create-walle 0.10.1 → 0.10.2

package/template/coding-task-manager/public/js/prompt-submission-client.js

@@ -5,6 +5,11 @@
   'use strict';
 
   var TERMINAL = new Set(['sent', 'needs_attention', 'blocked', 'failed']);
+  // WP-1 (C1, design §6 / R3/R6): the closed vocabulary the server publishes next to a
+  // terminal status. `retry` repeats the SAME admitted request, `resend` is an explicit
+  // new attempt, `review` restores the preserved prompt and needs a confirmation, and
+  // `none` means the user has nothing to do here.
+  var RECOVERY_ACTIONS = new Set(['retry', 'resend', 'review', 'none']);
   var DEFAULT_INACTIVITY_MS = 20000;
   var LEGACY_DEADLINE_MS = 12000;
   var DEFAULT_ATTENTION_MS = 600000;
@@ -18,6 +23,18 @@
     return String(candidate.type || candidate.agentType || candidate.sessionType || '').toLowerCase();
   }
 
+  // Never invent an action from prose, and never let an unrecognized value grant a
+  // resend. A frame the current server produced always carries one of the four; a frame
+  // with no usable verdict is a legacy frame, so the historical `retryable: true`
+  // verdict keeps its old same-ID meaning and anything else is conservative: review
+  // restores the preserved prompt and requires an explicit confirmation before a
+  // possible duplicate, and can never mint a fresh id on its own.
+  function normalizeRecoveryAction(value, retryable) {
+    var clean = typeof value === 'string' ? value.trim().toLowerCase() : '';
+    if (RECOVERY_ACTIONS.has(clean)) return clean;
+    return retryable === true ? 'retry' : 'review';
+  }
+
   function createManager(options) {
     options = options || {};
     var records = new Map();
@@ -30,6 +47,18 @@
     var createId = options.createId || function() {
       return typeof crypto !== 'undefined' && crypto.randomUUID ? crypto.randomUUID() : fallbackId();
     };
+    // One replacement per original: the gesture is idempotent, so a double click (or a
+    // second UI affordance reaching the same original) returns the successor it already
+    // started instead of minting a second id. Never published: publicRecord must not
+    // expose a live record object.
+    var successors = new Map();
+    // AC-1b (WP-1): the reentrancy fence. The entry is acquired BEFORE any caller-supplied
+    // callback can run (createId, publish/onChange, getSessionType, transport), so a callback
+    // that re-enters resend() for the SAME original while the first call is still executing --
+    // a synchronous double gesture, or a publish-driven UI re-render -- joins the operation
+    // already in flight instead of minting a second identity. It is released on every exit
+    // that did not register a successor.
+    var operations = new Map();
 
     function isCurrent() {
       if (disposed) return false;
@@ -58,6 +87,13 @@
     function eraseRecord(record) {
       clearRecordTimers(record);
       records.delete(record.clientMessageId);
+      successors.delete(record.clientMessageId);
+      operations.delete(record.clientMessageId);
+      // A retired record must not stay reachable through another record's supersession link:
+      // the successor map is a live-object map, never a graveyard of erased records.
+      successors.forEach(function(candidate, originalId) {
+        if (candidate === record) successors.delete(originalId);
+      });
       record.clientMessageId = '';
       record.sessionId = '';
       record.text = '';
@@ -67,6 +103,8 @@
       record.message = '';
       record.signal = '';
       record.status = '';
+      record.recoveryAction = 'none';
+      record.supersedesClientMessageId = '';
       record.alarmed = false;
       record.retryable = false;
       record.lateConfirmationReported = false;
@@ -129,6 +167,13 @@
       if (!record || record.settled) return record;
       Object.assign(record, patch || {});
       if (record.status !== 'sent') record.alarmed = true;
+      // A record that settles into a terminal failure owns its recovery policy, even when
+      // the settling path (a transport failure or an inactivity deadline) has no server
+      // frame to copy it from.
