Epic: terminal workflow initiative (make one command's result useful for the next)

FRONTEND FROZEN — 2026-10-14

All required automated workflow stabilization gates pass at the accepted original PR heads below. Candidate and actual published-head CI were freshly reconciled against the real remotes and PR checks; each linked run passed on attempt 1. Original ancestry and both independent siblings are preserved. No integration, protected-branch merge, tag or release occurred. Physical terminal/clipboard QA is unperformed; issues and draft PRs remain open.

Track	Accepted original PR head	Comprehensive candidate CI	Actual PR CI
Input #348	`6aba63bd78f467af8aeaf60421faef05c608646b`	38525959028	38527326783
Queue #357	`5ab9892060fb0aed2d89f34842a9739c6e860163`	38528656051	38529888852
Copy #358	`839d23f3bfb780c164b3fa19137170944abe0d21`	38565279297	38566317316
Report #360	`cb28d4586197e563e4f98c1f0a96e9e3b8f95251`	38567509019	38568288217
Compare #361	`f1abe217c6a27034a93182bf423dfb45e18ef73d`	38584973991	38585746229
Vocabulary #367	`5009033c553c882c27a9aeb5a136323637ab302f`	38586511315	38587380619
References #368	`2395dad5b52895fe041d93d2c75123b25f6669fe`	38588753923	38589604854

Verification: exact-head canonical build/full runtime/ranking/cleanup/diff checks pass for every track. Current References passes report/compare security and clipboard acceptance, benchmark typechecking and bounded timing smoke. Full Linux canonical passes at References with Fish 3.7.0/Node 26.11.1; affected independent Vocabulary lifecycle/completion and three-worker checks pass. Curated Node 22.23.3 plus the new clipboard/startup regressions pass. Guest clones remained clean and the owned VM stopped normally. PR-only Fedora/timing skips are covered by comprehensive candidate CI.

Stable boundaries: the typed SessionClient event/operation/capability boundary, persistent real shell, authenticated queue readiness/approval/ownership, private composer routing and review, panel/draft focus restoration, stable poll identity/query/focus, raw transcript separation and common screenPlan geometry are documented. TerminalApp private methods are implementation seams; no background-submission hook is connected. Workspace/background components remain unwired. Future integration must preserve user keymap/shelf/bar/history precedence, drawer focus, stable task identity/graceful owned termination, session-service validation and separate bounded task output. Use canonical #370 Ruby/PHP 417d105e3f513e36bf35d0efb7c0b79574a31f9b, not #368’s older duplicate.

Known limits: older failed Copy/Report/Compare/timing/discovery records remain preserved and unattributed where unreproduced. Compare 38569811366 hit the original ten-minute Ubuntu job limit; exact-source observed controls recorded worker/PTY exits and independent uninstrumented confirmation plus actual PR CI passed. No harmless-flake/resource-starvation classification or gate waiver is claimed. Comparison c copies a sanitized plain diff directly and may retain secrets; comparison r and Copy as Report use explicit review. Plain /copy is also intentionally unredacted. Report redaction is best-effort; external clipboard failure cannot guarantee rollback. Native less concurrent read/WINCH and forced SIGKILL helper cleanup retain documented limitations. Linux optional installed zoxide/fzf/Powerlevel10k and macOS-only cases have explicit skips; Bash minimum 4.4 was not directly exercised. Exact last-frame module compaction diagnostics and dedicated external source previews can move to v0.20 or later.

Physical QA still required: Ghostty/Terminal.app and a physical Linux/Fish 3.7 terminal: hidden/function/key reads and immediate post-read/interrupt typing; startup typing/quit and repeated cleanup; multiline/stateful exact-once queueing, failure/interruption/approval/edit/reattach; Vim/less/TUI resize, input modes and selection; actual clipboard bytes, cancel/edit/backend failure and narrow/short review; original-draft submission/focus, cwd pins/staging/privacy/failure navigation, live vocabulary and poll focus; FOLLOW/DETACHED, Top/Bottom/Flow, NO_COLOR/Safe and narrow/short layouts. The complete checklist and limitations are in the handoff. No human test result is inferred from automation.

Complete durable handoff: stable frontend checkpoint, exact evidence manifest, canonical stabilization handoff.

Checkpoint commit: ca26b9be62f2d7eb7f083e05bd6a2fcff9334811. No integration was started or authorized by this publication.

Earlier checkpoint text below is retained as historical context; pending/running states are superseded by the accepted freeze above.

Compare uninstrumented confirmation and publication (2026-10-14): frontend freeze PENDING. Hosted observed control 38583441554 passed every required job on attempt 1 at isolated diagnostic 31bf78714ef8504c2b4648e91d8dabb5dc6af2f4; its x64 Ubuntu artifact records Node 26.11.1 and exit events for every observed worker and PTY child. The diagnostic branch changes no Compare runtime/test/dependency source and is not incorporated into the feature.

A separate uninstrumented comprehensive candidate confirmation 38584973991 then passed every required job, including both platform shards, Node 22, Fedora, quality, both timing smokes and aggregates, on attempt 1 at exact Compare f1abe217c6a27034a93182bf423dfb45e18ef73d. This is distinct confirmation after controlled observations, not a rerun or replacement of the failed run. Original failed candidate 38569811366 and its unchanged record/hash remain preserved and unattributed. No assertion, timeout, process-cleanup gate or CI requirement was weakened.

After canonical/current-head/ancestry/accepted-Report-parent and full-candidate guards passed, original PR #361 was promoted nonforce from 032365e2ffa9fd42563ae93e66fd487b41e66841 to f1abe217c6a27034a93182bf423dfb45e18ef73d. Actual published-head PR CI 38585746229 is running; Compare is not yet accepted until those required jobs pass. Input, Queue, Copy and Report remain the four accepted original tracks. Vocabulary 5009033c553c882c27a9aeb5a136323637ab302f and References/Elm 2395dad5b52895fe041d93d2c75123b25f6669fe remain independent siblings, held behind actual Compare CI before their guarded candidate/original sequence.

Current source host canonical and References security/clipboard/benchmark/timing, full Linux/Fish 3.7, affected Vocabulary lifecycle and Node 22 gates pass as recorded below. Raw diagnostic job-log API retrieval was refused by the GitHub CLI escape-sequence output filter; no override was used. The complete lifecycle artifact and job metadata were collected and verified instead. This did not block correctness evidence. Physical QA remains unperformed. No integration, protected-branch merge or other owner's resource mutation occurred. Next: reuse actual Compare CI and the existing sequential promotion driver; then reconcile every accepted exact head and required gate before publishing a freeze.

Evidence on T7: clipboard-startup-indigo-workflow_dispatch-confirmation-ci-final.json; preserved original clipboard-startup-indigo-workflow_dispatch-ci-final.json; clipboard-startup-indigo-uninstrumented-confirmation-request.json with retained-record hash; clipboard-startup-indigo-original-publication.json; compare-observed-ci-{final.json,ubuntu1-summary.json,ubuntu1-early-artifact}; active driver finish-post-observation-workflow-ci.py.

Hosted worker-observation checkpoint (2026-10-14): frontend freeze PENDING. Private exact-source Linux controls at Compare f1abe217c6a27034a93182bf423dfb45e18ef73d passed both the contextual subset and the entire original Ubuntu shard 1/2 file list with three workers, the unchanged 120-second test limit and ten-minute outer limit. The full shard finished in about four minutes. Every observed worker and PTY child had an exit event. This is arm64 diagnostic evidence, not attribution or replacement of the failed hosted x64 run. The owned VM stopped normally; the failed CI 38569811366 remains preserved and unclassified.

The isolated branch diagnostics/workflow-indigo-worker is now pushed at 31bf78714ef8504c2b4648e91d8dabb5dc6af2f4, with hosted diagnostic CI 38583441554 dispatched exactly once and running on attempt 1. Compare's runtime source, tests and dependency locks are byte-identical to f1abe217; only the diagnostic scripts and Ubuntu shard observation step differ. Test assertions, runner concurrency, test timeout and job deadline are unchanged. The probe records worker identity, phases, owned process exit events, bounded unreferenced heartbeats and minimal process metadata, excluding payloads, argv and environment values. Its timing overhead means its passage cannot by itself accept an uninstrumented candidate.

Review found and corrected diagnostic-only outcome masking on recording setup, file/output failure and a missing worker header. Final real-child controls preserve success, failure and signal exit status when recording fails. A parser-only private /proc fixture proves the missing-header correction; the preceding macOS control did not reach that Linux path and remains recorded as nonreproducing evidence. Normal clean-head canonical passes at the initial diagnostic commit 0e80632e92a9367c81c863d29ce3cf07e678b175 and corrected 31bf787. Both records are retained; neither is a workflow-head acceptance claim. The owned documentation worktree is restored cleanly to docs/workflow-oak-checkpoint.

Current workflow acceptance remains unchanged: Input #348 6aba63bd78f467af8aeaf60421faef05c608646b, Queue #357 5ab9892060fb0aed2d89f34842a9739c6e860163, Copy #358 839d23f3bfb780c164b3fa19137170944abe0d21 and Report #360 cb28d4586197e563e4f98c1f0a96e9e3b8f95251 have accepted exact-head local/candidate/actual-PR gates. Compare and both independent sibling originals remain held. Their candidate host gates and current-head Linux/Fish 3.7/Node 22, security/clipboard/timing evidence are recorded below. Remaining: finish this existing hosted observation, investigate any captured failure, obtain genuine uninstrumented candidate and actual published-head CI for the last three tracks, and reconcile all required gates before freezing. Physical QA is unperformed. No integration or protected/other-owner branch mutation occurred.

Evidence on T7: compare-f1abe21-worker-diagnostic-{linux-result.json,events.tar,summary.json}; compare-observed-ci-{publication.json,run.json,final-controls-result.json,header-proc-control-result.json}; exact diagnostic canonical logs/results. Observation CI results must remain separate from acceptance evidence.

Current-head Linux acceptance checkpoint (2026-10-14): frontend freeze PENDING. The complete normal Linux canonical gate passes at References/Elm 2395dad5b52895fe041d93d2c75123b25f6669fe, including its unchanged ranking ceiling and resource cleanup. Independent Vocabulary 5009033c553c882c27a9aeb5a136323637ab302f passes the affected activity/lifecycle/native-completion subset and the existing three-worker Keep Awake subset. Curated Node 22.23.3 compatibility and the new real-child clipboard/startup regressions also pass at 2395dad5. Linux uses Node 26.11.1, Fish 3.7.0, zsh 5.9 and Bash 5.2. Both guest clones stayed clean at their pinned heads; the owned VM stopped normally. The earlier failed Linux canonical remains failed evidence and is not rewritten.

