the flash e2e's seeded-family red) (#3003) c54ff2a09a84merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: undo the condensed activity runs - the collapse mode becomes details mode minus thinking blocks (#2999) a6d8414d818cmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-cli: print_boundary.rs split - the 4 stages: events, compaction_arms, autorefine, tests (#2989) 2292af8f1cefmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: bash_view.rs split - under 1,000 lines (#3008) 15d9c1a659efmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: auth_panel.rs split - under 1,000 lines (#3009) 8c3061a5db29merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: heartbeats_picker.rs split - under 1,000 lines (#3011) 13849ce9138cmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: the queue groups internal prompts in the summary; the edit surface is user-origin only (#3012) b19ffd2ff84fmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * docs: docs/ ends empty per the operator's ruling; the README's install detail goes with it (#3007) d89e319660c4merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: the terminal-state differential - every armed mode restores on every exit route (#3002) aba71e8b491dmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: the worker test mass splits by family - under 1,000 lines (#3014) f011aaac54c7merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui/pa-ai/pa-agent: /tier command + Default service tier settings row + footer badge + completions service_tier forwarding + proxy serviceTier (TS #2144 half + #2491 half) (#2735) e8cdef33d443merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core/pa-daemon/pa-types: the Windows platform gaps close - the tilde arm, the win32 path resolution, the TS launch budgets (#3016) 438012e04c27merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: the agents_view test mass splits by family - under 1,000 lines (#3018) 7c488aca640bmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * fix(pa-daemon): the compacting admission gate - a racing turn defers through the compaction window, the parked work delivers after it (#3021) b15dc777d141merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-core): cut the refine pre-LLM full-entries snapshot clone (-9.5ms / -30.4% pre-LLM at 10MiB) (#3013) f9c343f8d7a5merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge); optional lane gate evidence: gate_1790621761_1065006 GREEN. * perf(tui): slice the kitty-probe reader-lock window to 10ms polls - early typing delivers while the probe listens (#3010) 07be8ffbcc74merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * install: the installer bootstraps its own Python via uv; the output flow; the bash-3.2 parse fix; the test suite moves lane-side (#3017) a2c94944cc40merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-core): refine pushes its appended rows instead of rebuilding the context (-25.4ms / -35% at 10MiB; TS-parity restoring) (#3020) f3a9757dd30dmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * fix(pa-core): the digest terms' window direction - TS slice(-4) keeps the NEWEST four texts, not truncate(4)'s oldest four (#3019) f310e1c9bc42merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * test(pa-core): the compact digest-capture placement oracles - the ENTER capture is the TS-parity shield (byte-identity across placements in frozen windows; the racing class) (#3006) ae542c6a56bcmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core/pa-agent/pa-daemon/pa-tui: settings.imageModel routes image turns to a configured image model + the [python-skills-unavailable] notice (TS #2453 + #2381) (#2741) 5098db88b8f8merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * install: the TS daemon always stops on install - busy daemons get the forced shutdown (#3028) 78b0b58de028merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: per-call-site durability for the shared atomic_write - the TS WriteFileAtomicOptions shape (#3023) 2acae69edf1fmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * docs: the last docs/ file goes - the terminal-leak audit repo copy (the ruling final straggler) (#3026) 0d72ff3d77d0merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-daemon): flush the RPC compaction_start frame before the pre-summarizer CPU span (client-visibility: +48.8ms p50 -> +0.143ms, 341x) (#3024) ddf75643ab00merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge); optional lane gate evidence: gate_1790634676_1065157 GREEN. * pa-tui: agents_view_forest.rs split - under 1,000 lines (#3040) 741be982e655merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * privacy: scrub personal machine paths and identity data from docs + fixtures (the security-scan lane) (#3046) ba9ea3b7eb5amerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: