@andorra-labs/code 0.0.0-stage → 0.1.4

package/tests/browser-test-plan.md

@@ -0,0 +1,280 @@
+# Browser workspace QA plan
+
+## Scope and prerequisites
+
+The local browser workspace provides a GUI for CLI and browser-created Andorra sessions: projects grouped by folder, retained conversation and tool activity, prompts, steering, cancellation, runtime questions and approval decisions. It uses the configured default graph, provider/model and workspace permissions. Node >=22.19 and a supported desktop browser are required. Configure a provider with `/providers`; credentials remain in the existing local configuration. Paid graphs retain existing entitlement checks. The default Software Engineer graph remains available without membership.
+
+Use a dedicated feature worktree; verify `git branch --show-current`, then run `npm ci`, `npm run check`, `npm run build`. Start `node dist/src/cli.js --cwd <existing-project-folder>`. Keep the installation checkout on `main`. Provider calls can spend configured account credits; deterministic automated tests use a local mock provider.
+
+## How to use
+
+1. From a CLI conversation, enter `/browser`. It prints a loopback URL containing a fragment token and opens the default browser. The CLI remains usable; the application server belongs to that CLI process.
+2. Select a project/session in the sidebar. Existing saved CLI sessions appear automatically; another open CLI contributes a live session without requiring `/browser` there.
+3. Enter a task and choose Send. During a run the same composer steers the agent; Cancel aborts the run. Inspect partial workspace changes after cancellation.
+4. Answer a runtime question in its card. Select Approve or Deny for gated operations. A terminal and browser question refer to the same pending question; answering in either surface closes it.
+5. Choose New session, enter the absolute path to an existing folder, then create it. Start its first task from the composer. This session runs in the server process with that folder's saved permissions.
+6. Open Settings. Set maximum days since last activity: 0 displays all retained history; the default is 30. Active sessions remain visible. Filtering never deletes records. Switch light, dark or system appearance; appearance persists in the local application settings across server restarts.
+7. Reload to reconnect to the same session and application state. Exit the owner CLI to stop its server and cancel browser-owned runs. Relaunch `/browser` to view retained records.
+
+`node tests/browser-cli-smoke.mjs` runs an isolated Windows PTY launch smoke with a local mock provider. It suppresses only the OS browser opener, waits for the real CLI conversation prompt, executes `/browser`, verifies the authenticated API, executes `/status`, and verifies exit cleanup.
+
+For isolated QA set `ANDORRACODE_HOME=<temporary-test-directory>`, configure test provider there, and use a temporary project. Stop the CLI before removing the test directory. Never remove real session history for cleanup.
+
+## Test cases and expected results
+
+| ID | Preconditions and steps | Observable expected results |
+| --- | --- | --- |
+| B01 | Start CLI in folder A, enter `/browser`, issue `/status` in terminal. | Browser opens with A in sidebar; CLI continues accepting commands. URLs use 127.0.0.1 and an ephemeral port. |
+| B02 | Open another CLI in B. Send tasks from both surfaces concurrently. | A and B appear independently; selected session transcript and activity are scoped to that session. Usage and run status do not cross folders. |
+| B03 | Select idle live CLI session, send a browser prompt. | Terminal accepts it as a conversation prompt and runs existing graph; progress and final summary update in browser. No second run starts while active. |
+| B04 | Start a long task, send new direction while active; cancel. | Direction enters graph's steering queue; Cancel aborts lifetime signal. Final state is cancelled, with partial-work caveat and retained prompt/outcome. |
+| B05 | Trigger ask_user with choices and custom response. Answer from browser and terminal in separate attempts. | Choice IDs match runtime choices. Custom response progresses to free text. Only current pending question ID can be answered; replay/stale responses reject. |
+| B06 | Use Ask for approval permissions; request a workspace write. Deny then approve in separate runs. Repeat Read Only and Full Access. | Denial prevents operation; explicit approval reaches existing policy. Read Only remains enforced and Full Access follows existing saved policy. Browser creates no implicit elevated grant. |
+| B07 | New session with existing folder; also submit missing folder/file/empty path. | Existing folder creates unique session ID; invalid inputs produce actionable errors and do not create records. |
+| B08 | Complete at least 8 turns, reload, restart server. | All newly archived task/outcome turns remain, latest six context turns feed the model while respecting resets and compaction. Recent activity persists within its 200-event/256 KiB window; unfinished ownerless run shows disconnected instead of running. Older records retain only history originally saved. |
+| B09 | Set days to 1, 0, -1, non-integer, and >36500 with old and active records. | 1 hides old idle records, 0 restores them, active records remain; invalid settings reject. Restart retains valid setting. |
+| B10 | Switch light/dark/system, reload; narrow window and keyboard navigation. | Theme persists and controls remain readable; sidebar/progress adapt, fields and actions have accessible names. Drafts survive state polling. |
+| B11 | Call API without bearer, wrong bearer, foreign Origin/Host, oversized JSON, and stale question ID. | Requests reject, no run starts, session state unchanged. Assets use CSP and no external scripts. |
+| B12 | Emit tool arguments containing configured credentials, browser private inputs and private reasoning metadata. | Event storage/API sanitization uses existing trajectory sanitizer; private reasoning deltas are omitted. Credentials never appear in provider bootstrap (none is exposed). |
+| B13 | Close one CLI while another and GUI sessions run. | Owner's endpoint disappears; other process-owned sessions remain. Owner server cancellation handles its own runs. |
+| B14 | Run a CLI task and observe its Windows Terminal tab title; pause/resume and finish. | Working title animates braille dots beside the existing shell icon; waiting state flashes INPUT NEEDED once per second; completion restores the idle session label. The shell profile icon remains OS-managed. |
+| B15 | Complete turns, use `/clear`, then exit and resume. Repeat with provider/model/graph changes and `/compact`. | Display history retains prior turns; resumed model context respects each reset or compacted summary and never restores raw archived turns over it. |
+| B16 | Ask a normal clarification beginning with "Approve" with two choices and a custom answer. | Browser renders clarification choices, accepts their IDs, and supports custom text; only actual approval requests show Approve/Deny. |
+| B17 | Keep `/browser` open; rotate a fixture provider key or its environment value, then emit that fixture value in a pending question and completion. Inspect authenticated state and saved browser history. | New and prior credentials remain redacted. Use synthetic keys only; never expose real credentials during QA. |
+| B18 | Type distinct unsent drafts in old session A and current session B. Select A and tighten maximum age until A disappears; restore age 0 and return to A. | Automatic selection restores B's draft (or an empty composer), never A's text; A's draft is retained for returning to A. Repeat with all sessions filtered out. |
+| B19 | At 601px, 750px and 900px width, use Progress twice while a run has todos. | First click reveals readable progress, second hides it; conversation and composer remain usable. |
+| B20 | In New session, submit a missing path and a file path, then correct to an existing folder. | Error appears inside the still-open dialog and is accessible; correction creates the session and clears obsolete errors. |
+| B21 | Finish a run that emits todos, then start a run that emits none or fails preflight. | New run shows no previous run's todos while active or after failure; recent historical events remain within the activity window. |
+| B22 | Open `/permissions` or `/providers` in the CLI, then submit browser steering. Return to the conversation prompt. | Steering rejects with an actionable error; rejected text never enters a later task. Normal graph-run steering remains available. |
+| B23 | Create a browser session, submit `Repair browser session naming`, finish and restart the server. | The sidebar receives a locally generated task name on the first prompt and retains it after restart. |
+| B24 | Interrupt a browser-owned run by terminating its process, restart, inspect history and continue the session. | The original prompt appears as an interrupted turn with a partial-work warning, and remains in retained history and resumable context after continuation. |
+| B25 | With an isolated configuration directory, create a file named `browser-live`, then attempt bridge startup. | Startup rejects its descriptor setup and exits without leaving a loopback listener. Remove only the fixture file afterward. |
+| B26 | Emit a burst of 120 tool events, inspect live state, then cancel and close the app. | Live state retains all events, archive checkpoints are coalesced rather than rewritten per event, and shutdown flushes all 120 events. |
+
+## Edge cases and potential bugs
+
+- A CLI command screen owns terminal input. GUI prompt submission rejects until the user returns to the CLI conversation prompt; it never answers a provider/settings modal accidentally.