Explicit Linux limitations: optional installed zoxide, fzf and Powerlevel10k coverage was skipped because those tools are absent; real macOS caffeinate and macOS window integration are platform skips. Minimum Bash 4.4 and physical terminal/clipboard QA were not newly exercised. Current host canonical, benchmark typechecking, report/compare security/clipboard acceptance and bounded timing smoke pass as recorded below; these automated results do not establish physical validation.

Compare candidate CI 38569811366 remains failed at its ten-minute Ubuntu shard 1/2 limit. A separate private exact-source diagnostic has passed the contextual test subset with three workers at the original 120-second test limit on the owned arm64 Linux VM; the original shard file list is now being observed under the same worker/test/job limits. It records worker identity, test phases, owned process signal/exit events and bounded resource heartbeats. It changes no repository source or canonical acceptance invocation. A passing diagnostic does not clear or attribute the historical CI failure, and arm64 VM evidence does not substitute for the failed hosted x64 job.

Accepted original automated heads remain Input 6aba63bd78f467af8aeaf60421faef05c608646b, Queue 5ab9892060fb0aed2d89f34842a9739c6e860163, Copy 839d23f3bfb780c164b3fa19137170944abe0d21 and Report cb28d4586197e563e4f98c1f0a96e9e3b8f95251. A fresh actual-PR read confirms those heads and green required checks. Compare and both independent sibling originals remain held; their older CI cannot accept the new candidates. No integration, protected-branch mutation, unrelated feature or other owner's resource change occurred. Next: finish the existing bounded diagnostic, investigate any recorded retained worker, then obtain genuine new candidate and actual-head CI before declaring a freeze.

Evidence on T7: clipboard-startup-final-linux-{canonical.log,result.json,vm-start.log,vm-stop.log}; published-head-reconciliation-20261014T…Z.json; compare-f1abe21-worker-diagnostic-* (diagnostic, not acceptance); original failed CI job log/annotations retained.

Host completion and Compare CI hold (2026-10-14): frontend freeze PENDING. The serialized host driver completed normally. Clean-head canonical verification passes for Compare f1abe217c6a27034a93182bf423dfb45e18ef73d, Vocabulary 5009033c553c882c27a9aeb5a136323637ab302f and References/Elm 2395dad5b52895fe041d93d2c75123b25f6669fe, in addition to the four accepted original tracks below. References also passes benchmark typechecking, current-head report/compare security and clipboard acceptance, and bounded timing smoke. All original assertions, deadlines and cleanup gates remain intact.

Compare candidate CI 38569811366, attempt 1, did not pass: Ubuntu shard 1/2 exceeded the existing ten-minute job limit. It logged normally through 13:14:40 UTC, then remained silent until cancellation at 13:22:31. Both macOS shards, Ubuntu shard 2/2, Node 22, quality, Fedora and both platform timing jobs passed. Cancellation-time process records include a surviving Node worker and zsh, but do not identify their owning test; reporter ordering does not establish which file stalled. No assertion failure, production defect, resource-starvation cause or harmless-flake classification has been established. The failed run, job log, annotations and process records are preserved. No failed run was rerun and no deadline was increased.

Compare's original PR branch remains 032365e2ffa9fd42563ae93e66fd487b41e66841; Vocabulary and References original promotions remain held. Their source candidates remain independent siblings above Compare. Accepted original tracks are Input #348 6aba63bd78f467af8aeaf60421faef05c608646b, Queue #357 5ab9892060fb0aed2d89f34842a9739c6e860163, Copy #358 839d23f3bfb780c164b3fa19137170944abe0d21 and Report #360 cb28d4586197e563e4f98c1f0a96e9e3b8f95251, with exact candidate and actual PR CI linked below.

The prepared full Linux/Fish 3.7 and Node 22 driver is now the sole active local heavy verification, using the owned VM after host completion, strict-forward clean guest clones and unchanged dependency locks. Start guards passed at 50% memory free, about 3.6 GiB internal and 5.5 GiB mounted T7 free. Results are pending; prior-head Linux passes do not accept these new heads. Next: reuse this running gate, collect exact worker identity/lifecycle evidence for the CI timeout, and resume publication only through unchanged canonical/candidate/parent/actual-head guards. Physical QA remains unperformed. No integration, protected-branch mutation, unrelated feature or other owner's resource change occurred.

Evidence on T7: clipboard-startup-host-progress.jsonl; exact-head {indigo-compare,willow-vocabulary,maple-workflow}-clipboard-startup-… logs/results; compare-f1abe21-ubuntu-shard1-{cancelled-job.log,job-metadata.json,annotations.json}; clipboard-startup-indigo-workflow_dispatch-ci-final.json; clipboard-startup-final-linux-* (active, not accepted).

Terminal workflow initiative

Make the result of one command useful for the next without taking execution control away from the user. NMSh owns the interaction/presentation layer over the real persistent zsh, Bash and Fish shell.

Canonical design: docs/design/terminal-workflow.md. Development ledger: docs/development/workflow-initiative-ledger.md on the workflow feature stack. Draft PR ≠ merged, released or physically validated. Always verify current heads.

Dependency/PR map

#345 release/v0.18.0 (base: master)
  └─ #348 input awareness [draft]
       └─ #357 command queue [draft]
            └─ #358 copy picker, block controls and Smart Folding [draft]
                 └─ #360 Copy as Report [draft]
                      └─ #361 Compare Output [draft]
                           ├─ #367 expressive activity vocabulary [draft sibling]
                           └─ #368 references, failure navigation, staging, pins/recipes/conditions [draft sibling]

Related independent PRs: #347 (managed agent workspace) and #349 (notice wrapping) build on #345. #329/#342/#343/#344/#346 are included in the #345 release stack; do not close or rebase them merely to tidy the list. Confirm merge/closure policy first.

Current stabilization gate — PENDING

Report/Compare gate checkpoint (2026-10-14): original PR #360 and its fix branch are both cb28d4586197e563e4f98c1f0a96e9e3b8f95251. Clean-head canonical, comprehensive candidate CI 38567509019 and actual published-head PR CI 38568288217 pass, with both CI runs on attempt 1. Its PR description is current. The earlier failed Report runs remain preserved; these passes do not attribute their causes.

Compare f1abe217c6a27034a93182bf423dfb45e18ef73d also passes focused and clean-head canonical verification. Its fix branch was pushed nonforce and comprehensive candidate CI 38569811366 is running; original Compare remains gated by candidate/parent/actual-head CI. Vocabulary 5009033c553c882c27a9aeb5a136323637ab302f focused verification passes and canonical is now the sole active local heavy suite. References/Elm 2395dad5b52895fe041d93d2c75123b25f6669fe remains the independent sibling, queued for its own host and final benchmark/security/clipboard gates.

Input, Queue, Copy and Report now have accepted original automated track gates on their exact heads. Frontend freeze remains PENDING: later exact-head CI, References/Vocabulary host verification, final full Linux/Fish 3.7/Node 22 and acceptance reconciliation remain required. Physical QA is unperformed. The owned VM is stopped; no integration or protected-branch change occurred. Historical failure records and original assertions/deadlines remain intact.

Published Copy acceptance checkpoint (2026-10-14): original PR #358 and fix/workflow-amber are now both 839d23f3bfb780c164b3fa19137170944abe0d21. Clean-head canonical, comprehensive candidate CI 38565279297 and actual published-head PR CI 38566317316 all pass. Both CI runs passed on attempt 1; the candidate run passed Fedora and both platform timing jobs as well as runtime/quality/aggregate checks. Nonforce promotion checked the original ancestry and accepted Queue parent. PR #358's description records the current behavior, exact evidence, retained failures and unperformed physical QA. This accepts Copy's current automated track gates, not the whole frontend freeze.

Report cb28d4586197e563e4f98c1f0a96e9e3b8f95251 passes clean-head canonical and focused verification. That Report publication checkpoint is superseded by accepted candidate/actual CI above. Compare canonical completed successfully; Vocabulary is now the active host canonical suite. No additional local heavy suite or VM overlaps this work.

The accepted original automated tracks so far are Input #348 6aba63bd78f467af8aeaf60421faef05c608646b, Queue #357 5ab9892060fb0aed2d89f34842a9739c6e860163, and Copy #358 839d23f3bfb780c164b3fa19137170944abe0d21. All later track gates and final current-head benchmark/security/clipboard/full Linux/Fish 3.7/Node 22 reconciliation remain required. Every earlier failed canonical and CI record remains preserved and unattributed where no controlled reconstruction exists. Frontend freeze remains PENDING. Physical QA is unperformed. No integration, protected-branch mutation or unrelated work occurred.

Next: reuse the existing serialized host and CI drivers; advance originals only after their exact local/candidate/parent/actual CI gates pass. Final References/Elm and Vocabulary remain independent siblings above Compare. The owned Linux VM stays stopped until host verification finishes.

Additive propagation checkpoint (2026-10-14): Copy 839d23f3bfb780c164b3fa19137170944abe0d21 passes normal clean-head canonical build, full runtime suite, ranking, cleanup and diff checks. The preceding ece9b81 discovery failure remains failed and unattributed; a later pass does not reconstruct its cause. The corrected Copy candidate was pushed nonforce to fix/workflow-amber; comprehensive exact-head CI 38565279297 is running on its first attempt. That initial Copy publication checkpoint was superseded by the accepted original head and actual PR CI recorded above.

The fixes are incorporated additively into local Report cb28d4586197e563e4f98c1f0a96e9e3b8f95251, Compare f1abe217c6a27034a93182bf423dfb45e18ef73d, Vocabulary 5009033c553c882c27a9aeb5a136323637ab302f, and References/Elm 2395dad5b52895fe041d93d2c75123b25f6669fe. Every two-parent merge and affected blob was checked. A full-file equality guard correctly paused at References' existing clipboard reader addition; the exact updated writer plus byte-identical prior reader was then verified. No feature was dropped, no merge was repeated or undone, and neither sibling is an ancestor of the other. Elm advanced only by a checked fast-forward. Other original feature/fix remotes remain at the previously recorded heads.