the subagent surfaces - one running count on the prompt bar, one dropdown in the agents view (#3031) b1ee386c0ddemerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * ci: the windows runtime triage workflow - on-demand Windows battery runs on any ref (#3022) 425b1751cb67merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: manager.rs split - under 1,000 lines (#3039) 5220b3c2f589merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * clippy: pa-cli is pedantic-clean (#3050) f2fdb439d3demerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * clippy: pa-daemon is pedantic-clean (#3029) c233c84b62dcmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * skills: the parity quick-fixes (#3058) 4de8f9c2acc9merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: info_commands.rs split - under 1,000 lines (#3057) febdcffc7cbbmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: agent_traces.rs split - under 1,000 lines (#3061) 5518a73acaf0merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: markdown.rs split - under 1,000 lines (#3066) f23b3d05c93dmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-cli: interactive_mode.rs split - under 1,000 lines (#3055) b559cd018f80merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: the settings page pass - spacing, arrow value-cycling, the tab keys, the white selection, the fullscreen retirement, two regressions (#3051) 286006389509merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * skills/runtime: the generic mcp skill + the discovery/tooling surface (#3063) 563c576e8123merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-core): the recurring capture-freshness memo - skip the redundant kernel re-dump while the namespace provably cannot have changed (#3037) 09043ae3b2b4merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: telemetry.rs split - under 1,000 lines (#3074) 2aeda90ba25bmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: model_picker/mod.rs split - under 1,000 lines (#3070) 867dfa067633merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: session_engine/mod.rs split - under 1,000 lines (#3062) fe1ee606180bmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: the compact_session test mass splits by family - under 1,000 lines (#3073) e27835fee7f4merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: rlm_ledger.rs split - under 1,000 lines (#3078) 758ea09ebc34merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: auth/manager.rs split - under 1,000 lines (#3071) 36a261afd673merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: queued.rs split - under 1,000 lines (#3079) 91873baa42cbmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: ctrl+s stashes and restores the prompt draft (#3072) 443ab531022amerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: venv.rs split - under 1,000 lines (#3077) d6ae9a7770e9merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: sequence_guard.rs split - under 1,000 lines (#3083) 430d6141a0ccmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: session_engine/request_timing.rs split - under 1,000 lines (#3084) fdd1f5bbfbcamerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: the session_ui composition root trims under 1,000 lines (#3064) b068d7a48a13merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: chat.rs split - under 1,000 lines (#3081) 65525952ae25merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: daemon_client.rs split - under 1,000 lines (#3086) ddef55111f26merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: supervisor_e2e.rs splits by test family - under 1,000 lines (#3067) 81b928e55a00merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: view.rs split - the 3,888-line god-file ends as an 841-line composition root + 5 concern children (#3088) 0ff470e08385merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: the agent_engine test mass splits by family - under 1,000 lines (#3059) 9cabd79136demerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * runtime: blocking usage beyond the auto-bg threshold degrades to a handle - bash awaits and python execution alike (#3076) b17703d1425cmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: chrome.rs split - under 1,000 lines (#3087) 7af1b5840f32merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-ai/ci: the TS-parity sweep-2 quick-fixes - Gemma 4 thinkingLevel on Vertex (TS #2946), Azure store:false (TS #2948), the staleness gate live (TS #2567) (#3068) b5cf6ec2b29cmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: tree_list.rs split - under 1,000 lines (#3091) d54b591b12a2merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: autocomplete.rs split - under 1,000 lines (#3092) 6a90ccf77948merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: keybindings.rs