+- Repeated submission while running rejects. Steering applies at model/tool turn boundaries, not instantaneous interruption of a tool already running.
+- Offline descriptors are ignored; persisted unfinished runs display disconnected. Relaunching a historical session starts a fresh run using current configured defaults.
+- Existing six-turn saved CLI records cannot reconstruct earlier conversations retroactively. New transcripts archive every turn; full raw provider conversation is not used as model resume context.
+- The browser is authorized with a local capability token. Keep the printed URL private; local files use existing configuration-directory access boundaries. Cross-origin requests and hostname rebinding are rejected.
+- Folder input refers to the server host filesystem; there is no remote upload or OS folder picker.
+- Long conversations/events increase local JSON record size. No automatic history deletion is performed.
+- Event snapshots are checkpointed at most once per second during activity and flushed on completion or orderly shutdown. An abrupt process kill can leave the latest checkpoint interval absent from browser event snapshots; browser-owned runtime events still have their append-only trajectory records. The submitted prompt is persisted before execution and recovered as interrupted history.
+- Browser-owned runs use saved per-workspace permissions and configured defaults. Model/provider/graph/permissions editing remains through CLI controls.
+- CLI exit intentionally stops its browser application. Closing a browser tab leaves its server and runs alive until CLI exit.
+
+## Gaps and limitations
+
+Rich Markdown rendering, native OS folder pickers, remote access, and browser management of providers/graphs/accounts are outside this change. Older records have only their existing summary history; raw conversation recovery is unsupported. Automated fixture checks do not establish real cloud-provider reliability. Shared QA process/PTY managers retain existing scope, so concurrent same-folder runtime resources require further stress coverage. Windows is the development platform; macOS/Linux default-browser launch paths require platform QA.
+
+## Validation evidence
+
+Validated on Windows with Node v24.16.0, locked dependencies from `npm ci`, and the dedicated `feat/browser-workspace` worktree.
+
+- `npm run check`: passed. Final `npm run build`: passed, including adapted-engine verification, TypeScript compilation and bundled browser assets.
+- `node --check src/browser-ui/app.js` and `node --check tests/browser-cli-smoke.mjs`: passed.
+- Focused sequential Node test set: **48/48 passed** across browser server/registry, browser runtime, terminal browser input, sessions, commands and trajectory tests. This includes ten API tests, three real-runtime local HTTP provider tests and three terminal integration tests. Coverage includes cross-app ownership/control, approval/question handling, parallel questions, steer/cancel, eight-turn retention, theme/filter persistence, origin/auth rejection and snapshot redaction.
+- `node tests/browser-cli-smoke.mjs`: exited 0. Actual CLI `/browser` launch, authenticated loopback API, `/status` while the browser server runs, and `/exit` cleanup all passed. The fixture suppresses only the OS default-browser opener and uses a local mock provider.
+- Manual browser checks against the real local app with a deterministic injected runner: project/session selection, session creation, prompt submission, runtime questions, steer/cancel, denial, maximum-age 0, light/dark settings and reload. Final conversation order was user prompt ? matching tool activity ? final response once; progress showed 2/2 completed todos. Theme survived refresh, and API restart tests confirmed settings persistence.
+- A separate broader terminal UI regression run reported two existing prompt-click/resize failures. Both reproduced using original `origin/main` terminal-ui source and its original tests transpiled as separate baseline modules, with unchanged feature dependencies. This is a baseline module comparison, not a full untouched-worktree suite. These unrelated defects remain outside this change.
+- Real cloud-provider calls, macOS/Linux browser launch, Windows native shell-profile icon configuration and extended same-folder concurrency stress were not validated. Proposed QA cases above identify further manual coverage; they are not claims that every case was manually executed.
+
+### PR #102 review remediation
+
+- `npm run check`, `npm run build`, JavaScript syntax and whitespace checks passed. The focused browser API/bridge tests passed 14/14, browser runtime tests 3/3, browser terminal tests 3/3 and session-storage tests 4/4; command-screen and trajectory regressions also passed. Runtime checks use local providers and temporary configuration directories.
+- Added regression coverage for rotated credential redaction, fresh-run todo clearing, retained events, imported empty context followed by eight browser turns, explicit clarification/approval kinds, and persisted empty resume context.
+- Headless Edge checks against source assets and in-memory API fixtures passed draft isolation (including zero visible sessions), creation errors and recovery, progress toggles at 601/750/900px, and open-panel resize from 750px to 550px. These validate UI behavior with mocked API responses, not cloud-provider integration.
+- Actual CLI `/browser` smoke passed launch, authenticated loopback API, continued `/status`, and exit cleanup. The default OS browser opener was suppressed by the isolated fixture.
+- An untouched source export of `origin/main` at `951c9aca1294aadc7584b73f386ff7fc22465337` built successfully using identical locked dependencies and isolated configuration. Its terminal/session tests had 123 passes and three failures: the original PTY approval fixture, prompt disclosure capture, and resized prompt disclosure. The two disclosure failures also reproduce on the feature branch and remain outside this PR. Two additional feature slash-completion failures were corrected by retaining `/model` as the default; both targeted regressions passed afterward.
+- A browser-runtime attempt overlapped a build's generated-directory replacement and failed to import a module; the post-build rerun passed all three tests.
+- Real PTY session tests passed 2/2, including compact/save/restart/resume, clear/save/restart/resume, retained display archive, model-request context assertions, and SIGTERM persistence. The fixture now explicitly requests a gated read-only write, waits for idle before exit, and allows 120 seconds for three CLI launches while retaining bounded per-state waits. Nonfatal node-pty teardown messages occurred for already exited children.
+
+### Follow-up review remediation
+
+- `npm run build` and `npm run check` passed on Windows / Node v24.16.0. Build output was checked to include the final server, bridge and CLI fixes.