Report focused and clean-head canonical verification completed successfully; Compare is now the active local canonical suite. The driver serializes Compare, Vocabulary and References gates afterwards, stopping rather than replacing a failed result. Final References benchmark typecheck, current-head report/compare/clipboard acceptance and timing smoke are still required. The prepared full Linux/Fish 3.7 and Node 22 driver reuses only the owned stopped VM, strict-forward guest clones and unchanged package locks; it refuses to overlap host verification. Earlier Linux/Node 22 passes are evidence of their earlier pinned heads, not acceptance of these new commits.

Input/Queue accepted original heads remain 6aba63b/5ab9892. Later comprehensive candidate and actual PR CI, final cross-platform/security/clipboard reconciliation and physical QA remain pending. Frontend freeze remains PENDING. No integration, release/master merge, unrelated feature or other owner's resource was modified. All historical failure evidence is retained.

Evidence on T7: Copy amber-copy-clipboard-startup-839d23f…-canonical log/result; post-handoff-clipboard-startup-candidates.json; clipboard-startup-local-promotion.jsonl and clipboard-startup-local-propagation-reconciliation.json; clipboard-startup-amber-candidate-publication.json; Report exact-head focused log/result. Next: reuse existing CI and running serialized gates, investigate any failure without deadline/budget changes, and promote original branches only through the recorded ancestry and CI guards.

Discovery gate checkpoint (2026-10-14): Copy ece9b81c8c4a5787e748aa5d7ab933272db6eb57 clean-head canonical completed with exit 1. Clipboard, startup ownership and ranking passed, but worktreeDiscovery.test.ts expected 101 entries and received 93 in its original 100-linked-worktree fixture. The failure occurred at the count assertion; it is not recorded as a performance-ceiling failure. The discovery implementation, parser, runner, fixture and test are unchanged from published Copy ce6cee1. No worktree production code was modified and no resource/flake attribution is justified by this result.

Three original-dataset controls passed with all 101 records and status calls, concurrency at most eight and the original deadlines. A complete unchanged-file shadow with transparent Git-result observation also passed, including all preceding fixtures. These controls do not clear the failed canonical gate. A subsequent failure-only evidence commit 839d23f3bfb780c164b3fa19137170944abe0d21 retains the raw Git list, failed-probe results and setup/discovery timings if the original assertion fails again. Every count, concurrency, timing and cleanup assertion remains intact. Focused discovery tests, strict typechecking and fast verification pass. This diagnostic change does not claim to fix the discovery failure.

That Copy 839d23f canonical completed successfully; local propagation and candidate publication are recorded above. The previous ece9b81 record remains failed and immutable. Original PR promotion remains subject to candidate/parent/actual-PR CI guards. Neither sibling was changed. Input/Queue accepted progress remains unchanged; later exact-head CI, final timing/security/clipboard/Linux/Fish 3.7/Node 22 and physical QA remain outstanding. Frontend freeze remains PENDING. No integration or protected-branch mutation occurred.

One full-file control preflight failed the unchanged combined disk guard before creating any run log or starting tests. A fresh check subsequently passed (about 5.0 GiB internal and 5.6 GiB mounted T7 free), and only the previously unstarted control then ran. The rejected preflight and follow-up are separately recorded; no cleanup, guard change or interruption occurred. The owned VM remains stopped during host verification.

Evidence on T7: amber-copy-clipboard-startup-ece9b81…-canonical failed log/result; worktree-100-ece9b81-observed-control and per-round raw-list/metadata records; worktree-discovery-ece9b81-full-observed-control log/result/events; worktree-full-control-resource-guard-first-attempt.json; worktree-discovery-failure-context-{focused,strict,fast} and worktree-discovery-failure-context-commit.json. Next: reuse the running 839d23f canonical outcome; inspect retained layer evidence on recurrence. Do not restart obsolete drivers or replace earlier failed results with controls.

Clipboard/startup correctness checkpoint (2026-10-14): Vocabulary cb25f7310231864409a85e08c6c3b9d8a20b22a8 clean-head canonical completed with exit 1. Both early less/vim cases failed before submission while waiting for a transient composer; the real frontend instead displayed the intended blocked-startup screen. Usable owned-process samples and complete failure output are retained. Delayed-journal controls reproduced this incorrect fixture assumption at the original twenty-second deadline. References host canonical was not started by that stopped driver.

Copy now contains two additive local commits: clipboard lifecycle fix 8723a119433377bcd912cd16ced4a67386a5ac36, followed by startup fixture correction ece9b81c8c4a5787e748aa5d7ab933272db6eb57. A real-child control completed actual EOF and copied exact bytes, then delayed only the JavaScript final callback until backend exit. Node destroyed stdin before emitting exit, suppressing finish; the old writer timed out at the unchanged three-second deadline. The fix requires an error-free payload-write callback and backend exit zero, calls end() immediately, and preserves process/stream errors, timeout and owned-process cleanup. Real-child regression failed before the fix and passed afterwards. Partial-read, callback-error-after-exit, existing EPIPE, timeout, UTF-8, selection-owner and live-copy regressions pass. This proves the controlled lifecycle defect, not attribution of the historical live clipboard failure; five unchanged live controls passed without reproducing it.

The early fullscreen fixture now submits through the actual editor/submit pipeline before the startup notice, with pending-command and foreground-ownership witnesses. Normal and delayed-journal less/vim cases retain answered-file, actual q/Ctrl+C, exit 130, session removal, shell-exit and strict cleanup assertions. Separate automated real-PTY early-typing coverage remains unchanged; this is not human terminal QA. Focused tests, fast verification, strict test/fixture typechecking and review pass. The initial test-only overload typecheck failure is preserved separately and corrected.

That Copy ece9b81 canonical run completed with the discovery failure recorded above; the current running head is 839d23f. These commits are not yet published or accepted. Input/Queue accepted heads remain unchanged; downstream local heads still require deliberate additive propagation and their new-head gates. All preceding startup/clipboard/timing/CI failures remain preserved; no deadline, budget or acceptance assertion was weakened. Current Linux/Fish 3.7 and Node 22 evidence remains scoped to fd4daf8/cb25f73 and will require reconciliation after propagation. Frontend freeze remains PENDING. Physical QA is unperformed; no integration or protected-branch merge occurred.

Evidence on T7: compare-clipboard-a86-held-final-control log/result/events; compare-clipboard-a86-live-events-control records; startup-early-ownership-delayed-oracle-red; clipboard-lifecycle-boundary-{red,green}; startup-and-clipboard-correctness-green; clipboard-startup-correctness-{fast,strict-tests-v2}; clipboard-lifecycle-final-focused; clipboard-startup-correctness-commits.json. Failed canonical records are immutable. Next: reuse the running Copy result, then continue guarded propagation, exact-head canonical/CI and remaining timing/security/clipboard/Linux acceptance.

Durable exact-head handoff records committed/published heads, interfaces, limitations and remaining physical QA. All history is preserved. No integration or protected-branch merge is authorized.

Current actual Report PR CI 38500575001, attempt 1, failed Ubuntu shard 1/2 on published 690ff65f8b356f2a9d06b399bff17befbca57c4e: the reattached less display appeared, then completion after one q timed out at the original 15 seconds. Other applicable jobs passed; no process leaks were found. Exact historical CI cause remains unknown; no rerun or harmless-flake classification. The preceding 0d092ac macOS first-repaint timeout remains separately preserved.

Pager investigation checkpoint (2026-10-14): the unchanged Report 690ff65 fixture reproduced the less quit timeout on Ubuntu 24.04 arm64 with less 590, Node 26.11.1 and Fish 3.7 installed. Failure-only observations found a live foreground less process, both PTYs at 35×110 and a later complete repaint after the single quit key. A separate frontend observation confirmed q entered the active raw passthrough path and was written to the live client socket; this does not prove delivery through every later layer. Strict cleanup completed and the owned VM stopped normally after each control. Service/native instrumentation runs passed and therefore do not isolate the failed path.

A native-only controlled pair, without NMSh, confirms an independent hazard: after less successfully reads its single q, a real PTY resize at that read boundary can leave it running through the original 15-second observation, while the same read without resize exits promptly. This agrees with less v590's command loop, which skips decoding a character when signals are pending. It proves a native signal/input interaction, not the exact cause of the historical CI failures. The old first-text oracle can accept an intermediate attach-nudge repaint; its readiness assumption is unsafe independently of historical attribution. Same-prompt legacy-oracle controls also passed, so the new prompt/wait is not claimed as a one-variable reconstruction of CI.

Test-only Cedar c9fcbf92701ef30d72a83e3cb75c31237dba160f waits for the complete final-size pager frame (last content row plus explicit native prompt) before one q. It preserves the single existing repaint wait, the 15-second completion deadline, Vim coverage and strict cleanup. Bounded read-only failure observations now cover both repaint and quit stages before teardown. Uninstrumented Ubuntu full-frame controls, actual macOS lifecycle/resize checks, fast verification and focused read-only review passed. Its clean-head canonical passed and additive propagation is complete; fresh candidate CI and downstream gates are underway. Accumulated terminal text is not an input acknowledgement or a terminal-screen model. No production input change, retries, skipped assertion, deadline inflation, failed-run rerun or harmless-flake classification occurred.

Evidence is preserved on T7 under verification/: report-690ff65-linux-quit-control, report-690ff65-linux-quit-delivery-observable, report-690ff65-linux-service-delivery-interop, report-690ff65-linux-native-read-window, report-690ff65-linux-pager-complete-frame-literal and report-690ff65-linux-pager-legacy-oracle log/result pairs. Initial setup-only dependency/import failures and the incorrect diagnostic prompt-format repaint failure remain separately recorded; they are not production failures. The new fixture's focused/fast, review and exact-commit canonical records use the pager-fixture- prefix. Previous stopped drivers must not be restarted with their obsolete pins.

Current verified progress (2026-10-14): Input original/fix 6aba63bd78f467af8aeaf60421faef05c608646b passes recorded clean-head canonical, candidate CI 38525959028 and actual PR CI 38527326783. Queue original/fix 5ab9892060fb0aed2d89f34842a9739c6e860163 passes clean-head canonical, candidate CI 38528656051 and actual PR CI 38529888852. All four CI runs passed on attempt 1. The existing Input canonical result was reused. Promotions were gated and nonforce; PR descriptions now reflect these exact heads.