split - under 1,000 lines (#3090) 337d2efcc712merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: mcp_view.rs split - under 1,000 lines (#3094) 500fcd9581a9merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: worker/turn_stream_tests.rs split - under 1,000 lines (#3095) 2b9778a0dc6emerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * clippy: pa-core is pedantic-clean (#3093) 273b29234448merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: the goal timer counts from the goal creation; the goal continuation fires once per boundary (#3048) f116a6b5a849merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: the termios + process-tree exit audit - no raw-mode/flow/orphan/fd leaks (#3089) 13683dba140dmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: agent_engine/turn.rs split - under 1,000 lines (#3102) c8af2dd96ba0merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: the per-model layer trims to the minimal format reference - the empty block gone (#3106) bd3b03f57b6bmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: scheduled_jobs.rs split - under 1,000 lines (#3105) 67ea4b6ff782merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui/pa-core: the image-heavy session-open fix - the render-path skip + the measured fast paths (#3098) 3325e22b396emerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: settings_menu.rs split - under 1,000 lines (#3108) b789ea8dc265merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * clippy: the small crates are pedantic-clean (pa-ai, pa-agent, pa-types, pa-telemetry, pa-models) (#3110) 25ab57d2829fmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: the hover + click affordances - the dock groups, the hints, the agents-view rows, the dropdowns; every clickable thing shows it (#3109) 0f871da2e8a1merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * install/pa-daemon: the takeover completes - the rust daemon stops on update; the schema-family match; the no-auto-resume contract (#3107) 29645e1b9bb7merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: supervisor_restart_e2e.rs splits by test family - under 1,000 lines (#3114) 9434853a18e7merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-telemetry: the #2117 tracking intent lands clean - the modular catalog, the accurate firing, the edge cases pinned (#3100) 942f003642b0merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-ai: stream_failure.rs split - under 1,000 lines (#3116) 4b7300a6147dmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: engine.rs split - under 1,000 lines (#3118) 8b6dda11865dmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: the handshake channel stays private until the auth answer installs it - the launch-storm connect-budget wedge closes (#3075) 80e9fe60091emerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: harness_digest.rs split - under 1,000 lines (#3119) c806bee6fe79merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui/pa-daemon: the bare /skill: invocation guards - the TUI hint + the empty-args notice + the engine floor (#3113) 2d72de5cef32merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: agent_messaging.rs split - under 1,000 lines (#3120) 691e0785cca3merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-tui): the cross-view layout handoff - reuse the visible-window packs on the agents->chat re-entry (-100.1ms / -35.7% at canon) (#3103) cd55ae21aefemerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: session_stats.rs split - under 1,000 lines (#3122) af8138eaee3amerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: models/registry.rs split - under 1,000 lines (#3124) 4c4d622bcb8dmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: compaction_arms.rs split - under 1,000 lines (#3125) 16d6c239ae3amerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-ai): append streamed Responses mirror text and reasoning-details fragments in place instead of re-copying per delta (#3035) * perf(pa-core): scan only new bytes for newlines - linear line framing (TS #2781 twin) (#3042) * test(pa-core): the multi-MiB protocol-line timing tests for the kernel reader and the extension LineDecoder (TS #2781 twin) A 4 MiB decoder line fed in 1 KiB chunks and a 31 MiB blank kernel line read through the 64 KiB pipe reader must complete under the computed bounds: while every chunk rescans the buffered prefix, they scan >= 8.6 GB and >= 8 GB and overrun them. The blank line never reaches parse_event, so the bound separates pure scanning from the quadratic rescan. Failing runs report their real duration in the assertion message. * perf(pa-core): the kernel protocol reader and the extension LineDecoder scan each byte once - linear line framing (TS #2781 twin) Both readers keep only the newline-free tail of earlier chunks, so the newline