+      if (record.status === 'sent') record.recoveryAction = 'none';
+      else if (TERMINAL.has(record.status)) {
+        record.recoveryAction = usableRecoveryAction(patch && patch.recoveryAction, record.retryable === true);
+      }
       record.settled = true;
       clearRecordTimers(record);
       if (!publish(record)) return record;
@@ -136,6 +181,11 @@
       return record;
     }
 
+    function usableRecoveryAction(value, retryable) {
+      var clean = typeof value === 'string' ? value.trim().toLowerCase() : '';
+      return RECOVERY_ACTIONS.has(clean) ? clean : normalizeRecoveryAction('', retryable);
+    }
+
     function ackTruthEnabled() {
       if (typeof options.isAckTruthEnabled !== 'function') return true;
       var result = guardedCallback(options.isAckTruthEnabled, null, [], null);
@@ -226,7 +276,13 @@
         reason: '',
         message: 'Sending...',
         signal: '',
+        recoveryAction: 'none',
       };
+      // Local supersession link (C1/R6): what this new attempt replaces. It is a client
+      // bookkeeping field for the queue/UI lanes, never part of the transport frame.
+      if (submitOptions.supersedesClientMessageId) {
+        record.supersedesClientMessageId = String(submitOptions.supersedesClientMessageId);
+      }
       record.promise = new Promise(function(resolve) { record.resolve = resolve; });
       var submissionPromise = record.promise;
       records.set(clientMessageId, record);
@@ -308,18 +364,35 @@
       if (record.settled && !TERMINAL.has(status)) return true;
       if (!record.settled && ackTruthEnabled()) armSubmissionDeadline(record);
       if (!guardRecord(record)) return false;
+      var has = function(name) { return Boolean(message) && Object.prototype.hasOwnProperty.call(message, name); };
+      var incomingReason = String((message && (message.reason || message.code)) || '');
+      var incomingMessage = String((message && message.message) || '');
+      var failure = TERMINAL.has(status) && status !== 'sent';
+      // A later duplicate frame for the SAME terminal failure often carries only the
+      // status (the direct reply and the broadcast race). It must not erase the rich
+      // message/reason/recovery verdict the first frame already published.
+      var sameFailure = failure && record.settled === true && String(record.status || '') === status;
+      var retryable = has('retryable') ? message.retryable === true : (sameFailure && record.retryable === true);
+      var recoveryAction = !failure ? 'none'
+        : has('recoveryAction') ? normalizeRecoveryAction(message.recoveryAction, retryable)
+          : sameFailure ? normalizeRecoveryAction(record.recoveryAction, retryable)
+            : normalizeRecoveryAction('', retryable);
       var patch = {
         status: status === 'accepted' ? 'pending' : status,
-        reason: String(message.reason || ''),
+        reason: sameFailure && !incomingReason ? String(record.reason || '') : incomingReason,
         // Server verdict on whether re-sending the SAME prompt can succeed once
         // the condition clears. Callers use it instead of matching code strings.
-        retryable: message.retryable === true,
-        // A refusal without its own message must still read as a refusal: the tray shows Retry
-        // for it, and "Sending..." beside Retry told the user a failed prompt was in flight.
-        message: String(message.message || (status === 'sent' ? 'Sent'
-          : TERMINAL.has(status) ? 'Prompt not sent: ' + String(message.reason || message.code || status).replace(/_/g, ' ')
-            : 'Sending...')),
+        retryable: retryable,
+        // A terminal reply without prose must not look in flight or claim a known no-effect
+        // outcome when its typed recovery policy requires uncertainty review.
+        message: sameFailure && !incomingMessage ? String(record.message || '')
+          : incomingMessage || (status === 'sent' ? 'Sent'
+          : TERMINAL.has(status) ? (recoveryAction === 'review' ? 'Delivery unconfirmed: ' : 'Prompt not sent: ') + String(message.reason || message.code || status).replace(/_/g, ' ')
+            : 'Sending...'),
         signal: String(message.signal || ''),
+        // WP-1 (AC-1a/AC-1e): the typed recovery verdict. Exact enum; an unrecognized
+        // value never grants a fresh resend.