All eight local source refs retain the reviewed two-file readiness correction additively, with exact file/blob checks and independent Vocabulary/References siblings. All six downstream focused lifecycle/completion runs pass with strict runner cleanup. Copy 0ab5bdc0e49ea0006fd07c1418be3dd3e4d3228a canonical finished naturally with exit 1: the initial frontend in liveHardening.test.ts:68 produced zero output through its unchanged 20-second deadline. Native readiness and ranking passed. Three unchanged focused controls and the complete affected file passed with strict cleanup; these do not clear or attribute the failed canonical. Preserved checkpoint, durable handoff at 0cae3b5. Copy promotion remains held. Report 7af27b16ce20dd405c4899ae0d37b3b94e404b56 canonical also completed with exit 1: copySelectionLive.test.ts:146 failed its initial readiness wait before detach/reattach, with only 13 bytes of terminal control output through the original 20-second deadline. Ranking passed; no ownership leak was recorded. Completed-failure checkpoint, handoff at 106f4d6. Both current canonical failures remain uncleared. Two sets of 24 fresh starts, the normal-worker Copy selection file and earlier focused controls passed without reproducing the stall. That full-suite diagnostic control completed successfully without reproducing a failed wait; the latest running verification is recorded above. This is diagnosis, not replacement acceptance evidence. Remaining host, CI, Linux/Fish3.7/Node22 and timing/security/clipboard gates are pending. No failed run was duplicated or interrupted.

The ordinary correctness steps completed normally. All remaining release criteria are unchanged: later exact-head canonical, candidate/actual CI, benchmark/security/clipboard acceptance and full Linux/Fish 3.7; physical QA remains unperformed. Earlier Copy canonical and Report CI failures remain preserved and unattributed. No assertion, deadline or acceptance gate was weakened. Frontend freeze remains PENDING. Integration and protected-branch merges remain outside this session.

Current native readiness correction (2026-10-14): Input local candidate 6aba63bd78f467af8aeaf60421faef05c608646b fixes an independently proved native-completion readiness framing bug. capture.zsh checked successful nonblocking PTY reads separately: an actual ok line split into o and k was lost, causing initialization to expire despite a ready inner shell. A byte-preserving real-zpty control captured the file with unsplit reads, expired at the original helper deadline with the split, then captured the same file after normal forwarding resumed. Zsh 5.9's reader implementation permits successful reads containing an incomplete line. This control establishes the framing defect, not the exact cause of the Copy canonical failure.

The fix accumulates initialization output within 65,536 characters and recognizes a complete exact ok line at stream start or after newline, accepting LF/CRLF. Overflow fails closed through the existing initialization failure path; no arbitrary tail is promoted into readiness. Absolute 1.5-second helper and 2-second outer budgets, polling, cleanup and final completion framing are unchanged. The real-zpty regression failed on unchanged production and passes after correction. Its fixture handles forced and naturally occurring splits without losing bytes, uses the original resolved Zsh, validates its whole source shadow and restores its environment. Focused lifecycle/completion, fast, strict repository-option test typechecking and read-only review pass. The existing clean-head canonical run completed successfully; the candidate and remaining gates are recorded above. Additive propagation, new-head canonical/security/Linux/Fish and all actual published CI must still follow.

The preceding pager-source family remains preserved below: Input c9fcbf9 and Queue 6739b30 passed their local/candidate/actual PR gates. Copy fe73f30ada1afa939e98860a96966e823dbb13ea failed canonical nativeCaptureLifecycle.test.ts:113 because recovery after an intentional startup expiry returned no capture-file candidate. Ranking and the pager case passed. Host driver 74808, publisher 63480 and Linux waiter 27626 exited naturally at that failed gate; no active test was interrupted and the VM never started. Neither failed canonical nor CI was rerun. Bounded original expiry/recovery controls passed with empty cache after expiry and a fresh recovered capture, which does not identify the historical failure cause. All failure logs remain retained. The framing correction addresses an independently confirmed defect; historical attribution remains unknown.

Evidence on T7: native-expiry-recovery-observed and native-readiness-split-correct-assembly log/result pairs; native-readiness-c9fcbf9…-red-0 and focused records; final-fixture focused/fast/typecheck records and native-readiness-6aba63b…-review.json. Initial diagnostic-only TypeScript interpolation and JavaScript replacement-template source-assembly failures, including their unsplit baseline failures, are retained separately and are not production evidence. The corrected control uses literal replacement callbacks and a complete shadow syntax check. Do not restart old failed drivers or the pager checkpoint updater with obsolete pins. Frontend freeze remains PENDING; integration stays separate.

Confirmed production corrections include secure runtime-directory validation, ordered held-client detach/kill cleanup, authenticated submission cwd, NO_COLOR restoration, foreground/replay ownership, safe early terminal preparation, stopped-input guards, catchable startup signal cleanup and instance-owned process-exit listener removal. The existing export redaction/clipboard security regressions remain intact. These independently proved fixes do not retrospectively attribute every historical failure.

Fresh exact final-head canonical, benchmark/security, full Linux/Fish 3.7, comprehensive candidate CI and all actual published PR CI must pass before acceptance. Previous-family green results remain evidence of those older commits. The owned VM is stopped while host verification runs; scratch/cache/build roots remain on T7. Physical terminal/clipboard QA is unperformed and remains explicitly required. Uncatchable SIGKILL helper cleanup and bounded redaction/clipboard/platform limitations are recorded honestly. Native/workspace #375–#378 and #383–#385 remain standalone and disconnected; canonical #370 Ruby/PHP is retained for later separately authorized integration.

TerminalApp.ts remains unfrozen. No release/master merge, tags, releases or integration occurs here.

Delivery status and owners

Phase A — interactive and copy foundations

Input awareness: show when a command is waiting for you #348 input awareness, implemented in draft; still needs physical acceptance. Flaky: Fish can lose keys typed right after a handed-over read returns #356 tracks the separate Fish post-read type-ahead race.
Command queue: prepare the next commands while one runs #357 native same-shell queue, implemented in draft, not a background-job manager.
Copy: selections, picker, sticky Copy; Smart Folding folds long output #358 copy selection/picker/sticky actions/status options, implemented in draft.
Smart Folding leaves large diagnostic output expanded; copying must never change folding #350 Smart Folding long-diagnostic fix and no-copy-expansion default, implemented in Copy: selections, picker, sticky Copy; Smart Folding folds long output #358, not merged.
Flaky: Fish can lose keys typed right after a handed-over read returns #356 Fish race: native reader/multiline/typing-after-read corrections and controlled regressions are in the draft ancestry; latest full Linux/Fish 3.7 and physical acceptance remain pending.

Phase B — reusable command information

Copy as Report: Markdown/plain diagnostic reports from command blocks, with review and optional redaction #351 Copy as Report — draft Copy as Report: reviewed Markdown/plain reports from command blocks #360 implemented; security acceptance in Diagnostic report and comparison security acceptance: exact reviewed text, safe rendering #363 must pass before ready/merged.
Compare output: diff two executions of a command #352 Compare output — draft Compare output: diff two runs of a command #361 implemented; hostile input/clipboard review covered by Diagnostic report and comparison security acceptance: exact reviewed text, safe rendering #363.
Diagnostic report and comparison security acceptance: exact reviewed text, safe rendering #363 report/compare security acceptance: open verification gate, not an assertion the latest code still has every reported vulnerability.
Output references and failure navigation: open file:line, copy paths/URLs/hashes, jump between failures #353 contextual output references + failure navigation: implemented in draft Output references, paste batches, queue conditions, pins and recipes #368; exact-head cross-feature and physical acceptance remain pending.

Phase C — reuse and staging

Paste batches, /ps and clipboard staging: review pasted commands and queue them together #354 shell-aware paste batches, /ps, ephemeral clipboard staging and privacy-safe suggestions: implemented in draft Output references, paste batches, queue conditions, pins and recipes #368; suggestions are off by default, metadata-only and frontend-local. Final acceptance remains pending.
Pins and recipes; queue conditions (manual approval step) #355 explicit pins, reviewed recipes and optional queue conditions/manual approval: implemented in draft Output references, paste batches, queue conditions, pins and recipes #368; no output-derived action executes automatically. Final acceptance remains pending.

Phase D — selective ecosystem integration

Workflow integrations: external editors, search, preview tools and shell utilities #366 integration decision tracker: Atuin, fzf/Television, Pueue, Yazi, delta/bat, zoxide, Gum. Audit existing support first; optional and safely degradable.

Companion platform/identity work (separate scope)

Expressive command lifecycle: restore, curate and integrate 600+ activity pairs #362 expressive activity vocabulary: implemented in draft Activity wording: Expressive and Classic, with a curated vocabulary #367 with Expressive/Classic settings, stable per-command selection and persisted choices. Latest canonical/CI and physical lifecycle acceptance remain pending.
NMSh Native module ecosystem and upstream module ports #305 Native modules program — existing 10 built-ins + 25 bundled pack entries at Release v0.18.0: Context Engine, Managed Agents & Workspaces #345's ref, not a 600-module requirement.
- Native module catalog: Starship / Oh My Posh coverage audit and prioritized ports #364 upstream Starship/Oh My Posh coverage audit and prioritized native ports.
- Module observability: explain visibility, provenance, collection timings and cache state #365 module explain/collection timings/cache/provenance diagnostics are implemented in draft Output references, paste batches, queue conditions, pins and recipes #368; exact last-frame width-compaction explanations remain deferred.
- Theme Bridge and semantic terminal integration #304 already owns external-theme translation/import and Theme Bridge; do not create a second implementation tracker.
- [Context Engine] Security, performance, hostile-workspace and physical QA #321 owns Context Engine security/performance/host QA.
Terminal-first workspace: sidebars, external workspace navigation and developer control surfaces #330 owns workspace navigation/sidebar/right panel, with Workspace Sidebar: keyboard-first resource navigation with explicit focus and activation #331–Future security/runtime: enforced isolation for executable NMSh Portable Mods #341 focused existing children. Do not duplicate those in this workflow stack.

Phase E — integration and physical QA

Check stacked PR branch ancestry and base targets; no force-push or mistaken PR auto-closures.
Full unit, typecheck, cross-shell real PTY, security and CI verification.
Narrow/NO_COLOR/Safe, host input ownership, folding/copy/queue/compare and restored transcripts.
Reviewed integrated QA branch/captures and honest limitations before merge.
Human approval required to merge to master, tag or publish.

Product constraints

No automatic execution from generated/copied/pasted/output-derived text; staging and queue review remain explicit.
No always-on clipboard-content history or automatic remote transmission.
Avoid permanent chrome, settings explosion, a second shell/multiplexer, and blanket ports of upstream modules.
No arbitrary workspace-supplied code execution in context discovery; documented, permissioned capabilities only.
Incremental, reviewable PRs with a clear owner for each unfinished feature.