scan resumes at the old buffer length instead of restarting at zero: while one line accumulates, every chunk rescanned bytes already known to hold no newline. The decoder also consumes lines by offset and drains once per feed instead of one O(remaining) drain per line. Measured (8-core sandbox, prebuilt debug test binaries, medians of 3): a 4 MiB decoder line in 1 KiB feeds 14.27s -> 0.014s (~1000x); a 31 MiB blank kernel line 13.85s -> 0.65s (the ~13.2s quadratic rescan eliminated; the remainder is the one-pass scan plus the UTF-8 and trim checks the blank line still pays). Frame handling is byte-identical: same oversize checks and order, CR and blank-line rules, invalid-UTF-8 endings, and post-error buffers. * perf(pa-daemon): mint session entry ids against the by_id index instead of rebuilding an id map per append (#3053) append_entry and persist_entry_at rebuilt a HashMap of every entry id on each call just to check the new id for collisions. The store's by_id index already holds the same ids, so check against it: appends drop from O(n) to O(1). The fork and branch paths in session_tree reuse by_id the same way instead of keeping their own id copies. * perf(pa-ai): Anthropic stream edits the output blocks directly instead of copying a second block list per delta (#3056) * pa-ai(anthropic): mutate output.content directly instead of copying a duplicate block list per delta * pa-ai(anthropic): trim the stream snapshot test per review (struct-update expected values, one-line terminal assert) * pa-ai(anthropic): state why the stream snapshot test allows too_many_lines * pa-cli/pa-daemon: daemon-attached ACP honors the CLI session flags (#3096) The daemon-attached ACP path dropped --append-system-prompt, --system-prompt, --skill, --prompt-template, --extension, --tools, --thinking and --autonomous*. The CLI now sends them in the daemon create config under the TS field names, the supervisor keeps them in the stored create command, and the worker feeds them into every session build (autonomous starts enabled with its limits). * pa-tui: the @ fuzzy file search - fd's ignore-crate walk off the UI thread (#3097) `@` tokens route to a background walk with fd's semantics (the ignore crate: --type f/d, --follow, --hidden, --exclude .git, the 100-result cap, smart-case regex on the name - the whole path for slash queries, the scoped @dir/ form, quoted values); TS scoreEntry sorts and truncates the menu, and the apply adds the TS @ branch's trailing space for files. The editor parks the request at its idle tick, drops a stale search on the next one (cancelling the walk), and a new request aborts the in-flight one. * perf(pa-daemon): the resume create folds the saved context once - the model restore's second windowed open and its duplicate fold are gone (-62ms / -98% of the create-path restore class at the 22.9MB image-heavy fixture) (#3127) f5384e379cbamerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(tui): the attached idle wake cut - the reader parks edge-driven, the quiet tick arms only on pending work (#3126) 73dae6dd89d8merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * fix(pa-daemon): saved sessions keep their parent link, and the family view checks depth so forks are not children (#3041) * pa-daemon: saved rows publish the header binding and the family classifiers apply its depth (TS summaryForInactiveSession + selectAgentFamily) `saved_session_summary` now publishes `rlmDepth` always and `parentSessionPath` only when one is recorded, restoring the TS `summaryForInactiveSession` row: a session a user created under a parent (feature 1's top-level file binding) keeps its family edge in `agent_observe`/`agent_message` once its worker is gone, exactly like a resident one. Publishing the binding alone would regress: a fork carries its source's `parentSessionPath` at its source's own depth, and the depth-less file arms of `row_is_child`/`row_is_sibling` would read it as a child (live forks already are; saved ones would become one). The file arms now apply TS `selectAgentFamily`'s depth rule - a child sits exactly one level down, a sibling at the same depth - read from `FamilyIdentity::rlm_depth` (from the session summary) and the row's `rlmDepth` (TS `agent.rlmDepth ?? 