+- Focused sequential checks passed 27/29: browser API/bridge 17/17, bridge cleanup/checkpoint regressions 2/2, browser-terminal controls 3/3, session storage/title 4/4, and real runtime approval/steering 1/3. The two other runtime cases hit their 30-second child-process limits with empty stdout/stderr; no assertion failure was observed in those children.
+- New regressions cover first-prompt names across restart, interrupted prompt recovery into display history and explicit resumable context, bounded writes for a 120-event burst, complete event flushing on close, and process exit after descriptor setup failure.
+- The CLI smoke's default 25-second initial-prompt wait timed out with empty PTY output, including the unchanged prior-commit harness. A temporary diagnostic copy allowing 90 seconds for startup passed real `/browser` launch, authenticated API, command-screen steering rejection, continued `/status`, and exit cleanup. The committed timeout was not changed; this diagnostic establishes behavior with extra startup time, not the original timing bound.
+- The two runtime cases timed out again in an isolated standard retry. Both then passed in a temporary compiled diagnostic copy allowing 90 seconds per child and 240 seconds per case (observed case durations: denial/cancellation 6.9 seconds, clarification 15.6 seconds). No production code or committed test deadlines were altered for those runs. Thus all focused behaviors passed, while the default-deadline suite did not pass reliably on this host.
+- Untouched-main source export at `951c9aca1294aadc7584b73f386ff7fc22465337` matched current main CLI/runtime/config/graph sources after line-ending normalization. Import-only main probes passed in 21.4 and 27.0 seconds; feature runtime import timed out once at 35.6 seconds and passed sequentially in 7.1 seconds. These measurements show startup variability; they do not establish a baseline failure or a PR-caused regression.
+
+### Durable acceptance and ownership follow-up
+
+- B27: Submit a browser task to a fresh CLI session and to a browser-owned session. Immediately after HTTP 200, inspect `sessions/<id>.json` and `browser-history/<id>.json` in the isolated home: the session must be discoverable and its prompt (or completed turn) must already exist. Kill the owner after acknowledgement and restart; the task must remain recoverable. A failed persistence promise must return an error, never HTTP 200. The CLI composer rejects slash commands (use the terminal) and missing-provider submissions before consuming terminal input.
+- B28: Leave a CLI process alive while its authenticated `/state` request exceeds discovery's 1.5-second timeout. Submit to its saved session through another app. Expect an actionable owner-unavailable error and no fallback run. Retry after the CLI reconnects; after it exits, normal historical recovery is allowed. Current session identity is checked rather than cached across CLI session switches.
+- B29: Render interleaved tool started/completed events with the same run/node/tool-call ID but different invocation IDs. Expect separate disclosure cards with each call's own arguments/output. Expanding one card and polling must preserve only that card's expanded state.
+- Conservative ownership limitation: an unavailable bridge with a live process ID blocks acquiring new browser ownership even if it might belong to an unrelated session. Retry after that CLI reconnects or exits. Existing owned sessions remain controllable. PID reuse can likewise require waiting for the unrelated process to exit; no automatic live-owner takeover is attempted.
+- Validation on Windows / Node v24.16.0: type-check and build passed; focused sequential API/bridge/ownership/terminal/session checks passed **31/31**. The new API checks verify saved prompts immediately after success on direct and bridge routes, awaiting acceptance, and persistence rejection. Ownership checks cover a stalled live endpoint, changing session identity, orderly close, and an exited child process. An ephemeral DOM harness exercised the actual conversation renderer with colliding call IDs and independent expansion state; JavaScript syntax checks passed. Abrupt-kill recovery remains a proposed B27 manual step, not a newly executed crash test.
+- Final real Windows PTY CLI smoke passed with its original 25-second waits: `/browser`, command-screen steering rejection, `/status`, browser task submission, immediate on-disk prompt/completion and fresh-session registration checks, return to conversation input, and clean exit. Only the OS browser opener was suppressed; the fixture used a local provider. Final build also passed after CLI preflight validation changes.
+- The final PTY smoke also passed an actual isolated filesystem failure: replacing the fixture session directory with a file makes prompt submission return HTTP 400, restores the conversation prompt, and leaves the CLI idle after storage is restored. Failed acceptance remains rejected until the terminal consumes it; it cannot be silently converted to a later successful run.
+
+### Cancellation and failed-creation review follow-up
+
+- B30: In an isolated CLI fixture, delay session acceptance storage, submit a browser prompt, cancel while the write is pending, then release storage. Expect return to the conversation prompt, idle browser state with no pending prompt, a single cancelled turn in both saved histories, and successful acceptance of the next prompt. `node tests/browser-cli-smoke.mjs` controls this delay deterministically through its fixture wrapper.
+- B31: Save the CLI's synthetic interrupted turn in primary display/context history and the same pending prompt in its browser archive, then reopen the app and continue. Expect exactly one pending attempt in each history before continuation, including after repeated polling. An earlier completed task with identical text remains a distinct turn.
+- B32: In an isolated home, replace the absent `sessions` directory with a file and attempt New session twice. Each attempt must return an error and leave no live descriptor, ownership lease, or partial browser archive. Remove the fixture file, refresh, and retry: no failed sessions appear and exactly one successful session is created.
+- Validation: Windows / Node v24.16.0; `npm run build` passed (including TypeScript compilation). Focused browser API, ownership and session-storage checks passed **28/28**, including B31 and B32 regressions. The real Windows PTY smoke passed B30, accepted the next task, verified persistence-failure recovery, and exited cleanly. The fixture suppresses the OS browser opener and delays storage only for the cancellation case; it uses a local provider. `git diff --check` passed. No real cloud-provider or non-Windows validation was performed for this follow-up.
+- Additional bridge lifecycle and browser-terminal regressions passed **5/5**, bringing focused follow-up coverage to **33/33**.
+
+
+### Slow acknowledgement and shutdown review follow-up
+
+- B33: Delay a live CLI bridge's durable prompt acceptance for more than five seconds, then release it. The browser request must remain pending and return success only after acceptance; exactly one task starts. Storage rejection must still return an error. No forwarding deadline should invite a retry while the owner continues accepting the task.
+- B34: Open Settings and simulate an unwritable settings file, then a disconnected server. Save must show an accessible error inside the open dialog and preserve the inputs. Restore service and retry: success closes the dialog; reopening clears the old error.
+- B35: In an isolated home, replace a live bridge descriptor with a directory before closing the bridge. Closing must report the removal failure but terminate its loopback listener and allow the process to exit. Only remove the fixture directory afterward.
+- B36: Pause a new-session ownership lock acquisition, begin application shutdown, and release the lock. Shutdown waits for acquisition cleanup, leaves no descriptor or ownership lease, and refuses new requests. Requests that reach ownership after shutdown begins must not create listeners.
+- UI validation: headless Edge with source assets and mocked API responses passed B34 storage/network failure, successful retry, and reopen checks. This verifies dialog behavior, not live filesystem or cloud-provider reliability.