Stabilization track started. Current published topology is unchanged: #345 → #348 → #357 → #358 → #360 → #361, with #367 and #368 as siblings. #369/#370 remain independent on #345. Existing worktrees are preserved; fixes are developed on uniquely named branches in nmsh-astra- worktrees.

Ownership: this track owns workflow/input routing in src/app/TerminalApp.ts until a tested stabilization checkpoint is posted here. Native-runtime and workspace work should keep using its separate branches and handoff documentation. #370 is the canonical native-runtime owner; any security patch to the duplicate in #368 will be reconciled at integration.

Initial CI evidence: #357 run 38071796100 fails Ubuntu Fish read input and typing-after-read tests. #368 run 38071808042 also fails Fish paste syntax, guide coverage, asynchronous batch/recipe assertions, and some live input tests. These are being investigated independently; no failures are being dismissed as flakes. No shared-file freeze or integration readiness is claimed yet. No merge to release/master is authorized.

Workflow stabilization progress; this is not the frontend freeze checkpoint.

Published Input awareness: show when a command is waiting for you #348 head: 684a3fbc837be97f185cc938f4fb13cbccf1533b, Actions 38122464924 succeeded. Its authenticated Fish reader handover is additive and does not change answersByDefault.
Local additive candidates: input 991f299c8aebf11e76193cd10ebc161c6f7a5662, queue 97e427079971a5c214c0601279f957c5e353e10a, output references/workflows 3097cbbfe98faac0eb0ea1a33897d4e5dc53ef92, vocabulary sibling d4619e4d719f912b7c8a71374a33012dbab175b9. Final publication/CI is pending; these are not advertised as green branch heads.
Reattach testing found host canonical echo during slow journal startup. The input candidate establishes raw input before probing/journaling and excludes running/startup input from key diagnostics. A real hidden Fish reader survives detach and slow-journal attach without exposing the answer.
Fish 3.7 parse-only checks on Ubuntu rejected Node's socket-backed stdin (Unable to read input file: Is a directory). Workflow verification now passes script data through --no-execute -c. Sentinel tests verify that neither commands nor substitutions execute.
Ubuntu 24.04 arm64, Fish 3.7, Bash 5.2, zsh 5.9 and Node 26.10: queueConditionsLive, pasteBatch, clipsLive, copyReportLive, compareOutputLive, inputPrivacy, moduleExplain, moduleManagerUx passed at the original deadlines. Earlier reader/queue/detach regressions also passed on Linux. This is headless verification, not physical terminal QA or the final amd64 Actions gate.
Remaining additions are implemented locally: bounded ephemeral clips, opt-in macOS clipboard change-count hints without background content reads, history-selected command pins, F8/Shift+F8 failure navigation, preview/cancel import regressions, and factual module source/cache/timing diagnostics. Diagnostic refinements and a Setup fixture readiness correction are currently uncommitted.
Full local verification remains a gate. One run passed all functional tests but failed the ranking deadline; another passed ranking but failed configured-completion startup and a Setup fixture that bypassed shell readiness. The completion file passed separately at unchanged deadlines; Setup now explicitly waits for readiness and verifies that blocked startup owns Enter. The current full run has also reported a Fish reader failure; its detailed failure is still being collected. No reproducible failure is dismissed as a flake.

TerminalApp.ts remains under stabilization ownership. Please continue independent native/workspace work and preserve the existing frontend boundary. No workflow merge to master/release or integration of unfinished feature heads is authorized. A separate exact-head/CI freeze checkpoint will follow after the remaining gates pass.

Bonjour — dans raiseCatError/notMyShell, scripts/demos/render.mjs:110 et src/ask/configAssist.ts:164 passent une entrée à un shell : motif à vérifier. Analyse statique, code non exécuté — motif, pas faille confirmée. Utile ? je détaille ; sinon j'ignore, sans relance.

Workflow stabilization progress; the shared frontend is not frozen.

Current additive candidates: input fix/workflow-cedar at 9465eb5; queue fix/workflow-birch at 8b25ad0; copy fix/workflow-amber at 05f8b03; report fix/workflow-coral at 768183b; compare fix/workflow-indigo at ce6f2f5; vocabulary sibling fix/workflow-willow at 0b2e886; output references/workflow fix/workflow-maple at 5756f7c. These candidates are local; their final publication and exact-head Actions gates are pending.
The combined workflow revealed three deterministic multiline-queue fixture failures: the optional batch action changed the expected paste-review footer. Correction 4636672 accepts that action while retaining whole-paste insertion, explicit queueing, same-shell state and once-only journal assertions. The original failure reproduced and corrected zsh/Bash/Fish real-PTY cases passed.
Security follow-ups: 5570d34 sanitizes restored labels in the comparison chooser header and makes invisible controls visible in authored review UI; 25af5ba keeps restored report status literal in Markdown. Focused unit and actual stand-in clipboard PTY regressions passed. Final cross-feature CI remains a gate; redaction remains best-effort.
Temporary resources disappeared during continuations, interrupting full runs; those runs are not passing evidence. Committed work was preserved. All owned worktrees, logs, VM disks and verification temporary storage now reside on T7 Shield, under neutral tree/color names.
Storage correction 9465eb5 adds explicit test-root selection, removes hardcoded fixture temp writes and makes optional key diagnostics respect the selected temporary directory. Typecheck, the affected lifecycle/privacy/platform/model tests and verify:fast pass. Full input canonical verification is running; the Ubuntu/Fish 3.7 VM is being prepared from the exact committed workflow head.
The other track's handoff remains unchanged. Native runtime additions still belong to Native modules: Ruby, PHP, .NET, Swift, Zig and Deno (#364) #370; the patched Ruby/PHP overlap is documented for eventual deliberate acceptance integration.

No master/release merge or frontend freeze is claimed. Physical terminal QA remains outstanding.

Workflow stabilization update; the shared frontend remains not frozen.

Published input head 86fb4e4 passed direct typecheck, full macOS canonical verification and Actions 38150534791: Ubuntu/macOS shards, Quality, Node 22 and aggregate checks. Timing/Fedora were skipped on the PR event.

The combined workflow passed full Ubuntu 24.04 arm64 / Fish 3.7.0 / Node 26.10 canonical verification at 5e45e87, including the unchanged suggestion timing threshold. This supersedes the failed run at 5756f7c.

A later queue canonical run at f081c42 failed its initial nested-path candidate assertion after about 1.5 seconds. Controlled slow completion initialization reproduces a bounded empty result and transport cleanup. Correction 566c321 keeps the production deadlines, prepares fixture-owned completion caches for functional path/cache assertions, and adds expiry/recovery coverage. It also gives test children a private home inside the selected temporary root, preventing home-relative shell caches from writing to the host home. The new home-isolation regression failed before the fix; affected lifecycle/completion checks and verify:fast passed after it.

Current local additive candidates:

input: fix/workflow-cedar / 566c321
queue: fix/workflow-birch / 2dd8b80
copy: fix/workflow-amber / 443eed5
report: fix/workflow-coral / 26a2a7f
compare: fix/workflow-indigo / c6d7514
vocabulary sibling: fix/workflow-willow / cd20d8a
workflow: fix/workflow-maple / 895aae5

Canonical verification is running again on these exact candidates, with tmux/screen installed in the disposable Ubuntu VM for previously skipped multiplexer cases. These new candidates are not yet published or advertised as green CI heads.

PR descriptions now distinguish historical checks from pending candidate gates and use Refs for issues needing physical QA. The other track's branches/handoff and the main checkout remain unchanged. No master/release merge, frontend freeze or physical validation is claimed.

@aarrtH8

@aarrtH8

7. Bonjour — dans raiseCatError/notMyShell, scripts/demos/render.mjs:110 et src/ask/configAssist.ts:164 passent une entrée à un shell : motif à vérifier. Analyse statique, code non exécuté — motif, pas faille confirmée. Utile ? je détaille ; sinon j'ignore, sans relance.

🇫🇷 Français

Salut, merci beaucoup pour le signalement ! J'ai regardé les deux emplacements sur la branche master actuelle, mais aucun ne semble transmettre directement des données non fiables à un shell. Cela dit, je n'ai pas encore exclu de problèmes dans les chemins d'exécution associés.

Si tu as plus de détails, notamment sur le chemin entre l'entrée et l'exécution, ou un scénario d'injection potentiel, ça m'intéresse ! Je serais ravi d'examiner ça plus en détail. Merci encore d'avoir pris le temps de regarder le projet !

🇬🇧 English

Hey, thanks for flagging this! I took a look at both locations on the current master branch, but neither appears to directly pass untrusted input to a shell. That said, I haven't ruled out issues in the surrounding execution paths.

I'd appreciate more details if you have them, particularly the source-to-sink path or a potential injection scenario. Happy to investigate further, and thanks again for taking the time to look through the project!

Workflow stabilization checkpoint in progress; TerminalApp.ts is not frozen.

The latest full runs remain recorded as failures:

macOS queue 2dd8b80: the same-shell fixture outlived its fixed holding sleep; the interrupt fixture signalled before actual foreground ownership; two frontend startups produced no bytes before their existing deadlines; the bounded zoxide query also timed out.
Ubuntu workflow 895aae5: ranking and installed multiplexer tests passed, but SIGHUP's third-shell fixture used the visible composer as shell readiness.

Corrections 48a0ded and e2adc1e use authenticated shell readiness, a release-file queue gate, and actual foreground ownership before Ctrl+C/Ctrl+Z. The focused SIGHUP case and zsh/Bash/Fish same-shell queue plus interrupt cases passed. Production deadlines and security checks are unchanged. This 8 GiB host also had concurrent unrelated builds and substantial load; those processes were preserved. Verification now uses one host test worker with this track's Linux VM stopped, followed by a separate Linux run.

Module diagnostics correction 52db115 makes all detail rows reachable in short terminals using arrows and PageUp/PageDown. Direct typecheck, 25 focused unit/real-PTY cases (including 50-column NO_COLOR Safe) and verify:fast passed. This does not collect new facts or persist viewport state. Exact last-frame surface compaction remains documented for acceptance integration.

Current additive candidates:

cedar-input: 48a0ded
birch-queue: 3adc451
amber-copy: 000736d
coral-report: 80bd0cf
indigo-compare: 0117a34
willow-vocabulary: be037a0
maple-workflow: 1007f71

The full failing-file rerun and new canonical gates are still pending. The published #348 head remains 86fb4e4 with successful Actions 38150534791; none of these new heads is claimed CI-green. Existing PR dependency order, both independent siblings, the other track's branches/handoff and the main checkout were preserved. All task temporary writes, test resources and logs are on T7 Shield; owned names are neutral and additive commit messages carry no attribution trailers.