0`). The spawn-id arms stay depth-free: only spawned children carry them, and a spawn always sits one level below its parent. Operator context: the "agents and users are equal collaborators" ruling (snimu 2026-09-28), same precedent as the chrome.rs 2026-09-24 directive notes - daemon-side internals only, no new public surface, no pa-types change. * pa-daemon: a depth-0 binding is no parent edge - the family reads route through one parent_binding accessor (TS familyCatalogEntry) Review fix for 3e14b7e51: the depth rule alone broke the common `/fork` case. A fork of a root carries its source's `parentSessionPath` at depth 0, and TS never treats a depth-0 binding as a parent edge (`familyCatalogEntry` keeps `parentSessionPath` only when `depth > 0`) - a root fork is a plain root and a Sibling of its source. The first commit's classifiers instead read the raw field everywhere, so a saved root fork vanished from its source's family and a live one went from Child to absent. One accessor now states the rule once and every family read of `parentSessionPath` routes through it: `from_summary` (a root fork's identity is top-level, its source is a Sibling, never its Parent), `row_is_child`'s file arm, `row_is_sibling`'s top-level arm (a root fork row is a root too) and its file arm. The wire keeps the raw field (TS also publishes it in `summaryForInactiveSession` and strips it only when building the family catalog), so saved rows and peers are untouched; the `parentSessionId` half of the TS guard is not needed (spawn ids only exist on subagent summaries, always depth >= 1). Tests: the family test is renamed and now expects the root fork as Sibling; a new part (iii) builds the fork's identity through `from_summary` - without read 1 it labels its source Parent and drops the other roots. The two moved-parent fixtures gain the `rlmDepth: 1` every real worker summary publishes (the identity is a depth-1 child). The whole-tuple asserts and the `row_depth` reuse in `from_summary` fold in the review nits. * feat(pa-tui): the activity dock renders in every session, all-zero included (#3036) The bottom activity dock was mounted only while some count existed (subagent history, heartbeats, bash history, or a live goal), so an idle session rendered nothing below the tray. The operator's 2026-09-28 directive: the dock renders in every session — the muted rule plus ` ◆ 0 subagents · ◷ 0 heartbeats · ▸ 0 shells` — and its Subagents group opens the scoped agents view even with no children, which shows the view's existing `No sessions yet.` empty state (TS `SubagentSummaryLine` renders nothing at zero; sanctioned divergence, the same precedent as the chrome.rs operator-directive notes). - delete the visibility premise: `ActivityDock::visible()` and the `subagents_total`/`bash_total` fields (their only consumer was the gate); `render_activity_dock` returns `Vec` and drops the `width == 0` early return (the truncator already yields an empty row at width 0 — keeping the guard would be an impossible-state defense) - `update_subagent_summary` always mounts the dock; a focused selection only steps when its group leaves the row (only the goal group can) - `focus_activity_dock` (alt+a and every dock panel's close) always takes focus; the duplicate step-into-groups copy is gone (`update_subagent_summary` owns that step) - the scope-back dock-focus restore is assigned directly after the attach (the attach's rebind reset clears focus): the `pending_dock_focus_restore` one-shot deferral existed only so the restore could check `visible()` once the roster had seeded - the PromptDown gate stays (TS `isSelectable()` parity — the prompt's Down keeps input-history recall in zero sessions), and `DockFold` keeps its machinery with counts-rationale comments Tests: the all-zero headless e2e (the dock row renders, alt+a + Enter opens the scoped empty view, which carries the exact AgentsViewScope) fails without the change; the childless-scope unit test pins the newly reachable empty view's keys (search, Enter no-op, escape back, ctrl+d, ctrl+n dispatch); the pinned mouse-selection geometry moves two rows up (25:66 -> 23:66) because the dock always renders. Visible behavior note (the operator's 2026-09-26 panel-exit ruling now applies in zero sessions): closing the heartbeats view, the bash view, or the goal panel restores focus to the panel's own dock item instead of the editor; typing still releases the focus into the editor path. * revert: the auto-backgrounding guards (PR #3076) - not yet (#3129) 7ebcf2c7f409merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * clippy: pa-tui is pedantic-clean (#3134) b4ff5a053977merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * perf(pa-agent/pa-daemon): stop copying the whole streamed message on every delta (#3045) * perf(pa-agent/pa-daemon): share streaming partials via Arc and convert to wire form at coalescer flush * pa-daemon/pa-agent: review fixes for the streaming-snapshot change * perf(pa-tui): cache settled markdown blocks like TS and reuse the cache for row counts (#3060) * pa-tui: cache settled markdown blocks like TS and reuse the cache for row counts * pa-tui: tighten the markdown cache comments * pa-tui: accent every recognized slash command in the editor (#3080) * chore: remove the ci/ workflow staging dir - the promotion-era holdover (the live set