+        recoveryAction: recoveryAction,
       };
       if (TERMINAL.has(status)) reconcileTerminal(record, patch);
       else {
@@ -351,6 +424,9 @@
       return true;
     }
 
+    // AC-1a: a same-ID retry is only ever correct for the server's `retry` verdict --
+    // the admitted request is still executable. Every other policy (resend/review/none)
+    // must go through resend(), which mints exactly one fresh id on an explicit gesture.
     function retry(clientMessageId) {
       if (!isCurrent()) return Promise.resolve(neutralResult());
       var record = records.get(String(clientMessageId || ''));
@@ -358,6 +434,12 @@
       if (!TERMINAL.has(record.status) || record.status === 'sent') {
         return Promise.resolve({ ok: false, status: record.status, reason: 'submission_in_flight' });
       }
+      var action = normalizeRecoveryAction(record.recoveryAction, record.retryable === true);
+      if (action !== 'retry') {
+        return Promise.resolve({
+          ok: false, status: record.status, reason: 'recovery_action_not_retry', recoveryAction: action,
+        });
+      }
       return submit(record.sessionId, record.text, {
         attachments: record.attachments,
         source: record.source,
@@ -365,6 +447,79 @@
       });
     }
 
+    // AC-1b/AC-1c: the ONE explicit fresh-attempt path. Only a user gesture may call it
+    // (nothing here is scheduled, drained or timer-driven), it requires a settled UNSENT
+    // original whose server verdict permits a new attempt, and a `review` verdict also
+    // requires the caller's explicit confirmation. The id is minted once; text,
+    // attachments, source and session are carried over unchanged.
+    function resend(clientMessageId, resendOptions) {
+      resendOptions = resendOptions || {};
+      var confirmUncertain = resendOptions.confirmUncertain === true;
+      if (!isCurrent()) return Promise.resolve(neutralResult());
+      var originalId = String(clientMessageId || '');
+      var record = records.get(originalId);
+      if (!record || !guardRecord(record)) {
+        return Promise.resolve(!isCurrent() ? neutralResult() : { ok: false, status: 'failed', reason: 'submission_not_found' });
+      }
+      var started = successors.get(originalId);
+      if (started && records.get(started.clientMessageId) === started) return started.promise;
+      var inFlight = operations.get(originalId);
+      if (inFlight) return inFlight.promise;
+      if (!record.settled || record.status === 'sent') {
+        return Promise.resolve({ ok: false, status: record.status, reason: 'submission_in_flight' });
+      }
+      var action = normalizeRecoveryAction(record.recoveryAction, record.retryable === true);
+      if (action !== 'resend' && !(action === 'review' && confirmUncertain)) {
+        return Promise.resolve({
+          ok: false, status: record.status, reason: 'recovery_not_permitted', recoveryAction: action,
+        });
+      }
+      var operation = { released: false, promise: null, resolve: null };
+      operation.promise = new Promise(function(resolve) { operation.resolve = resolve; });
+      operations.set(originalId, operation);
+      function release(result) {
+        if (!operation.released) {
+          operation.released = true;
+          if (operations.get(originalId) === operation) operations.delete(originalId);
+          operation.resolve(result);
+        }
+        return result;
+      }
+      try {
+        var idResult = guardedCallback(createId, null, [], record);
+        if (!idResult.current || !idResult.value) return release(neutralResult());
+        if (!guardRecord(record)) return release(neutralResult());
+        var candidateId = String(idResult.value);
+        // The successor must be a NEW identity: the original's own id, or any id already
+        // tracked, would overwrite a live record (and silently re-drive a different prompt).
+        if (candidateId === originalId || records.has(candidateId)) {
+          return release({ ok: false, status: record.status, reason: 'duplicate_client_message_id' });
+        }
+        var successorPromise = submit(record.sessionId, record.text, {
+          attachments: record.attachments,
+          source: record.source,
+          clientMessageId: candidateId,
+          supersedesClientMessageId: originalId,
+        });
+        // submit() registers and publishes the successor before it returns, so the link is
+        // only recorded once the replacement really exists; a denied preflight leaves the
+        // original (text, attachments, ids) exactly as it was and frees the fence.