+- Automated validation: Windows / Node v24.16.0; `npm run check`, `npm run build`, `node --check src/browser-ui/app.js`, and `git diff --check` passed. Sequential compiled browser server/lifecycle/bridge/ownership/terminal/session tests passed **36/36**, including B33, B35 and B36. No real cloud-provider or non-Windows checks were run for this follow-up.
+
+### Persistence, identity and cleanup review follow-up
+
+- B37: In the isolated CLI smoke, make primary session storage fail while browser history remains writable. Submit a prompt. Expect HTTP 400 only after both writes settle and the browser archive is idle with no rejected prompt or turn. Restore storage and verify the CLI remains usable. Run `node tests/browser-cli-smoke.mjs`.
+- B38: Run `node tests/browser-cli-smoke.mjs --close-failure`. The fixture replaces a browser-owned descriptor with a nonempty directory before `/exit`. Expect a reported cleanup error and exit code 1, both application and CLI listeners closed, and the original CLI descriptor removed. The fixture removes its blocked descriptor afterward.
+- B39: Inject one final session-save failure after a successful browser-owned run. Expect a retry of the existing result, succeeded status and exactly one display/context turn on disk. With persistent final-save failure, preserve the actual result and expose a separate finalization diagnostic; never append an initialization-failure turn.
+- B40: Discover a CLI session, switch its identity, then send prompt, steer, cancel and answer requests using the old identity. Each must return 409 without invoking an action. Requests missing an expected identity also reject; the current identity succeeds. Application forwarding supplies the selected session ID, overriding any caller-provided ID.
+- B41: Split UTF-8 JSON prompts and answers at each byte boundary. Expect exact Unicode preservation. Requests exceeding 1 MiB of raw bytes reject.
+- B42: Discover descriptors for exited, alive-unavailable and permission-inaccessible processes. Only a confirmed exited process (`ESRCH`) permits descriptor removal; live/unknown processes remain protected from ownership takeover.
+- B43: Complete browser-owned runs using a configured provider/model, continue and restart the app. Run details and persisted records must contain the provider/model returned by the actual run.
+- Validation uses isolated temporary homes, deterministic local runners/providers, and Windows PTYs. No user configuration is changed. Real cloud-provider and non-Windows behavior remain untested in this follow-up.
+- Validation on Windows / Node v24.16.0: `npm run check`, final `npm run build`, smoke JavaScript syntax and `git diff --check` passed. The sequential focused set passed 41/41; after the final ownership test was added and rebuilt, ownership tests passed 4/4 (42 distinct passing tests overall). Both normal and `--close-failure` real CLI smoke modes passed with their original deadlines, covering B37 and B38. No new baseline failures were observed in these checks.
+
+### Cancellation and primary-session projection follow-up
+
+- B44: Open `/permissions` in the isolated CLI smoke, call the browser cancel endpoint, then leave the screen using Escape. Expect HTTP 400 with `No task is accepting cancellation`; the command screen remains usable. Repeat B30 to confirm accepted task startup still permits cancellation before graph setup. Run `node tests/browser-cli-smoke.mjs`.
+- B45: Finish browser activity and inspect `sessions/<id>.json`. It contains only SavedSession fields (identity, parent, workspace, timestamps, display/context history and usage); events, todos, prompt, status and provider/model metadata belong to `browser-history`. Reopen a fork with stale browser fields in its primary record and newer fork events/todos in its archive: the fork's archive wins, while parentId and reset context remain intact.
+- B46: Hold the prompt POST response pending while polling reports running. Stop run remains enabled and sends a cancellation request. Repeated clicks for that session send only one pending cancellation; switching to another running session permits its cancellation. A failed cancellation displays its error and allows retry. Send and New session remain disabled until the original prompt request settles, even after cancellation succeeds or fails.
+- Validation: Windows real CLI PTY smoke passed B44 and preflight cancellation with a local fixture provider. Headless Edge with source assets and mocked APIs passed B46, including duplicate suppression, cross-session cancellation, failure retry, and independent busy-state ownership. These checks use isolated temporary homes and do not modify user configuration; real cloud providers and non-Windows behavior remain untested.
+- Final `npm run build` passed. The sequential browser server/lifecycle/bridge/ownership/runtime/terminal and session-storage suite passed **46/46**, including B45 and transient/persistent final-save failures. Save-failure fixtures now identify completed turns by run ID because primary records intentionally omit browser status. JavaScript syntax and `git diff --check` passed.
+
+### Crash recovery and runtime-answer review follow-up
+
+- B47: In an isolated home, interrupt a browser-owned save after its archive replacement but before primary replacement. Restart with the previous primary record, including a matching timestamp. The latest archive transcript, bounded context, usage and completion must survive. A later independent primary reset or compaction must remain authoritative instead of restoring archived model context.
+- B48: Fail the initial browser-owned prompt save after its archive write. The rejected response must wait for rollback; name, history, context, usage, status and prior archive are restored with no rejected turn. Retry immediately after storage recovers: exactly one run executes and exactly one turn is retained. Persistent rollback failure must not permit execution or a false acceptance.
+- B49: Create a browser session and complete more than six prompts. All turns remain in display history while persisted model context contains only the latest six. Restart and continue, retaining that separation. Legacy sessions without explicit context must acquire bounded context when continued; explicit empty reset context remains empty until a new accepted run.
+- B50: Open a CLI configuration command screen and inspect authenticated browser state. Its question must be absent, and a forged or stale answer request must reject without advancing the screen. Return to a graph run and answer a runtime question through the browser; the current question resolves and stale answers reject.
+- These cases use isolated temporary configuration and local provider fixtures. Real cloud-provider behavior and non-Windows execution remain unverified.
+- Validation on Windows / Node v24.16.0: type-check, build, smoke syntax and whitespace checks passed. The sequential focused browser server/lifecycle/bridge/ownership/runner/terminal/session suite passed **50/50**. After adding the pending-archive reset guard, the final build and all **30/30** server checks passed (51 distinct focused checks overall). Both normal and `--close-failure` real CLI PTY smoke modes passed, including a real provider-wizard question rejection, live graph approval denial from the browser and stale-answer rejection. Fixtures use temporary homes and local providers; no user configuration was changed.
+- Recovery tests simulate an interrupted two-file commit by allowing archive replacement and rejecting both primary-save attempts, then restarting and continuing. They do not simulate OS power loss. If the filesystem refuses both snapshot restoration and archive removal, the app reports uncertain persistence and blocks further prompts in that process; repair storage and inspect saved history before reopening. Legacy CLI bridge archives retain their existing recovery behavior.
+
+### Rejected settings, first-prompt identity and visible notices follow-up
+
+- B51: In an isolated home, save age 0 and light theme with an old retained session. Replace `browser-settings.json` with a directory and submit age 1/dark. Expect HTTP 400; polling retains age 0/light and the old session remains visible. Remove the fixture directory and retry: success applies and persists age 1/dark, hides the old session, and leaves its stored history intact.