is .github/workflows/) (#3133) 6a6d22e35984merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui: a mouse click expands only the clicked card (#3043) * fix(pa-tui): a mouse click expands only the clicked card * fix(pa-tui): the layout handoff skips clicked cards - the re-entry renders them at the level A clicked card's layout slot holds its flipped rows, but the toggles live in the exiting view and the re-entered chat starts with none. The agents-view round trip served those rows anyway: the card rendered expanded while its row count said collapsed, and the next click looked like it did nothing. stash_layout_handoff now skips the entries in toggled_cards, so they re-render at the conversation level on re-entry, like TS mounting fresh components. * feat(pa-daemon): the whole-worker idle passivation - TS idleEvictionMinutes gains its consumer (the settled-child whole-worker stop, the passive-row survival, the wake-and-revive) (#3104) 7e42d9718928merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * fix(pa-ai): the windows-latest pair - the callback port-bind + the bedrock h2/http1 answer (#3137) 43a9f20004ebmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * fix(pa-ai): the review pass on the windows pair - the readiness event replaces the fixed sleep (#3141) 82abcc6e48e9merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-tui/pa-cli: the kitty probe's verdict-time contract locked as e2e oracles (the DA1 early conclusion timed + the deadline's late-kitty role documented) (#3138) 760f2e275134merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge); optional lane gate evidence: gate_1790709491_1423357 GREEN. * pa-cli: kitty_exit_routes_e2e.rs split - under 1,000 lines (#3135) ef9fe60e80ccmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-ai/pa-core/pa-daemon: the provider failure never settles silently; the goal continuation checks progress - the 402 diagnosis fixes (#3101) c32b074fc57emerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-daemon: engine.rs split - under 1,000 lines (#3111) 14651aab0c60merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * fix(pa-cli): the update funnel fetches the official domain (the merge-window flip) (#3142) 6594ec52eba0merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * ci: the release flow core - the release PR, the GitHub-only tags, the nightly cron, the publish wiring, the 0.10.0 lineage (#3069) b64e7feb6cafmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * Show the same session cost in the chat title and the agents view (#3112) 99da012fca54merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: turn_boundary.rs split - under 1,000 lines (#3147) 80a5d54964c5merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * Make 9 declared keybindings work: external editor, model selector, agents view (#3117) 7d889e0d06f5merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * ci: enforce clippy::pedantic - the gate the five campaigns earned (#3152) e8ef65947f8bmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * pa-core: manager_catalog.rs split - under 1,000 lines (#3153) 1d2ba12130d0merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * ci: the wave speedup - the cargo cache + the shard-count knob (#3151) c1e9b848abeamerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * fix(pa-tui): the selection color matches the hover band - the pink/purple replacement in the agents view + the tab below the prompt bar (#3161) 300ba148eca1merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * test(pa-ai/pa-tui/pa-core): the thinking-channel pins + the request-timing payload capture (the fast-model leak diagnosis) Per the accepted fast-model leak diagnosis (2026-09-29): the TUI/store mappings are provider-envelope-driven and faithful - the pins prove it at every layer, the engine/agent thinking-level sync footgun gets its trivial TS-parity fix, and the request-timing wiring gains the outbound payload capture so the next leak window yields the decisive artifact. - pa-ai stream pins (stream/tests/stream_pins.rs): the content-only envelope (reasoning riding content deltas assembles NO thinking block, the prose merges into the text block, no thinking events) and the healthy envelope (reasoning_content deltas assemble the thinking block whose signature is the field name). - pa-tui render pin (snapshot/tests/thinking_pins.rs): the two stored row shapes (healthy thinking+text vs the content-only text row) decode and render faithfully - thinking renders collapsible detail-gated, the text-only row renders plain and identical at every detail level (nothing to widen). - pa-daemon: switch_model re-syncs the built session's agent slot to the re-clamped effective level (TS setModel re-applies the level via _getThinkingLevelForModelSwitch + setThinkingLevel). No