+        if (!guardRecord(record)) return release(successorPromise);
+        var successor = records.get(candidateId);
+        if (!successor || String(successor.supersedesClientMessageId || '') !== originalId) {
+          return release(successorPromise);
+        }
+        successors.set(originalId, successor);
+        // One replacement, one promise: the re-entrant gesture and this call resolve to the
+        // same successor, and a later gesture gets that successor's own promise back.
+        release(successorPromise);
+        return successor.promise;
+      } catch (error) {
+        release({ ok: false, status: 'failed', reason: 'resend_failed' });
+        throw error;
+      }
+    }
+
     function dismiss(clientMessageId) {
       if (!isCurrent()) return false;
       var record = records.get(String(clientMessageId || ''));
@@ -381,6 +536,7 @@
         if (!dismissed.current) return false;
       }
       records.delete(record.clientMessageId);
+      successors.delete(record.clientMessageId);
       clearRecordTimers(record);
       record.clientMessageId = '';
       record.sessionId = '';
@@ -397,10 +553,17 @@
       disposed = true;
       records.forEach(function(record) { denyRecord(record); });
       records.clear();
+      operations.forEach(function(operation) {
+        if (operation.released) return;
+        operation.released = true;
+        operation.resolve(neutralResult());
+      });
+      operations.clear();
+      successors.clear();
     }
 
     var manager = { submit: submit, handleStatus: handleStatus, handleWalleUser: handleWalleUser,
-      handleInputDropped: handleInputDropped, retry: retry, dismiss: dismiss, dispose: dispose };
+      handleInputDropped: handleInputDropped, retry: retry, resend: resend, dismiss: dismiss, dispose: dispose };
     Object.defineProperty(manager, 'records', { enumerable: true, get: function() {
       if (!isCurrent()) records.forEach(function(record) { denyRecord(record); });
       return records;
@@ -411,6 +574,8 @@
   return {
     classifySessionType: classifySessionType,
     createManager: createManager,
+    normalizeRecoveryAction: normalizeRecoveryAction,
+    RECOVERY_ACTIONS: Array.from(RECOVERY_ACTIONS),
     DEFAULT_INACTIVITY_MS: DEFAULT_INACTIVITY_MS,
     LEGACY_DEADLINE_MS: LEGACY_DEADLINE_MS,
     DEFAULT_ATTENTION_MS: DEFAULT_ATTENTION_MS,

package/template/coding-task-manager/public/js/prompt-submission-tray.js

@@ -0,0 +1,281 @@
+(function(root, factory) {
+  if (typeof module === 'object' && module.exports) module.exports = factory();
+  else root.PromptSubmissionTray = factory();
+})(typeof globalThis !== 'undefined' ? globalThis : this, function() {
+  'use strict';
+
+  // WP-1 (C2, design §6 / R6, docs/queue-delivery-recovery-evidence-2026-10-23.html): the
+  // per-record submission tray row, extracted from index.html (which sits at its file-size
+  // ceiling). Every dependency that can only exist in the page -- the tray element, its
+  // composer clearance, the live manager, and the owner-fenced recovery route -- is passed in
+  // explicitly, so this module owns no globals and no queue state of its own.
+  var QUIET_REVEAL_MS = 5000;
+  var SENT_FLASH_MS = 2200;
+  var FAILURE_STATUSES = ['needs_attention', 'blocked', 'failed'];
+  var ROW_CSS = 'display:flex;align-items:center;gap:8px;padding:9px 10px;border:1px solid var(--border);border-radius:6px;background:var(--bg-secondary, var(--bg-lighter));box-shadow:0 6px 20px rgba(0,0,0,.28);font-size:12px;color:var(--text-primary, var(--text))';
+
+  function normalizeRecoveryAction(value) {
+    var clean = typeof value === 'string' ? value.trim().toLowerCase() : '';
+    return clean === 'retry' || clean === 'resend' || clean === 'review' ? clean : 'none';
+  }
+
+  function rowId(clientMessageId) {
+    return 'prompt-submission-' + String(clientMessageId || '');
+  }
+
+  function trayButton(doc, label, onClick) {
+    var el = doc.createElement('button');
+    el.className = 'btn small';
+    el.textContent = label;
+    el.onclick = onClick;
+    return el;
+  }
+
+  // AC-1a/AC-1e (WP-1 fix): a row's callbacks and timers are bound to the manager and the record
+  // the row was rendered for. The manager identity is captured once, at render time, and re-checked
+  // before every DOM/recovery/dismiss effect -- a later getManager() that answers with a NEW manager
+  // (a logout, or a fresh lease) can never authorize an old row's timer or handler. A caller may add
+  // its own predicate for a record the manager does not track (a queue-owned review record that
+  // survived a reload): the clientMessageId is never authority on its own.