+- B52: Before the first CLI task, independently block `sessions` and `browser-history` storage in the isolated PTY smoke. Each browser prompt rejects, the live session retains its original unnamed identity and empty history, and a successful sibling primary write leaves no rejected named record. Restore storage and submit a differently named task; the accepted task determines the name in both stores. Run `node tests/browser-cli-smoke.mjs` and its `--close-failure` mode.
+- B53: Supply `browser.notice` events for paid-graph fallback, extension diagnostics and finalization failure. During a run, each message appears as an activity note. After completion/reload, open the retained activity and verify the same messages. Include HTML-like text and verify it renders literally without creating executable elements.
+- UI evidence: headless Edge with source assets and fixture API responses reproduced missing notices before the fix, then passed B53 for running and completed/reloaded activity, including inert HTML text. This does not verify live paid-graph service availability.
+- Automated and PTY validation results are recorded below after execution. Fixtures use temporary homes and local providers; real cloud providers and non-Windows execution remain unverified.
+- Validation on Windows / Node v24.16.0: `npm run check`, `npm run build`, JavaScript syntax checks and `git diff --check` passed. `node --test --test-concurrency=1` over compiled `browser-*.test.js` plus `sessions.test.js` passed **112/112**, including B51. Both normal and `--close-failure` real Windows PTY smoke modes passed B52 and existing runtime-control/cleanup checks. No baseline failures were observed.
+
+### Reused tool IDs and uncooperative shutdown follow-up
+
+- B54: Use a local provider fixture that reuses the same tool-call ID in multiple model responses of a single node invocation. Inspect runtime events and browser activity: each response has a distinct monotonic `modelTurn`, started/completed events pair within that response, and each card retains its own arguments, output, and expansion state across polling. Include a preparation-only response that does not consume the normal iteration budget.
+- B55: Start a browser-owned fixture runner that ignores cancellation and remains pending. Close the app. After the two-second drain allowance, the application and bridge listeners close and descriptors/ownership leases are released. Restart: the accepted task remains recoverable as interrupted history. Continue under the new owner, then settle the old runner and emit a late event: neither may overwrite the new owner's archive. A cooperative cancelled runner still persists its final history and full event burst before shutdown.
+- Fixtures use isolated temporary homes and local runners/providers; real cloud providers and non-Windows execution remain unverified. Shutdown fences browser event/history writes after detachment; it cannot forcibly terminate arbitrary in-process provider/tool code that ignores abort.
+- Validation on Windows / Node v24.16.0: type-check, final build, JavaScript syntax and whitespace checks passed. Sequential compiled `browser-*.test.js` plus `sessions.test.js` passed **114/114**, including real runtime repeated-ID events and the shipped renderer in a minimal DOM, bounded shutdown, interrupted recovery, and suppression of late writes after a new owner continues. The renderer regression is a DOM harness, not a visual browser check; preparation-only response coverage remains a proposed B54 QA step. No baseline failures were observed.
+- Conflict resolution: merged `origin/main` at `1da4e18`, preserving both the model-turn counter and main's response-state resets. The merged build passed, and the sequential browser/session suite plus `hardened-runtime`, `zcode-engine`, and `zcode-validation` tests passed **168/168**. No baseline comparison was needed because no failures occurred.
+
+### Ownership, shutdown storage, concurrent answers and CLI recovery follow-up
+
+- B56: In an isolated historical session, compromise the acquired ownership lease before the acceptance checkpoint and again while a checkpoint is queued. Expect HTTP 400, no runner invocation and no successful acknowledgement. A successor owner's snapshots must remain intact; the old owner must not roll back over them.
+- B57: Hold a browser checkpoint in storage while its runner ignores abort, then close the app. After the two-second runner drain and two-second storage flush allowances, listeners close and queued or not-yet-submitted replacements are fenced. If no replacement has been submitted, descriptors and ownership leases are released: continue under another owner, then release the old storage operation and verify the successor snapshots stay intact. If a rename was already submitted, ownership remains protected until it settles; takeover must reject during that interval. An already issued operating-system filesystem operation cannot be forcibly cancelled.
+- B58: Hold session A's prompt acknowledgement pending. In session B, answer a runtime question using a choice or free text; in C, approve or deny an approval. Each answer must carry its current question ID while A remains busy. Disable controls only for that session's in-flight answer, suppress duplicates, retain guards across selection changes, and show failed-answer errors with retry enabled and typed text retained. Cancel stays usable; Send and New session stay disabled until A's original request settles.
+- B59: Exercise CLI archive/primary partial writes in an isolated home. A newer primary completion must not gain a duplicate interrupted turn from an old running archive; a completed archive with a failed primary commit must retain its transcript and resumable context. A later independent primary reset remains authoritative. Interleaved event checkpoints must serialize with the paired commit. Failure of archive storage must still allow ordinary CLI primary history to be saved while reporting the archive failure; browser prompt acceptance must reject and roll back on either storage failure.
+- Fixtures use temporary homes and deterministic local runners/providers. DOM-handler regressions exercise shipped UI functions; they are not manual visual browser tests. Partial writes are simulated failures, not OS power-loss tests. Real cloud providers and non-Windows behavior remain unverified.
+- Validation on Windows / Node v24.16.0: `npm run check`, `npm run build`, final `npx tsc`, JavaScript syntax and whitespace checks passed. The sequential compiled `browser-*.test.js` plus `sessions.test.js` suite passed **124/124**, including all ten new regressions for B56-B59. Both normal and `--close-failure` real Windows PTY CLI smoke modes passed with their original deadlines, including rejected-prompt rollback against independently blocked primary and archive storage. No baseline failures were observed; no untouched-main comparison was needed.
+
+### Completed-state retry, private browser inputs and reconnect follow-up
+
+- B60: In an isolated home, accept and complete a browser-owned run while both immediate final snapshot writes fail. Restore storage before orderly close, then restart. The actual completion, usage, provider/model and succeeded status must survive exactly once, with no interrupted replacement turn. Persistent or stalled storage must still respect bounded shutdown and ownership fences.
+- B61: Use a local provider fixture that emits a `qa.browser_session` fill containing a unique private marker, then echoes it in later tool arguments, an approval prompt and final summary. Live event payloads, pending question/approval labels, completion data and stored browser history must redact the marker while actual tool inputs retain it. Repeat with trajectory storage unavailable: learning private inputs must continue even when the trajectory cannot be written.
+- B62: Fail a state poll, then allow polling to succeed. The connection label returns to Connected locally and the polling error disappears. Repeat with an action failure before or during the outage: reconnect must preserve that action error. Check repeated failed polls and recovery without submitting another action.
+- Fixtures use temporary homes and local providers. DOM regressions exercise shipped handlers rather than a manual visual browser session. Real cloud-provider behavior and non-Windows execution remain unverified. Storage failures are simulated, not OS power-loss tests.