durable thinking_level_change row: TS setModel records only the model row. Pinned: reported level == the request's carried level across model switches (fails without the fix), requested level survives the round trip. - pa-core request timing (request_timing/payload.rs): the outbound payload capture rides the same flag (settings requestTiming | PI_REQUEST_TIMING): the instrumented payload hook hands each request's final outbound body - exactly what the provider sees - to a bounded background writer (record never touches the filesystem; a slow or full writer drops captures, never delays the request) that persists owner-only-mode files under /logs/request-payloads/ (process-unique names, the atomic temp-then-rename write, newest-64 ring, best-effort throughout). Engine sessions (the daemon workers' build path) capture while on, write nothing while off. * fix(pa-tui): the Esc recursion overflow - the pop loop terminates at the empty state (#3160) b128daf8c909merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * fix(pa-cli): the ACP config fixture redirect resolves on windows - the registry fallback order (#3162) 462c9fa8934dmerge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * ci/install: the R2 publish phase - the release ships to the bucket, the user path never touches GitHub (#3154) 36eecc783ae2merge bar v23: mandatory CI green on the exact head + zero unresolved bot threads + head unmoved (verified by fleet_pipeline.fleet_merge). * chore: the workspace version reads 0.9.8 - the TS shipped 0.9.8, the first beta must be v0.9.8-beta.1 not a regression * docs: the installer header states the R2 channel - the stale workflow-artifact source line retired * perf(pa-tui): the ! bash card keeps only the output tail it renders - same rows, bounded memory (#3038) The card stored every output line for the whole session. Every render joined all of them and split the result again. Streaming a large command made this quadratic. The card now keeps only the last 50 KiB + 1 byte of output, which is all truncate_tail needs to return the same visible tail and truncation flag. 30 MiB stream (sandbox, release): 3.7s -> 28ms; 100 repaints 652ms -> 2.1ms; peak RSS 131 MiB -> 7.7 MiB. * fix(pa-daemon): raise the open-file soft limit to the hard limit at daemon start (#3150) macOS starts every process with a soft RLIMIT_NOFILE of 256. The daemon holds about two unix sockets per worker, so it runs out of descriptors near 115 workers and then fails accepts and worker spawns. Node raises the soft limit at startup, which is why the TS daemon never hit this. The supervisor now raises the soft limit to the hard limit before it binds its socket (capped at kern.maxfilesperproc on macOS, which refuses RLIM_INFINITY) and logs the result. Workers and kernels inherit it. * pa-tui: one guttered layout for expandable chat rows (TS #2779; Rust gutter/refinement conventions kept) (#3049) * pa-tui: one guttered layout for expandable chat rows (TS #2779; Rust gutter/refinement conventions kept) Port the layout from TS #2779 to the Rust TUI. Shell completions, injected prompts, the skill card, the generic custom panel, and the compaction summary now render their expanded bodies the same way: a dim gutter on the first non-blank body row, a four-column indent on the rest, every row clipped to the width. - Skill card and generic custom panel lose their customMessageBg boxes. - The skill body no longer repeats the skill name. - Injected-prompt headers drop the invisible expand-hint space. - Compaction metadata moves onto the expanded header row. - Markdown bodies share one new helper pair in branch.rs. Kept on purpose (operator decision, 2026-09-28): the gutter sits on the first non-blank row, and the refinement outcome keeps its layout. * pa-tui: update the expanded compaction header assertion in the view test * test: proptest pilot - property tests replace the framer, view-geometry, and tool-card example tests (#3099) * ci: the empty-commit retrigger - the runner's kernel venv missed the runtime install (ModuleNotFoundError: rlm) in the kernel_lifecycle e2e; the same tree's sandbox battery is green (gate round 7, FAILED_SECTIONS=0) * ci: the empty-commit retrigger (2) - wave 2's shard-5 red was the base-code TUI e2e tui_prime_login_escape_keeps_the_default_team_status (#3117, outside this diff): solo x3 GREEN at the identical tree in the lane sandbox; wave 1's kernel-venv class (ModuleNotFoundError: rlm) also proved transient (wave 2's shard 3 green) * ci: the empty-commit retrigger (3) - wave 3's reds (shard 4: tui_refused_submit_restores_the_draft_after_the_round_trip; shard 6: begin_login_host_request_is_live_in_the_worker + settings_declared_stdio_server_round_trips_through_the_kernel_mcp_client) are ALL base-code e2e load flakes outside this diff: every one SOLO-GREEN at the identical tree in the lane sandbox; waves 1-2's classes (kernel-venv install, the clipboard-auth TUI e2e) also solo-green and wave-2-proven-transient * fix(pa-core/pa-daemon): the Macroscope round - the capture's confidentiality + memory bounds, and the atomic model/level switch The six Macroscope threads on PR #3168: - THE SYMLINK REFUSAL (High): every path component from the agent dir down must be a real directory - a symlinked logs/ or ring dir would redirect the private-mode writes into an attacker-owned tree, so the capture refuses before creating or restricting anything. The temp file is created exclusively (create_new): a pre-existing path at the predictable name fails the open instead of being followed. Pinned: a symlinked ring dir + a symlinked logs component both end the capture with nothing reaching the target. - THE WINDOWS REFUSAL (High): the platform wall's restriction helpers are inherited-ACL no-ops on Windows; rather than write complete request bodies through a possibly permissive inherited ACL, the capture stays disabled there (a documented limitation until the wall gains a restrictive DACL; see the module doc). - THE RETAINED-BYTES BUDGET (High): the queue bounded the COUNT, not the BYTES - 64 large-image bodies could OOM the agent under a stalled writer. The budget (REQUEST_PAYLOAD_BUDGET_BYTES, 64 MiB) is reserved alongside the slot, priced by a non-allocating walk of the payload (the saturation path stays O(1); the over-budget path walks without cloning), and the writer releases each body's estimate once its write settles. Pinned: an over-budget body drops without landing, and a fresh handoff lands after the drain (no leak). - THE ATOMIC MODEL/LEVEL SWITCH (High): set_model and set_thinking_level took the agent lock separately - a concurrently admitted turn could send the new model with the old level. The new Agent::set_model_and_thinking_level (pa-agent) + the AgentSession::set_model_and_thinking_level seam (pa-core) update both fields in ONE lock acquisition, and the daemon's switch_model uses it. Pinned: 20k racing snapshots observe zero mixed pairs (the two-step form measurably reds: ~4000 mixed per run on the same test). - THE TEMP CLEANUP (Medium): a failed write removes its temp file (write/flush/rename errors no longer accumulate partial bodies; the ring still ages crash leftovers). Pinned: the blocked-rename failure leaves no .tmp behind. - THE PINS' SATURATION PREMISE (Medium): the saturated-queue and concurrent-producers pins no longer assume the stall body's serialization holds its reservation - the fill loop saturates the queue against the reserve counter itself (the observable), the drain completes against the counter, and the file counts are dynamic. * fix(pa-core): the Macroscope round's seventh thread - the budget's estimate is a true upper bound payload_bytes undercounted: nodes priced at their text bytes alone (a cloned Value enum element costs its enum footprint, a map entry its key + slot + value), and the budget did not price the transient full-body copies (the queue's clone, the envelope's re-clone, the serialization buffer). The estimate now prices every node's own footprint plus the collection slots and carries the transient-copies multiplier (x3): an OOM guard overcounts on purpose. The budget tests re-priced (three 8-MiB bodies: two fit, the third crosses); the stall bodies re-sized (100k nodes: the estimate fits the budget with the fills); the hands-off body 8 MiB. * test(pa-core): the Bugbot pin-race - the over-budget pin holds the writer on a stall body The three budget records were priced against reservations the writer could free mid-test (its first write completing releases the estimate, letting the third body land). The pin now stalls the writer on a many-node body first (the 20k-node stall serializes far longer than the three records take), so the drop at the budget gate is the budget's, not the drain's timing. Re-run green 10/10. * test(pa-core): the ninth thread - the capture tests are Unix-gated with the capture The capture refuses on non-Unix (its confidentiality boundary is not enforceable there), so the record-based tests would wait out their deadlines on Windows with nothing able to land. The capture's own battery, the writer test lock, and the three facade integration tests are cfg(unix) now - the feature's surface and its tests move together. --------- Co-authored-by: perf-kernel-cell-fast Co-authored-by: perf-spawn-admission-fast Co-authored-by: perf-catalog-second-parse-fast Co-authored-by: perf-tui-memory-fast Co-authored-by: perf-daemon-rss-fast Co-authored-by: perf-model-resolve-cache-fast Co-authored-by: perf-tui-scroll-retain-fast Co-authored-by: wc Co-authored-by: perf-launch-open-fast Co-authored-by: Sebastian Müller