+  function createLifetime(dependencies) {
+    var tracksOwner = typeof dependencies.getManager === 'function';
+    var owner = tracksOwner ? dependencies.getManager() : null;
+    function ownerCurrent() {
+      if (!tracksOwner) return true;
+      return !!owner && dependencies.getManager() === owner;
+    }
+    return {
+      owner: owner,
+      ownerCurrent: ownerCurrent,
+      current: function current(record) {
+        if (!ownerCurrent()) return false;
+        if (typeof dependencies.isCurrent !== 'function') return true;
+        try { return dependencies.isCurrent(record) === true; }
+        catch (_) { return false; }
+      },
+    };
+  }
+
+  // AC-1f (WP-1 fix): a recovery gesture is one-shot WHILE it runs -- a double click cannot start
+  // two replacements -- but a refusal, a throw or a rejected callback must hand the button back. An
+  // inert Resend/confirm button is a dead end for the user; the row stays locked only when the
+  // gesture really committed (its owner retires the row at that point).
+  function runGesture(row, flag, record, lifetime, gesture, onCommit) {
+    if (row.dataset[flag] === '1') return;
+    row.dataset[flag] = '1';
+    function release(committed) {
+      if (committed === true) return;
+      if (!lifetime.current(record)) return;
+      row.dataset[flag] = '';
+    }
+    var result;
+    try { result = gesture(); }
+    catch (error) { release(false); throw error; }
+    Promise.resolve(result).then(function(committed) {
+      release(committed === true);
+      // A committed successor has nothing left to say here: the surface that was only raised for
+      // the uncertain attempt retires itself. The check is the page identity the row was rendered
+      // against -- never the record predicate, which the commit itself is allowed to invalidate.
+      if (committed === true && typeof onCommit === 'function') onCommit();
+    }, function() { release(false); });
+  }
+
+  // R6: an uncertain outcome is never resolved by re-sending on the user's behalf. The Review
+  // gesture only opens the preserved prompt (the server's own message is the uncertainty
+  // warning); the SEND is a second, explicit click, and it is reported as a confirmed resend.
+  function appendReviewPanel(doc, row, record, dependencies, lifetime) {
+    var panel = doc.createElement('div');
+    panel.dataset.ctmReviewPanel = '1';
+    panel.style.cssText = 'flex-basis:100%;display:grid;gap:6px;padding-top:6px;border-top:1px dashed var(--border)';
+    var warning = doc.createElement('div');
+    warning.dataset.ctmReviewWarning = '1';
+    warning.style.cssText = 'color:var(--yellow);font-size:11px';
+    warning.textContent = String(record.message || 'CTM could not confirm what happened to this prompt.');
+    panel.appendChild(warning);
+    var preserved = doc.createElement('pre');
+    preserved.dataset.ctmReviewText = '1';
+    preserved.style.cssText = 'white-space:pre-wrap;margin:0;max-height:140px;overflow:auto;font:inherit';
+    // Exactly the text the user typed, byte for byte -- never re-typed, never re-worded.
+    preserved.textContent = String(record.text || '');
+    panel.appendChild(preserved);
+    var actions = doc.createElement('div');
+    actions.dataset.ctmReviewActions = '1';
+    actions.style.cssText = 'display:flex;gap:6px';
+    actions.appendChild(trayButton(doc, 'Send as new attempt', function() {
+      // The explicit confirmation R6 requires, and a one-shot gesture: a double click must not
+      // start two replacements. A refused answer re-arms it -- nothing was sent.