+- Validation on Windows / Node v24.16.0: build, type-check, final TypeScript compilation, JavaScript syntax and whitespace checks passed. Sequential compiled browser/session tests passed **129/129**; runner/trajectory tests passed **32/32**, including private-fill redaction and storage-unavailable learning. Both normal and `--close-failure` real Windows PTY CLI smoke modes passed. No baseline failures were observed; no untouched-main comparison was needed. B60 and B62 have automated regression coverage; B61 validates emitted runner events/approvals/results and trajectory failure handling, while a manual live browser inspection of persisted history remains pending.
+
+
+### In-flight replacement ownership, bridge shutdown and bounded activity follow-up
+
+- B63: In an isolated browser-owned session, separately stall archive and primary `rename` after submission. Close the app past both drain allowances. Its HTTP listeners close, but ownership stays protected and another application must reject takeover. Release the rename, wait for ownership cleanup, then continue under the successor. Its later archive and primary snapshots must remain intact. Repeat with a write stalled before rename: ownership may release after fencing, and resuming the old write must not replace successor history.
+- B64: In an isolated CLI bridge, separately stall archive temporary-file storage and the primary persistence callback. Close the bridge. Within the two-second drain allowance plus scheduling tolerance, its listener closes. Release the delayed operation after a successor saves newer snapshots; the old operation must reject or remain fenced without changing those snapshots. Separately stall an already-submitted archive/primary rename: close the listener within the allowance while retaining its discovery protection until the rename settles. Repeated close calls must share cleanup, and descriptor removal errors must still close listeners.
+- B65: Use a local browser runner that ignores abort until explicitly released. Cancel through both direct application and forwarded bridge routes. Poll repeatedly: status stays cancelling, the pending question disappears, and further steering/cancel requests reject. Stop and steering controls remain disabled. Release the runner and verify its terminal state replaces cancelling. Restart with a saved cancelling snapshot and verify interrupted recovery.
+- B66: Emit more than 200 runtime events and a burst of large tool outputs in a single session. API state, CLI bridge state and stored browser activity contain at most 200 events and at most 256 KiB of event JSON, favoring the newest events. Continue several conversation turns and restart: complete task/outcome history remains intact. Hydrate an older oversized archive and verify the same bounded public activity. Check that event eviction does not erase current todos or pending questions.
+- Fixtures use temporary homes and local runners/providers. Storage faults are deterministic delayed operations, not OS power-loss tests. Real cloud-provider behavior, non-Windows execution and manual visual checks remain unverified in this follow-up.
+- Validation on Windows / Node v24.16.0: `npm run check`, final `npm run build`, JavaScript syntax and whitespace checks passed. The isolated launcher (`node scripts/run-tests.mjs --test-concurrency=1 --test-timeout=30000`) passed **95/95** browser/session tests excluding the unchanged browser-tool file; that file passed **43/43** separately with `--test-timeout=20000` (**138 total**). All nine new regressions passed. Both normal and `--close-failure` real Windows PTY CLI smoke modes passed. The first build publication hit transient Windows EPERM and passed on retry; an initial broad test run was interrupted after a slow process exit, while the isolated reruns exited successfully. Untouched `origin/main` at `1da4e184` also built and passed the identical 43-test browser-tool file; no baseline failure is claimed. B63/B64 and the activity/cancellation API cases have automated coverage; manual UI cancellation, restart with a cancelling snapshot and older oversized archive hydration remain proposed QA steps.
+
+### Ownership acquisition, forwarded requests and approval details follow-up
+
+- B67: In an isolated home, stall ownership acquisition during a new-session or first-prompt request, separately at lock acquisition and bridge descriptor storage. Close the local browser server. Shutdown must pass the bounded acquisition drain and close its listener without waiting indefinitely. Release the stalled operation afterward: it must clean up its bridge/lease, never start a task or acknowledge a newly usable session. No stale acquisition may overwrite a successor's ownership or history.
+- B68: Keep a second CLI bridge alive and stall its prompt acceptance. Submit through the local browser application, then close that application. Its outbound prompt connection must abort and local shutdown must finish; the remote CLI must remain available. Treat the interrupted acknowledgement as an unknown acceptance outcome: do not report a definite prompt rejection, retry automatically, or start a fallback run. Reconnect to the owner and inspect its state before retrying.
+- B69: With Ask for approval permissions, trigger CLI-owned Write, Edit and long shell-command requests. Before selecting Approve, inspect the browser approval card: it must show the full sanitized arguments, including content, patch and command suffixes, as literal text. Use synthetic provider credentials/private browser inputs in fixtures and verify redaction. Deny prevents execution; Approve continues through existing permission checks, and stale question IDs still reject. Exercise both normal runtime and extension-startup approvals. Missing required detail must not enable browser approval.
+- Fixtures use temporary homes and local providers/bridges. Delayed storage tests simulate stalled operations; they are not OS power-loss tests. Real cloud providers, non-Windows behavior and manual visual approval checks remain unverified in this follow-up. A bridge still being initialized cannot expose its close handle until descriptor storage settles; its lease remains protected and its late cleanup closes the bridge. The local application listener closes within the acquisition drain bound.
+- Validation on Windows / Node v24.16.0: `npm run check`, `npm run build`, JavaScript syntax and whitespace checks passed. The isolated sequential browser/session suite passed **100/100** and the separate browser-tool suite passed **43/43** (**143 total**, including all five new regressions). Both normal and `--close-failure` real Windows PTY CLI smoke modes passed, including full Write content, canonical target and permission-warning projection before denial. The first smoke assertion expected only model-supplied arguments; it was corrected to verify the existing permission metadata too. No production or suspected baseline failure was observed, so no untouched-main comparison was needed. B67 covers new-session lock/descriptor stalls and late cleanup; first-prompt variants and successor stress remain proposed QA. B68 and B69 have transport, authenticated bridge/privacy, DOM and runtime PTY coverage; extension-startup visual approval remains proposed QA.
+
+### Rejected CLI archives and incomplete owner descriptors follow-up
+
+- B70: Run `node tests/browser-cli-smoke.mjs --rollback-failure` after building. The isolated real CLI accepts the archive write, fails the primary save, then fails archive replacement during rollback. Rejection must remove the partial archive before responding; subsequent browser and terminal tasks must reject without provider execution even after storage becomes writable. Close and reopen the browser application: the rejected prompt must not appear as interrupted history. Repeat with `--rollback-cleanup-failure`: simulated removal failure must explicitly report the remaining partial archive and block both task entry points. Do not automatically resume that damaged fixture; inspect/repair storage before restarting a real affected CLI.
+- B71: In an isolated configuration home with a saved session, create a UUID-named `browser-live/*.json` descriptor containing partial JSON, null, an array, an empty object, endpoint data without a PID, or a nonpositive, fractional or string PID. Direct ownership checks and authenticated prompt requests must reject takeover, retain the descriptor and saved session bytes, and never execute a fallback task. Removing the fixture descriptor restores the unowned state; existing dead-PID pruning remains covered separately.
+- These are deterministic filesystem faults and local-provider Windows PTY checks, not power-loss or real-provider tests. Manual visual testing and non-Windows behavior remain unverified for this follow-up.