No master/release merge, frontend freeze or physical validation is claimed.

Workflow preservation checkpoint — 2026-10-12

Development stopped at the user's request. Not a frontend freeze or release-ready checkpoint.
No new full suite started; no PR merged, force push/rebase or protected worktree modification.

Durable fresh-session handoff.
Canonical ledger updated on the same pushed branch.

All eight checkpoint refs pushed under neutral names:

Branch	Exact pushed head
fix/workflow-amber	`000736d`
fix/workflow-birch	`3adc451`
fix/workflow-cedar	`48a0ded`
fix/workflow-coral	`80bd0cf`
fix/workflow-elm	`5447eb9`
fix/workflow-indigo	`0117a34`
fix/workflow-maple	`cc85370`
fix/workflow-willow	`be037a0`

Elm 5447eb9 preserves incomplete acceptance tests, based on Maple e942523; not merged into Maple/published feature PRs.
Full local canonical: Cedar 48a0ded passed (2149 runtime + 8 ranking); Birch 3adc451 passed (2176 runtime + 8 ranking).
Amber 000736d full canonical failed (2200 passed / 3 failed; ranking 8 passed): two cleanup ownership probe timeouts plus zero-output canonical frontend startup timeout. Focused compatibility rerun passed; does not erase full failure. Host resource pressure observed; flakiness unestablished.
Last Elm focused command: node /Volumes/nmsh-t7/run-selected.mjs "$PWD" tests/queueConditionOwnershipLive.test.ts tests/queueConditionsLive.test.ts tests/outputReferencesLive.test.ts tests/historyReuseLive.test.ts tests/compatibilityHarness.test.ts --test-reporter=spec: 15 passed / 4 failed. Reference test final explicit draft submission timed out; zsh/Bash/Fish queue tests failed final NO_COLOR assertion on restored colored rows. Subsequent transcript assertions not reached.
Input Input awareness: show when a command is waiting for you #348 published 48a0ded: Actions 38157687343 failed macOS shard 1/2, flowComposer.test.ts / posix_spawnp failed. Both Ubuntu shards, other macOS shard, Quality and Node 22 passed. Aggregate wrappers failed/cancelled; timing/Fedora skipped. Older green run historical.
Coral/Indigo/Willow/Maple exact-head host suites, current full Ubuntu Fish 3.7 and final exact-head stack CI pending. Remaining original feature PR heads deliberately preserved; checkpoint branches contain candidates.
Flaky: Fish can lose keys typed right after a handed-over read returns #356 open: confirmed Fish reader/parse transport fixes in pushed ancestry; current CI failure is macOS PTY spawning, not an established Fish routing diagnosis.
TerminalApp.ts remains exclusive workflow ownership. No frontend freeze. Native/workspace wiring awaits explicit verified Epic: terminal workflow initiative (make one command's result useful for the next) #359 freeze. Protected Docs: context, native modules and workspace integration handoff #385 heads advanced; recorded, untouched.
Ruby/PHP overlap retained/security-patched on candidate; Native modules: Ruby, PHP, .NET, Swift, Zig and Deno (#364) #370 canonical owner. Both tracks must freeze before nonrelease integration. Preserve Activity wording: Expressive and Classic, with a curated vocabulary #367/Output references, paste batches, queue conditions, pins and recipes #368 siblings; merge highest frozen ancestry once, retain security regressions. No master/release merge authorized.
Physical Ghostty/Terminal.app QA outstanding. Module observability: explain visibility, provenance, collection timings and cache state #365 exact last-frame width-compaction explanation incomplete. Workflow integrations: external editors, search, preview tools and shell utilities #366 Pueue/Yazi deferred; embedded Gum rejected.

All source, incomplete tests and recovery commit ancestry are on GitHub. Raw logs, caches, helper runner and stopped Linux VM remain local on T7 Shield; important failure evidence and exact reproducible commands are copied into the handoff. No personal provider config changed.

Next phase: read handoff, audit current heads/ownership, investigate recorded failures with focused evidence, complete exact-head gates before any freeze. No further implementation in this checkpoint session.

Workflow stabilization resumed from the preserved checkpoint. All eight fix/workflow-* remote heads match the canonical handoff; existing T7 worktrees and main checkout are preserved. No protected native/workspace branch has been changed.

Controlled single-worker reproduction on macOS/Node 26 reproduced all four Elm failures:

Restored command/status rows replay saved truecolor styling after reattach with NO_COLOR: confirmed production presentation bug. A failing transcript regression now passes with the localized presenter correction; raw program SGR and serialized transcript bytes are explicitly preserved (22 affected tests and source build passed).
Reference draft submission: confirmed fixture focus assumption. Enter still belongs to the focused historical block and opens its action palette. The corrected fixture proves this does not execute the draft, explicitly returns focus with Esc, then submits exactly once; real PTY regression passed.

PTY startup/cleanup investigation continues. The historical posix_spawnp failed log has no errno/resource snapshot, so its root cause is not yet established. Old canonical failures remain failed evidence. Final canonical, latest published-head CI, current Linux/Fish 3.7 and security acceptance are still pending. TerminalApp.ts remains workflow-owned; no frontend freeze or integration authorization is declared. Physical QA remains outstanding. No master/release merges, history rewrites or release actions.

Stabilization progress: #348 now publishes bf8414d6b20531016e01d6cf2fc1a08528d51ed3, preserving the previous input head additively. Exact-head macOS canonical verification passed (runtime + ranking, no failures/skips), and Actions 38199474938 passed Ubuntu/macOS shards, Quality, Node 22 and aggregate checks. PR evidence was rewritten around this head. Historical spawn failure at 48a0ded did not recur in controlled files or its unchanged-head CI rerun; original cause remains unestablished.

Elm's preserved acceptance cases passed 19/19 without assertion/deadline weakening and were incorporated into Maple. Restored authored NO_COLOR rows are corrected; raw PTY styling/transcript bytes are preserved. Reference acceptance explicitly returns historical block focus to the composer before submitting its preserved draft.

Current security inspection also reproduced post-format redaction consuming Markdown delimiters, zero-body short reviews, and extreme-width review clipping. Additive report/comparison corrections have failing-to-passing regressions and are independently propagated to both siblings; #363 records details. Focused inspection confirmed source-fragment redaction, stable comparison snapshots, exact Enter text, short-body reachability and bounded Unicode geometry. Later heads still require canonical/real-PTY/CI gates.

Seven candidate canonical suites are serialized with one host worker, private T7 roots and the owned Linux VM stopped. Current queue run is in progress; no new full-stack acceptance is claimed. Both sibling branches, all history, protected native/workspace resources and main checkout are preserved. TerminalApp.ts is not frozen. Current full Linux/Fish 3.7 and later exact published-head CI remain pending; physical QA remains outstanding. No master/release merge, tags or releases.

Current published workflow gates:

PR	Published head	Local canonical	Latest-head CI
#348	`bf8414d`	passed	38199474938 passed
#357	`7b9de87`	passed	38200373126 passed
#358	`c8cfa1f`	passed	38201127848 passed

Each publication is an additive fast-forward of the original feature branch; PR descriptions now cite these exact heads. Amber's old startup/ownership cases passed inside the new full run, with deadlines/checks retained. Their original cause remains unestablished, and earlier failed evidence is retained.

The report/comparison security pass also fixed post-format redaction consuming Markdown boundaries, short/extreme-width reviewability, and argument-limit crashes from backtick-rich data. Details are in #363. Original acceptance regressions and new security failures were observed before corrections. Corrected report d12d23b canonical is running alone; the older report source was allowed to finish unchanged, and only the owned serial-loop parent is paused until this corrected gate finishes. The later comparison/vocabulary/workflow heads will then run serially, followed by the stopped owned Linux/Fish 3.7 VM. No active suite's source was changed.

Frontend boundary documentation is prepared as a pending draft. No frontend freeze yet. Both siblings and all preserved history remain independent; protected native/workspace worktrees and main checkout remain untouched. No release/master merge, tags, releases or human validation are claimed.

An additional full-run failure was retained at report head dd9aa85: native capture cleans its PTY and root after abrupt frontend death timed out after its original 8-second cleanup budget, with transport absent, innerAlive=true and no process found by ps. The later report d12d23b canonical passed, but its formatter correction could not explain this lifecycle result, so verification progression was stopped for investigation.

Controlled investigation reproduced a fixture defect: the native helper publishes/rewrites its PID file; the fixture accepted an empty file as Number('') === 0, then process.kill(0, 0) reported the current process group alive. A real-helper interposer held this rewrite window, and the original observation failed the valid-process-identity assertion. Correction 9fb09c9 waits for a safe positive PID before observing/signalling cleanup, keeps startup/cleanup budgets unchanged, and adds the PID to failure diagnostics. All eight focused lifecycle tests passed, including native/configured abrupt-death checks and the controlled rewrite regression. Production helper behavior did not change.

The original failure omitted the numeric inner PID, so the rewrite race is a confirmed fixture defect consistent with its signature, rather than conclusive attribution of that historical run. A genuine positive-PID cleanup failure still fails the original deadline and is now better diagnosed.

The fixture correction is propagated additively to comparison and both siblings. Four final canonical candidates are running serially, beginning with corrected report 9fb09c9; first three published feature heads remain canonical/CI green. Current full Linux/Fish 3.7 and final later-head CI remain pending. TerminalApp.ts remains workflow-owned; no frontend freeze or physical validation. No protected branches/worktrees or release/master history modified.

All seven final workflow source heads now have clean serialized macOS npm run verify results, including both independent siblings. The eight checkpoint refs were published with ordinary fast-forward pushes; no branch history was rewritten or release/master merge performed.

Latest sibling heads: #367 3616b9e7819878762e9918061c82ba8cc06bdad9 (CI green: https://github.com/raiseCatError/notMyShell/actions/runs/38232402817); #368 and Elm acceptance 279aa24a8bdbe2ff20ea7e08f73ca0fce47ba778 (CI running: https://github.com/raiseCatError/notMyShell/actions/runs/38232405996).

The existing isolated Linux VM is running full canonical verification of exact Maple 279aa24 with Fish 3.7.0, zsh 5.9 and Bash 5.2, one worker. No physical QA is claimed.