+      runGesture(row, 'ctmReviewDispatched', record, lifetime, function() {
+        row.dataset.ctmReviewOpen = '';
+        return dependencies.onRecovery('resend', record, { confirmUncertain: true });
+      }, function committedSuccessor() {
+        if (!lifetime.ownerCurrent()) return;
+        // Only a row this surface created is retired here; a row the manager still renders belongs
+        // to the manager's own dismiss path.
+        if (row.dataset.ctmReviewRow === '1') row.remove();
+      });
+    }));
+    // Closing the review never touches the prompt: the queue item keeps its text, images and
+    // pending state, and Send Next can open the review again.
+    actions.appendChild(trayButton(doc, 'Cancel', function() {
+      if (!lifetime.current(record)) return;
+      row.dataset.ctmReviewOpen = '';
+      row.dataset.ctmReviewDispatched = '';
+      row.style.flexWrap = '';
+      panel.remove();
+      if (row.dataset.ctmReviewRow === '1') row.remove();
+    }));
+    panel.appendChild(actions);
+    row.appendChild(panel);
+  }
+
+  function renderStatus(record, dependencies) {
+    if (!record || !dependencies || !dependencies.document) return null;
+    var doc = dependencies.document;
+    var lifetime = createLifetime(dependencies);
+    var manager = lifetime.owner;
+    if (!lifetime.ownerCurrent()) return null;
+    var now = function() { return dependencies.now ? Number(dependencies.now()) : Date.now(); };
+    var setTimer = function(callback, delayMs) {
+      return dependencies.setTimer ? dependencies.setTimer(callback, delayMs) : setTimeout(callback, delayMs);
+    };
+    var tray = dependencies.ensureTray();
+    dependencies.positionTray(tray);
+    var id = rowId(record.clientMessageId);
+    var row = doc.getElementById(id);
+    if (!row) {
+      row = doc.createElement('div');
+      row.id = id;
+      row.style.cssText = ROW_CSS;
+      tray.appendChild(row);
+    }
+    // Quiet happy path (user feedback 2026-08-20: stacked "Sending prompt..." rows sat over the
+    // composer for a whole 21-min turn saying nothing). The tray's real job is the FAILURE lane --
+    // Retry/Restore when a prompt would otherwise be silently lost -- so pending/queued rows stay
+    // hidden unless a prompt is still unacknowledged after 5s, a 'sent' that was never shown
+    // dismisses without the "Prompt sent" flash, and a user-hidden quiet row stays hidden until
+    // its status escalates to a failure (loss protection always wins over the quieting).
+    var quietStatus = record.status === 'pending' || record.status === 'queued';
+    if (!quietStatus && row.dataset.hiddenByUser === '1') delete row.dataset.hiddenByUser;
+    if (quietStatus) {
+      if (!row.dataset.quietRevealAt) {
+        row.dataset.quietRevealAt = String(now() + QUIET_REVEAL_MS);
+        row.style.display = 'none';
+        setTimer(function() {
+          if (!lifetime.current(record)) return;
+          var live = doc.getElementById(rowId(record.clientMessageId));
+          if (live && live.dataset.quietRevealAt && live.dataset.hiddenByUser !== '1') live.style.display = 'flex';
+        }, QUIET_REVEAL_MS);
+      } else if (row.dataset.hiddenByUser === '1' || now() < Number(row.dataset.quietRevealAt)) {
+        row.style.display = 'none';
+      } else {
+        row.style.display = 'flex';
+      }
+    } else if (record.status === 'sent' && row.style.display === 'none') {
+      row.remove();
+      setTimer(function() {
+        if (lifetime.current(record) && manager) manager.dismiss(record.clientMessageId);
+      }, 0);
+      return null;
+    } else {
+      delete row.dataset.quietRevealAt;
+      row.style.display = 'flex';
+    }
+    row.textContent = '';
+    var label = doc.createElement('span');
+    label.style.flex = '1';
+    label.textContent = record.status === 'pending' ? 'Sending prompt...'
+      : record.status === 'sent' ? 'Prompt sent' : (record.message || 'Prompt needs attention');
+    row.appendChild(label);
+    var failure = FAILURE_STATUSES.indexOf(record.status) >= 0;
+    var action = failure ? normalizeRecoveryAction(record.recoveryAction) : 'none';
+    if (action === 'retry') {
+      // Same admitted request: the server said this ID is still executable.