+
+### Rollback deletion, atomic settings and refresh/finalization races
+
+- B72: In an isolated saved session, fail prompt acceptance after publishing its archive and stall rollback removal beyond the two-second close drain. Repeat with the first removal failing and the fallback removal stalled. Close must bound its wait and stop listeners while retaining the descriptor and lease until the submitted deletion settles. Takeover rejects during that interval; after cleanup, successor history survives unchanged.
+- B73: Save light theme and age 0. Inject a partial settings-file write followed by ENOSPC while requesting dark theme and age 1. The request rejects; polling, durable JSON and a restarted application retain light/0. No temporary settings file remains. Restore storage and repeat: the new values persist.
+- B74: Overlap a periodic state poll with an action-triggered refresh and finish the newer request first. The older response must not change the session selection, theme, pending question, run controls or connection error. Repeat with stale failure/new success and stale success/new failure.
+- B75: Complete a browser-owned run while its final archive write is stalled. Authenticated state shows the completed status and exactly one result. Steering and cancellation reject without aborting or changing that result. A new prompt waits for final persistence before acceptance; release storage, complete the continuation and restart to verify both turns remain.
+- Automated regressions use temporary configuration homes, filesystem fault injection and local runners; UI refresh cases execute shipped handlers in a DOM fixture. They do not establish manual visual behavior, OS power-loss durability, real-provider reliability or non-Windows behavior.
+- Validation on Windows / Node v24.16.0: typecheck, build, final TypeScript compilation and whitespace checks passed. Compiled browser/session regressions passed 152/152, including all seven new cases, and the real Windows PTY CLI smoke passed. An initial test run caught a continuation race introduced by exposing completion before final persistence; continuations now wait for that persistence, and the final suite passes. No suspected baseline failure remains, so no untouched-main comparison was needed.
+
+### Archive-only recovery and accepted-prompt refresh follow-up
+
+- B76: In an isolated configuration home, persist a first CLI session's completed browser archive while failing its primary session save. Restart the browser application without a primary record. Authenticated state must retain its display/context history and usage, and a continuation must work through the normal ownership and permission checks. Repeat with an interrupted first attempt: show disconnected recovery and the interrupted turn exactly once. Ignore malformed archives, non-UUID filenames and mismatched IDs; an existing primary, including an invalid or unreadable one, must not be treated as absent.
+- B77: Submit a prompt successfully, then fail the following state GET. The composer must clear the accepted draft, disable empty Send and show the connection error. A later successful poll clears that error without submitting another prompt. Repeat for steering and while switching sessions: only the accepted session's draft clears. A rejected prompt POST must retain its draft for retry. These cases exercise the shipped action, refresh and composer handlers; refresh already catches state-fetch failures independently of mutation acceptance.
+- Fixtures use isolated homes, local runners and DOM handlers. Manual visual checks, real cloud providers, OS power-loss behavior and non-Windows execution remain unverified for this follow-up.
+- B78: Send SIGTERM while the CLI awaits its initial task snapshot. Expect exit 143 and exactly one retained attempt: the first snapshot records pending/interrupted work and the final snapshot records cancellation with the same session ID and matching context. Both snapshots have zero usage; no graph health check or provider request runs. Final primary JSON must exactly match the cancelled snapshot.
+- Validation on Windows / Node v24.16.0: typecheck, build (after one transient EPERM publication retry), final TypeScript compilation, JavaScript syntax and whitespace checks passed. The combined run passed 158/158 browser/session-storage cases and one of two CLI cases; the SIGTERM case exposed an obsolete one-save/pending-result assertion. The untouched main baseline at `1da4e184` passed that old assertion, while this PR intentionally finalizes cancellation in a second save. After strengthening the test to verify both exact snapshots and zero execution, the final CLI file passed 2/2: 160 distinct tests passed across the runs. The real Windows PTY browser smoke passed. node-pty printed AttachConsole cleanup diagnostics during the passing CLI tests; no CLI assertion failed on the final run. B76/B77 have automated fixture coverage; manual session-switch UI checks and unreadable-file OS permission fault injection remain proposed QA.
+
+### Live browser launch, failed creation and retained transcript follow-up
+
+- B79: Start a CLI task and enter `/browser` while it is working. The live input handler must receive the command and launch the authenticated browser application; terminal steering and cancellation remain available.
+- B80: In an isolated home, let new-session archive storage succeed, fail its primary save, and fail bridge cleanup. Creation must reject and still remove the partial archive. Repeat with archive deletion stalled while closing the app: retain ownership until deletion settles so a successor cannot have its archive removed by late cleanup. A failed deletion must report the incomplete cleanup rather than acknowledge creation.
+- B81: Complete a turn reporting passed, failed and pending checks in `completion.tests`. All entries appear alongside the summary, remain visible after reload and render HTML-like fixture strings as literal text. Empty test lists add no empty section.
+- B82: Put malformed event entries such as `events: [null]`, malformed todos and malformed pending-question fields in isolated browser archives, both with and without primary records. Authenticated state must ignore damaged archive data while retaining healthy sessions; polling and conversation rendering remain usable. Valid retained activity must still appear.
+- These are local filesystem, terminal and DOM fixture checks. Manual visual testing, real providers, OS power-loss behavior and non-Windows execution remain unverified for this follow-up. Validation results are recorded after execution below.
+- Validation on Windows / Node v24.16.0: final `npm run check`, `npm run build`, JavaScript syntax and whitespace checks passed. The sequential browser/session suite passed **163/163**, and the targeted live browser/permissions command test passed **1/1**. The real Windows PTY CLI smoke passed authenticated launch, terminal coexistence, runtime approval, cancellation and exit cleanup. A syntax error during implementation was corrected before the final checks; no remaining failure required an untouched-main comparison. B79 has live-handler coverage; actual OS browser opening during an active run remains proposed manual QA (the smoke suppresses the OS opener).
+
+### Per-session submission, live-state validation and CLI rollback follow-up
+
+- B83: Stall session A's durable prompt acceptance, switch to running session B and submit steering. B remains enabled and accepts the direction; duplicate submissions for A are blocked. Complete A and B in either order: each retains its own pending lock and clears only its accepted draft.
+- B84: Publish an authenticated local descriptor responding with an incomplete session, null events, null event/todo entries or malformed question choices. Discovery ignores the incompatible response; authenticated application state remains HTTP 200 and includes healthy live sessions. Archived sessions use the same shape validation.
+- B85: Enter `/browser` during an active debug run. The trajectory records `command.started` and `command.completed` with `mode: in-run` and duration. Simulate browser startup failure: it also records `command.error` and reports the failure to the terminal.
+- B86: Fail either archive or primary acceptance for a fresh CLI browser prompt. Both durable records must be absent after rollback; restarting must not reveal a phantom New CLI session. Repair fixture storage and retry successfully. Existing-session rollback retains its prior history.
+- Automated coverage uses shipped DOM and CLI callback bodies, real local HTTP discovery, isolated filesystem faults and temporary homes. Actual OS browser opening, manual visual checks, real providers and non-Windows behavior remain unverified for this follow-up.