Comparison #361 CI attempt 1 at exact 15644abd8c8ddcad216a5b5c9be6b046e578489f failed its Ubuntu fullscreen reattachment test: the fixture received REDRAW 28 90 rather than REDRAW 33 90. This is being investigated with replay/resize diagnostics; the complete original log is retained. Failed jobs are rerunning on the unchanged head. This is not classified as harmless or attributed to resource starvation without evidence. Deadlines and expected geometry are unchanged.

The frontend gate remains pending Linux completion, latest-head CI and the fullscreen investigation. Integration has not started.

Maple CI 38232405996 failures on macOS and Ubuntu were the same confirmed fake-clipboard publication race: the capture file became empty on truncation, and the test treated any change from UNCHANGED as a completed copy. A controlled held-input probe proved this false completion. Fixture 88f42bf publishes complete bytes by rename; exact assertions and deadlines are unchanged. Its focused reference acceptance passed and canonical host verification is running.

The separate fullscreen failure at comparison 15644abd passed unchanged-head CI retry, full Linux/Fish 3.7 acceptance and six isolated instrumented host runs, but these do not prove its historical cause. Inspection and a controlled held-save regression identified a real foreground handoff risk: initial durable journal IO could delay terminal entry/full-size resize while replayed program output was already visible. Correction c31322a starts the journal before input, lets renderer handoff/full resize proceed without awaiting IO, and preserves serialized saves, durable acknowledgements and shutdown persistence. The old ordering failed the held-save regression; the correction passes geometry/input/ack/shutdown assertions, existing journal tests and source build. Read-only review found no important regression. The exact historical CI blocking phase remains unknown.

The fix is being incorporated additively into both independent siblings. All three affected frontend heads will get fresh serialized canonical verification, latest-head CI and exact Maple Linux verification before the freeze. No deadline inflation, no ownership-check weakening, no master/release merge, and no physical QA claims. Integration remains separate and unstarted.

Current verification checkpoint (2026-10-14): References candidate fd4daf8fb26de8a3ca73b709f545fbed7d665488 passed the full Linux core suite on Node 26.11.1 with Fish 3.7.0, Zsh 5.9 and Bash 5.2.21. The separate history-ranking group failed its existing 60 ms ceiling with p95 86.3 ms. Therefore overall Linux canonical is FAILED, not accepted. The driver stopped normally at that gate and shut down only the owned VM. Vocabulary and Node 22 stages were not executed; the guest Vocabulary clone remains at 0dbd527ccca7db74bee57fa9afda1c744d516baa while the References clone is clean at fd4daf8. The ranking implementation and test are unchanged from the preceding passing b43b255 source. This rules out a ranking-code delta between those heads, not a production performance issue or resource cause.

The original Copy 0ab5bdc and Report 7af27b1 Mac canonical startup failures remain held and unattributed. A complete Copy suite with a private failure-only stack observer passed; it captured no failed wait and is diagnostic evidence, not replacement canonical acceptance. Module identity checks confirm that observer attached to the helper class used by the original tests. Source, assertions and deadlines were unchanged. A normal external process observer is prepared for remaining host heads, with a stopped-VM guard and no input injection or retries.

At exact fd4daf8, benchmark script typechecking and focused report/compare/clipboard unit plus real-PTY acceptance PASS, with strict cleanup and no leftovers. The latter uses substitute clipboard backends and does not establish physical clipboard/editor/terminal QA. Existing pattern-based redaction and irreversible external-backend limitations remain. Bounded timing smoke completed with exit 1: configured cold completion returned no candidates at scripts/benchmarks.ts:267. Preceding platform readiness and context timing checks passed. The log/result remain preserved; this failed gate is not accepted. Later host canonical and all later candidate/actual PR CI are pending. No source fix was guessed, no branch was promoted, and neither sibling was folded into the other.

The unchanged-budget Node 26/Node 22 ranking comparison is prepared but did not start: the existing VM guard requires at least 35% memory free, while measurements were 34% and then 32%. Disk guards passed (about 5.4 GiB internal and 5.8 GiB mounted T7 free). The VM remains stopped. No shared workload, cache or other owner's resource was modified. Independent host checks continue; Linux ranking, latest Vocabulary and Node 22 remain blocked until the resource guard passes. Frontend freeze remains PENDING.

Evidence on T7: native-readiness-independent-linux log/result/start/stop records; amber-copy-native-readiness-0ab5bdc…-full-startup-observed-control diagnostic records; copy-startup-observer-module-identity-result.json; maple-workflow-native-readiness-fd4daf8…-{bench-typecheck,security-focused} records. The failed canonical records remain immutable. The prepared ranking comparison retains the original dataset and p95/load ceilings and adds per-buffer/resource observations only.

The corrected durable checkpoint is pushed as 928aabac403ead9226199b3b772f79cb8afa4098.

Input Input awareness: show when a command is waiting for you #348 6aba63b and Queue Command queue: prepare the next commands while one runs #357 5ab9892 retain their recorded clean-head canonical, comprehensive candidate CI and actual published-head CI passes.
References candidate fd4daf8fb26de8a3ca73b709f545fbed7d665488: Linux core, benchmark typecheck and focused report/compare/clipboard acceptance pass; full Linux canonical fails ranking p95 86.3 ms against the unchanged 60 ms ceiling. Timing smoke separately fails configured-cold completion returning no candidates.
Copy 0ab5bdc and Report 7af27b1 Mac canonical startup failures remain held and unattributed. Narrow controls, a full diagnostic Copy suite and a default-budget configured-cold control passed without identifying their causes. They do not replace failed acceptance records.
The ranking comparison did not start: the immediate VM guard still measured 32% memory free against the unchanged 35% requirement. The owned VM remains stopped; no shared workload or resource was altered.
Compare a86ada3d891a0eb14a7799075323cc1ca6f3150a normal clean-head canonical is now the sole heavy workload, with bounded external samples of owned long-lived frontends. Source, assertions, input and deadlines are unchanged. Remaining host, CI, Linux/Vocabulary/Node22 and physical QA are pending.

Frontend freeze remains PENDING. No source fix was guessed, no original branch was promoted and no integration or protected-branch merge occurred.

Latest serialized verification checkpoint (2026-10-14): the untouched original ranking group passed at References fd4daf8fb26de8a3ca73b709f545fbed7d665488; Linux Vocabulary/activity/lifecycle/native-completion checks passed at independent sibling cb25f7310231864409a85e08c6c3b9d8a20b22a8; curated Node 22.23.3 compatibility passed at fd4daf8, with the expected macOS-only window-integration skip. Both guest clones are clean. The resource guard passed at 43% before the run; only the owned VM was started and it stopped normally. The preceding full Linux core pass plus this separately verified ranking group cover the current canonical test groups, but the initial failed overall canonical record is retained and not rewritten into success.

Before the untouched ranking run, original-budget controlled comparisons measured Node 26 p95 14.55/15.73 ms and Node 22 p95 17.38 ms on the unchanged dataset/source. Per-query and guest-resource observations are retained. These demonstrate that this source can satisfy the ceiling, not the precise cause of the original 86.3 ms failure. No budget, deadline or assertion was changed.

Compare a86ada3d891a0eb14a7799075323cc1ca6f3150a normal clean-head canonical completed with exit 1. Its live comparison reached the UI and verified the expected copied bytes, then failed the success-notice wait because NMSh reported Clipboard copy failed. The streaming compatibility fixture separately missed its initial prompt deadline with zero output. Ranking passed. Bounded owned-frontend sampling yielded no usable failed-startup stack: one sample attempt timed out, another produced no surviving file, and the surviving report has no call graph. These are incomplete observations, not evidence of healthy startup. A targeted clipboard-writer control using the identical substitute backend and default three-second budget passed all requested writes with exact bytes and successful owned-child completion. It does not clear or attribute the live failure.

Input/Queue accepted progress remains unchanged. Copy/Report/Compare Mac canonical and References timing-smoke failures remain held and unattributed. References exact-head benchmark typecheck and focused report/compare/clipboard acceptance pass; physical clipboard/editor/terminal QA is unperformed. Vocabulary and References host canonical, later comprehensive candidate and actual PR CI, and final reconciliation remain pending. Frontend freeze remains PENDING. No source fix was guessed, no original PR branch advanced, neither sibling was folded into the other, and no integration or protected-branch merge occurred.

Evidence on T7: ranking-fd4-linux-controls and native-readiness-linux-remaining log/result/start/stop records; indigo-compare-native-readiness-a86ada3…-canonical log/result; compare-clipboard-a86-observed-control log/result/events. All older failures remain immutable. The next step is serialized normal host canonical verification on Vocabulary and References, while investigating the unresolved startup/clipboard/timing failures with original acceptance requirements intact.

Clipboard/startup correctness checkpoint (2026-10-14): Vocabulary cb25f7310231864409a85e08c6c3b9d8a20b22a8 clean-head canonical completed with exit 1. Both early less/vim cases failed before submission while waiting for a transient composer; the real frontend instead displayed the intended blocked-startup screen. Usable owned-process samples and complete failure output are retained. Delayed-journal controls reproduced this incorrect fixture assumption at the original twenty-second deadline. References host canonical was not started by that stopped driver.

Copy now contains two additive local commits: clipboard lifecycle fix 8723a119433377bcd912cd16ced4a67386a5ac36, followed by startup fixture correction ece9b81c8c4a5787e748aa5d7ab933272db6eb57. A real-child control completed actual EOF and copied exact bytes, then delayed only the JavaScript final callback until backend exit. Node destroyed stdin before emitting exit, suppressing finish; the old writer timed out at the unchanged three-second deadline. The fix requires an error-free payload-write callback and backend exit zero, calls end() immediately, and preserves process/stream errors, timeout and owned-process cleanup. Real-child regression failed before the fix and passed afterwards. Partial-read, callback-error-after-exit, existing EPIPE, timeout, UTF-8, selection-owner and live-copy regressions pass. This proves the controlled lifecycle defect, not attribution of the historical live clipboard failure; five unchanged live controls passed without reproducing it.

The early fullscreen fixture now submits through the actual editor/submit pipeline before the startup notice, with pending-command and foreground-ownership witnesses. Normal and delayed-journal less/vim cases retain answered-file, actual q/Ctrl+C, exit 130, session removal, shell-exit and strict cleanup assertions. Separate automated real-PTY early-typing coverage remains unchanged; this is not human terminal QA. Focused tests, fast verification, strict test/fixture typechecking and review pass. The initial test-only overload typecheck failure is preserved separately and corrected.