+      row.appendChild(trayButton(doc, 'Retry', function() {
+        if (lifetime.current(record) && manager) manager.retry(record.clientMessageId);
+      }));
+    } else if (action === 'resend') {
+      // Explicit new attempt only -- nothing here is scheduled or automatic.
+      row.appendChild(trayButton(doc, 'Resend', function() {
+        runGesture(row, 'ctmResendDispatched', record, lifetime, function() {
+          return dependencies.onRecovery('resend', record, { confirmUncertain: false });
+        });
+      }));
+    } else if (action === 'review') {
+      row.appendChild(trayButton(doc, 'Review', function() {
+        if (!lifetime.current(record)) return;
+        row.dataset.ctmReviewOpen = '1';
+        renderStatus(record, dependencies);
+      }));
+    }
+    if (action === 'review' && row.dataset.ctmReviewOpen === '1') {
+      row.style.flexWrap = 'wrap';
+      appendReviewPanel(doc, row, record, dependencies, lifetime);
+    } else {
+      row.style.flexWrap = '';
+    }
+    if (record.status !== 'pending' && record.status !== 'queued') {
+      row.appendChild(trayButton(doc, 'Dismiss', function() {
+        if (lifetime.current(record) && manager) manager.dismiss(record.clientMessageId);
+      }));
+      if (record.status === 'sent') {
+        setTimer(function() {
+          if (lifetime.current(record) && manager) manager.dismiss(record.clientMessageId);
+        }, SENT_FLASH_MS);
+      }
+    } else {
+      // Quiet rows get a HIDE-ONLY dismiss -- never CTMPromptOutbox.dismiss here, that would drop
+      // the durable retry record while the prompt is still in flight. The row (and its tracking)
+      // stays; only the pixels go, and a failure escalation clears hiddenByUser above.
+      row.appendChild(trayButton(doc, 'Dismiss', function() {
+        if (!lifetime.current(record)) return;
+        row.dataset.hiddenByUser = '1';
+        row.style.display = 'none';
+      }));
+    }
+    return row;
+  }
+
+  // AC-1e (WP-1 fix): the review surface for a QUEUE-owned item. The queue owns the item, and the
+  // manager may hold no record for it at all (a preserved item after a reload), so the caller passes
+  // a read-only snapshot plus its own lifetime predicate. This renderer never mints, sends or
+  // persists anything of its own.
+  function renderItemReview(record, dependencies) {
+    if (!record || !dependencies || !dependencies.document) return null;
+    var doc = dependencies.document;
+    var lifetime = createLifetime(dependencies);
+    if (!lifetime.current(record)) return null;
+    var tray = dependencies.ensureTray();
+    dependencies.positionTray(tray);
+    var row = doc.getElementById(rowId(record.clientMessageId));
+    var ownsRow = false;
+    if (!row) {
+      row = doc.createElement('div');
+      row.id = rowId(record.clientMessageId);
+      row.style.cssText = ROW_CSS;
+      tray.appendChild(row);
+      ownsRow = true;
+    }
+    // Cancel removes a row this surface created itself; a row the manager already renders stays,
+    // with its own Review gesture, and is closed back to its normal state instead.
+    row.dataset.ctmReviewRow = ownsRow ? '1' : '';
+    row.dataset.ctmReviewOpen = '1';
+    row.dataset.ctmReviewDispatched = '';
+    row.style.display = 'flex';
+    row.style.flexWrap = 'wrap';
+    row.textContent = '';
+    var label = doc.createElement('span');
+    label.style.flex = '1';
+    label.textContent = 'Uncertain delivery — review this prompt before sending it again';
+    row.appendChild(label);
+    appendReviewPanel(doc, row, record, dependencies, lifetime);
+    return row;
+  }
+
+  return {
+    renderStatus: renderStatus,
+    renderItemReview: renderItemReview,
+    normalizeRecoveryAction: normalizeRecoveryAction,
+    QUIET_REVEAL_MS: QUIET_REVEAL_MS,
+    SENT_FLASH_MS: SENT_FLASH_MS,
+  };
+});