+- Validation on Windows / Node v24.16.0: `npm run check`, build, final `npx tsc`, JavaScript syntax and whitespace checks passed. The sequential suite passed 169/170 initially; its only failure used an incomplete live-state fixture now correctly rejected by discovery. After making that fixture a valid session, all 16 affected bridge/live-state/CLI tests passed: 170 distinct cases pass across the runs. The real Windows PTY CLI smoke passed after replacing its obsolete empty-archive expectation with an absence assertion. No suspected baseline defect required an untouched-main comparison. Actual OS browser opening remains suppressed in the smoke.
+
+### Pending submission edits and rollback/ownership cleanup follow-up
+
+- B87: Reject a fresh CLI browser prompt after its primary acceptance write succeeds. Inject a one-time failure removing the archive, then separately the primary. Both removals must be attempted independently and retried; after recovery neither record exists, no prompt runs, and restart cannot discover a phantom session. Persistent cleanup failure must report uncertain persistence and block further prompts instead of acknowledging acceptance.
+- B88: Hold a prompt or steering response pending and edit the same session's composer. Accept the original request: the newer text remains available. Repeat after switching to another session and back, including an intentionally emptied draft. An unchanged accepted draft clears only for its own session; a rejected request retains the current draft.
+- B89: Pause an already-submitted archive or primary replacement, then compromise the session ownership lease. The old owner rejects further work and closes its bridge listener, but retains the live descriptor until the replacement settles. A successor cannot acquire ownership during that interval; after release it can continue without an old write overwriting its state.
+- These cases use isolated filesystem/HTTP fixtures and the shipped desktop UI/callback code. Manual visual checks, real providers and non-Windows behavior remain pending for this follow-up.
+- Validation on Windows / Node v24.16.0: `npm run check`, `npm run build`, JavaScript syntax and whitespace checks passed. Sequential compiled `browser-*.test.js`, `sessions.test.js` and `cli-browser-review.test.js` passed **188/188**, including B87-B89. The real Windows PTY CLI smoke passed authenticated loopback access, CLI coexistence, approval/stale-answer handling, rejected-prompt rollback and exit cleanup. No failures required an untouched-main comparison. UI edit coverage uses the shipped handlers in a DOM harness; the smoke suppresses the OS browser opener.
+
+### Canonical session metadata and rejected acceptance queues
+
+- B90: In a temporary configuration home, use a fixture provider key `test` and create a browser session in an existing `test-project` folder. Public workspace text remains redacted, but both primary and archive JSON must retain the exact workspace and UUID. Restart with additional fixture keys matching part of that UUID and its date. The session must still appear with a valid timestamp, acquire its live bridge, and accept a prompt through its original UUID. Prompt/history content containing `test` must remain redacted on disk. Restart and continue again: the runner must resolve the original existing folder, retain both turns, and execute exactly twice.
+- B91: Pause a browser-owned prompt's primary acceptance save after its archive is published. Cancel through the authenticated API and wait for its one-second checkpoint to enqueue. Fail acceptance, then inspect both durable files: they must exactly match their pre-prompt bytes; no queued archive write may republish the rejected prompt, and no runner may execute. Retry immediately with a different accepted prompt, restart, and verify only the accepted turn is retained.
+- B92: Repeat B91, but close the application while acceptance is pending and wait for shutdown to enqueue its interrupted snapshot after the run drain. Submit directly to the authenticated owner bridge so shutdown's deliberate disconnection of forwarding transports does not hide the rejection. Fail acceptance before the storage-flush deadline; rollback must restore both pre-prompt files before close completes. Reopen, retry successfully and verify the rejected prompt never returns as interrupted history.
+- Automated checks use isolated local configuration homes, real loopback HTTP, mocked storage failures and an injected runner that resolves the actual workspace path. These checks do not verify manual visual behavior, real providers, power-loss durability or non-Windows execution. Remove the temporary fixture home after closing all applications; do not put real credentials in these tests.
+- Focused validation on Windows: `npx tsc` passed. The four focused acceptance/server/lifecycle/shutdown-write files passed 58/59 initially; the sole failure incorrectly used a forwarding request that shutdown intentionally disconnects. After correcting that fixture to address the owner bridge, all three acceptance regressions passed, giving 59 distinct passing cases across the runs. No suspected baseline failure required comparison with main. Broader validation is recorded after execution.
+- Final validation on Windows / Node v24.16.0: `npm run check`, `npm run build`, `npx tsc` and `git diff --check` passed. The sequential compiled browser/session/CLI regression suite passed **191/191**, including B90-B92. The real Windows PTY smoke passed authenticated loopback access, terminal coexistence, approval/stale-answer handling, cancellation, rejected-prompt rollback and exit cleanup. No remaining failure required an untouched-main comparison; manual visual checks, real providers and non-Windows execution remain unverified, and the smoke suppresses the OS browser opener.
+
+### Canonical CLI snapshots and project creation
+
+- B93: In an isolated CLI fixture, register synthetic secrets overlapping the workspace path, session UUID and timestamp. Inspect authenticated bridge discovery and archive JSON: canonical workspace, UUID and timestamp survive; name, prompt and transcript content remain redacted. The application public projection still redacts the workspace display. Existing CLI prompt, steering, cancellation and approval behavior must remain available.
+- B94: Create a session under a fixture path containing the configured synthetic key `test`. Use the project's `+` control: the request sends `projectSessionId`, never the redacted display path, and creates another session in the canonical folder. Repeat after restarting the server and with an unsaved live CLI session. Unknown or malformed project session IDs reject without creating records or falling back to a supplied workspace. The separate New session dialog starts blank; enter an explicit existing folder and verify successful creation.
+- B95: Create an isolated physical project directory and a Windows junction (or directory symlink on other platforms) pointing to it. Submit the alias in New session. Both primary and archive records must store `realpath` of the target; listing CLI sessions from the physical directory must include the created session. Remove only the temporary fixture home after closing all fixture processes.
+- Coverage uses real loopback HTTP, isolated filesystem fixtures, shipped CLI snapshot callbacks and shipped UI handlers in a DOM harness. Manual visual checks, real providers and non-Windows execution remain proposed QA; no real credentials are used. Validation results follow after execution.
+- Final validation on Windows / Node v24.16.0: `npm run check`, `npm run build`, JavaScript syntax and whitespace checks passed. The sequential compiled browser/session/CLI suite passed **197/197**, including B93-B95. The real Windows PTY smoke passed authenticated loopback launch, CLI coexistence, modal control rejection, runtime approval/stale-answer rejection, cancellation, rejected-prompt rollback and exit cleanup. No failures required an untouched-main comparison. The smoke suppresses the OS browser opener; manual visual checks, real providers and non-Windows behavior remain unverified.
+
+### Desktop theme and session actions
+
+The workspace now uses the desktop app's theme, and sessions have a right-click menu (rename, archive, delete, trajectory). Cases, setup and evidence are in [browser-session-actions-test-plan.md](browser-session-actions-test-plan.md). B10's light/dark check now expects the desktop's neutral palette rather than the earlier burgundy accent.