Clean-head normal canonical verification is running on Copy ece9b81; it is the sole heavy workload and the owned Linux VM remains stopped. These commits are not yet published or accepted. Input/Queue accepted heads remain unchanged; downstream local heads still require deliberate additive propagation and their new-head gates. All preceding startup/clipboard/timing/CI failures remain preserved; no deadline, budget or acceptance assertion was weakened. Current Linux/Fish 3.7 and Node 22 evidence remains scoped to fd4daf8/cb25f73 and will require reconciliation after propagation. Frontend freeze remains PENDING. Physical QA is unperformed; no integration or protected-branch merge occurred.

Evidence on T7: compare-clipboard-a86-held-final-control log/result/events; compare-clipboard-a86-live-events-control records; startup-early-ownership-delayed-oracle-red; clipboard-lifecycle-boundary-{red,green}; startup-and-clipboard-correctness-green; clipboard-startup-correctness-{fast,strict-tests-v2}; clipboard-lifecycle-final-focused; clipboard-startup-correctness-commits.json. Failed canonical records are immutable. Next: reuse the running Copy result, then continue guarded propagation, exact-head canonical/CI and remaining timing/security/clipboard/Linux acceptance.

Durable handoff: https://github.com/raiseCatError/notMyShell/blob/da3af161c7cbaf588975f9292caabd780312dfcd/docs/development/workflow-stabilization-handoff.md

Discovery gate checkpoint (2026-10-14): Copy ece9b81c8c4a5787e748aa5d7ab933272db6eb57 clean-head canonical completed with exit 1. Clipboard, startup ownership and ranking passed, but worktreeDiscovery.test.ts expected 101 entries and received 93 in its original 100-linked-worktree fixture. The failure occurred at the count assertion; it is not recorded as a performance-ceiling failure. The discovery implementation, parser, runner, fixture and test are unchanged from published Copy ce6cee1. No worktree production code was modified and no resource/flake attribution is justified by this result.

Three original-dataset controls passed with all 101 records and status calls, concurrency at most eight and the original deadlines. A complete unchanged-file shadow with transparent Git-result observation also passed, including all preceding fixtures. These controls do not clear the failed canonical gate. A subsequent failure-only evidence commit 839d23f3bfb780c164b3fa19137170944abe0d21 retains the raw Git list, failed-probe results and setup/discovery timings if the original assertion fails again. Every count, concurrency, timing and cleanup assertion remains intact. Focused discovery tests, strict typechecking and fast verification pass. This diagnostic change does not claim to fix the discovery failure.

Normal clean-head canonical is now running on Copy 839d23f; the previous ece9b81 record remains failed and immutable. Downstream local propagation, candidate publication and actual PR promotion remain held by the canonical guard. Neither sibling was changed. Input/Queue accepted progress remains unchanged; later exact-head CI, final timing/security/clipboard/Linux/Fish 3.7/Node 22 and physical QA remain outstanding. Frontend freeze remains PENDING. No integration or protected-branch mutation occurred.

One full-file control preflight failed the unchanged combined disk guard before creating any run log or starting tests. A fresh check subsequently passed (about 5.0 GiB internal and 5.6 GiB mounted T7 free), and only the previously unstarted control then ran. The rejected preflight and follow-up are separately recorded; no cleanup, guard change or interruption occurred. The owned VM remains stopped during host verification.

Evidence on T7: amber-copy-clipboard-startup-ece9b81…-canonical failed log/result; worktree-100-ece9b81-observed-control and per-round raw-list/metadata records; worktree-discovery-ece9b81-full-observed-control log/result/events; worktree-full-control-resource-guard-first-attempt.json; worktree-discovery-failure-context-{focused,strict,fast} and worktree-discovery-failure-context-commit.json. Next: reuse the running 839d23f canonical outcome; inspect retained layer evidence on recurrence. Do not restart obsolete drivers or replace earlier failed results with controls.

Durable handoff: https://github.com/raiseCatError/notMyShell/blob/2d7e80837faad4f896423396b237e6ee9be51a06/docs/development/workflow-stabilization-handoff.md

Additive propagation checkpoint (2026-10-14): Copy 839d23f3bfb780c164b3fa19137170944abe0d21 passes normal clean-head canonical build, full runtime suite, ranking, cleanup and diff checks. The preceding ece9b81 discovery failure remains failed and unattributed; a later pass does not reconstruct its cause. The corrected Copy candidate was pushed nonforce to fix/workflow-amber; comprehensive exact-head CI 38565279297 is running on its first attempt. Original Copy PR #358 remains at ce6cee16a53a44d03d906d0af6db41f796defa3d until candidate CI and parent acceptance permit guarded promotion; actual new-head PR CI must then pass independently.

The fixes are incorporated additively into local Report cb28d4586197e563e4f98c1f0a96e9e3b8f95251, Compare f1abe217c6a27034a93182bf423dfb45e18ef73d, Vocabulary 5009033c553c882c27a9aeb5a136323637ab302f, and References/Elm 2395dad5b52895fe041d93d2c75123b25f6669fe. Every two-parent merge and affected blob was checked. A full-file equality guard correctly paused at References' existing clipboard reader addition; the exact updated writer plus byte-identical prior reader was then verified. No feature was dropped, no merge was repeated or undone, and neither sibling is an ancestor of the other. Elm advanced only by a checked fast-forward. Other original feature/fix remotes remain at the previously recorded heads.

Report focused clipboard/startup/live-copy/native lifecycle verification passes with strict cleanup; its clean-head canonical is the sole active local heavy suite. The driver serializes Compare, Vocabulary and References gates afterwards, stopping rather than replacing a failed result. Final References benchmark typecheck, current-head report/compare/clipboard acceptance and timing smoke are still required. The prepared full Linux/Fish 3.7 and Node 22 driver reuses only the owned stopped VM, strict-forward guest clones and unchanged package locks; it refuses to overlap host verification. Earlier Linux/Node 22 passes are evidence of their earlier pinned heads, not acceptance of these new commits.

Input/Queue accepted original heads remain 6aba63b/5ab9892. Later comprehensive candidate and actual PR CI, final cross-platform/security/clipboard reconciliation and physical QA remain pending. Frontend freeze remains PENDING. No integration, release/master merge, unrelated feature or other owner's resource was modified. All historical failure evidence is retained.

Evidence on T7: Copy amber-copy-clipboard-startup-839d23f…-canonical log/result; post-handoff-clipboard-startup-candidates.json; clipboard-startup-local-promotion.jsonl and clipboard-startup-local-propagation-reconciliation.json; clipboard-startup-amber-candidate-publication.json; Report exact-head focused log/result. Next: reuse existing CI and running serialized gates, investigate any failure without deadline/budget changes, and promote original branches only through the recorded ancestry and CI guards.

Durable handoff: https://github.com/raiseCatError/notMyShell/blob/5c54cdf6a2cc908616ee0132ff4152f0c038dd97/docs/development/workflow-stabilization-handoff.md

Published Copy acceptance checkpoint (2026-10-14): original PR #358 and fix/workflow-amber are now both 839d23f3bfb780c164b3fa19137170944abe0d21. Clean-head canonical, comprehensive candidate CI 38565279297 and actual published-head PR CI 38566317316 all pass. Both CI runs passed on attempt 1; the candidate run passed Fedora and both platform timing jobs as well as runtime/quality/aggregate checks. Nonforce promotion checked the original ancestry and accepted Queue parent. PR #358's description records the current behavior, exact evidence, retained failures and unperformed physical QA. This accepts Copy's current automated track gates, not the whole frontend freeze.

Report cb28d4586197e563e4f98c1f0a96e9e3b8f95251 passes clean-head canonical and focused verification. Its fix branch was pushed nonforce; comprehensive candidate CI 38567509019 is running. Original Report remains gated until this result, accepted Copy parent and its own actual-head CI pass. Compare f1abe217c6a27034a93182bf423dfb45e18ef73d focused verification passes and canonical is running; Vocabulary and References follow serially. No additional local heavy suite or VM overlaps this work.

The accepted original automated tracks so far are Input #348 6aba63bd78f467af8aeaf60421faef05c608646b, Queue #357 5ab9892060fb0aed2d89f34842a9739c6e860163, and Copy #358 839d23f3bfb780c164b3fa19137170944abe0d21. All later track gates and final current-head benchmark/security/clipboard/full Linux/Fish 3.7/Node 22 reconciliation remain required. Every earlier failed canonical and CI record remains preserved and unattributed where no controlled reconstruction exists. Frontend freeze remains PENDING. Physical QA is unperformed. No integration, protected-branch mutation or unrelated work occurred.

Next: reuse the existing serialized host and CI drivers; advance originals only after their exact local/candidate/parent/actual CI gates pass. Final References/Elm and Vocabulary remain independent siblings above Compare. The owned Linux VM stays stopped until host verification finishes.

Durable handoff: https://github.com/raiseCatError/notMyShell/blob/937d932c266f121885afb5209a0642b7ea82e86b/docs/development/workflow-stabilization-handoff.md

Report/Compare gate checkpoint (2026-10-14): original PR #360 and its fix branch are both cb28d4586197e563e4f98c1f0a96e9e3b8f95251. Clean-head canonical, comprehensive candidate CI 38567509019 and actual published-head PR CI 38568288217 pass, with both CI runs on attempt 1. Its PR description is current. The earlier failed Report runs remain preserved; these passes do not attribute their causes.

Compare f1abe217c6a27034a93182bf423dfb45e18ef73d also passes focused and clean-head canonical verification. Its fix branch was pushed nonforce and comprehensive candidate CI 38569811366 is running; original Compare remains gated by candidate/parent/actual-head CI. Vocabulary 5009033c553c882c27a9aeb5a136323637ab302f focused verification passes and canonical is now the sole active local heavy suite. References/Elm 2395dad5b52895fe041d93d2c75123b25f6669fe remains the independent sibling, queued for its own host and final benchmark/security/clipboard gates.

Input, Queue, Copy and Report now have accepted original automated track gates on their exact heads. Frontend freeze remains PENDING: later exact-head CI, References/Vocabulary host verification, final full Linux/Fish 3.7/Node 22 and acceptance reconciliation remain required. Physical QA is unperformed. The owned VM is stopped; no integration or protected-branch change occurred. Historical failure records and original assertions/deadlines remain intact.

Durable handoff: https://github.com/raiseCatError/notMyShell/blob/75b4ff42cf28f322357d6d632961d30e9c70418a/docs/development/workflow-stabilization-handoff.md