[ScriptedAlchemy]

Session identity collision repair — Refs #4220 (2026-11-09)

Commit 9949ead fixes a real provider-identity misrouting defect in Sessions → Loom (and Delivery → Loom) links. A legitimate provider-unknown session ID such as ["claude","victim"] was emitted as an unqualified loomSession parameter; Loom parsed any JSON two-string array as a provider-qualified lane, silently opening another session. The existing ambiguity refusal did not protect this shape.

Provider-unknown links now carry a separate loomBareSession ID. Loom resolves it by exact session ID without inventing a provider, while known-provider links and old valid loomSession URLs retain their existing behavior. On scene selection, the bare parameter is cleared so it cannot override the newly selected qualified lane. No changed backend authorization, session persistence, or renderer authority.

Falsifiable tests added: URL parse/resolve distinguishes a JSON-shaped literal from the matching foreign lane; Sessions pivot unit and clicked DOM links preserve the literal; LoomPage DOM with two conflicting sessions must open the actual ID rather than the other provider. All seven scoped files and the exact one-parent non-force head were independently reviewed. Eight isolated executable Node URL/selection mechanism assertions passed, including reproduction of the old misroute. These are not execution of the committed React/Vitest tests. Current-head pnpm dashboard typecheck/Vitest, browser journey, and applicable CI still require verification. This is Refs #4220, not full tracking-issue acceptance or merge approval. Leave the PR ready for review but unmerged until verified.

---

Latest focused session-pivot correction — Refs #4220

Commit b85c686 restores the actual Sessions → Loom navigation link when a recorded session has no provider. Previously sessionHref('loom', {provider:null, ...}) already produced a supported bare-ID deep link, and Loom's canonical resolveLoomSession returned an explicit ambiguous/outside-page state without guessing a lane, but the visible SessionPivots component hid the link. This left provider-unknown transcript/search selections unable to reach the supported Loom view.

The new DOM regression exercises clicking the formerly absent link, checks the resulting URL, verifies provider-qualified project-scope identity and forbids self-links or fabricated provider values. The original provider-null navigation assertion fails before this change. Only SessionPivots.tsx and a new SessionPivots.dom.test.tsx changed in this commit; no renderer, route, store, source identity or permission changes.

Validation boundary: five isolated executable Node selection/URL assertions passed, and the two-file commit, parent and guarded force=false ref were independently verified. These checks are not in-repository Vitest/React execution; pnpm, repository checkout and native Bazel are unavailable locally. Hosted exact-head dashboard/CI and registered-project browser acceptance still need verification; prior CI results do not validate this head. This is Refs #4220, not full issue closure. Do not merge until current-head review and applicable CI pass.

---

Current stack and verification

At 0c72f7b7ea, the diff against the draft MCP fixture #4845 contains only the five dashboard files. Their Git blobs match the earlier full Linux and dashboard pass at 17bf3813b9. On the new head, dashboard typechecking, the production bundle, and all 2,263 dashboard tests passed. An initial parallel run timed out two compiler-diagnostics cases during host load; all 16 codegen cases passed separately, and the complete suite passed with three workers and the existing timeouts. Full hosted CI is running. A real Chrome keyboard journey opened the production palette, checked focus and resolved ARIA option identity, preserved the exact Brain, Loom and Code deep links on reselection, and navigated by task description to Delivery, Work and Automations. This ran against the built dashboard with the API disconnected. Registered-project navigation against an enrolled daemon and broader usability acceptance remain open.

Current hosted verification

At 17bf3813b9, the dashboard job executed and passed the dashboard unit suite in 118.5s, typecheck in 3.5s, and bundle determinism in 3.7s. Linux passed all 183 selected Bazel targets, and Clippy passed. Earlier queued statuses below are historical. Cross-view usability acceptance for the tracking issue remains open.

Scope

Refs #4220 — tracking issue for focused command-palette task discovery; not full dashboard navigation acceptance.

Previously the palette matched workspace names only, so users searching for tasks such as “temporal replay,” “source symbols,” “PR reviews,” “task board,” and “scheduled jobs” saw no destination even though the relevant workspaces were mounted. The menu also displayed every row's hint as “workspace,” without describing its purpose.

Latest keyboard-scope correctness follow-up (2026-11-08)

• a66ccf6: preserve the actual selected project identity when registry results reorder without typing. Previously, retaining only an index could silently make Enter activate a different project. Added a keyboard/registry DOM regression with two projects and a live reorder; an absent selected row still clamps to an available row.
• 5d71622: preserve /?field=sigma&node=... when Brain is reselected; the index route already mounts Brain, and navigation to bare /brain discarded the deep-link view. Added an index-route keyboard case to the existing renderer-preservation matrix.
• Verification: Five standalone selection-algorithm checks passed. The committed DOM regressions and full dashboard suites have not executed on this exact head; hosted CI 42509161038 is queued. Keep the PR unmerged and the tracking issue open pending full nonzero tests and remaining route/view acceptance.

Implementation

• Add short task descriptions to the existing canonical 14-channel registry and display them as palette hints, without changing route paths, order, numbers, scope or selected view controls.
• Match all query words against each workspace's name and task description, case-insensitively and independent of whitespace; keep project lookup name-based and existing scope-aware navigation.
• Reuse the channel registry in the palette rather than duplicating route names in its search data. No new route, renderer, cache, or search service.
• Add three behavioral Vitest cases covering six task phrases, existing workspace/project lookups, empty query, and unknown destinations. Expected previous behavior fails the task phrase checks.

Verification and limits

Commit 7508bda04817 was reviewed against master 91c72aba; the exact changes are confined to dashboard/src/app/channels.ts, dashboard/src/app/shell/CommandPalette.tsx, and dashboard/src/app/channels.test.ts. The branch was updated by a non-force expected-head fast-forward.

A standalone tsc --strict --target ES2022 --module commonjs compile of the byte-identical production channels.ts passed; its local Git blob SHA 1dbe0a683458ad71fe85a45cc5a79df0092394ce matched the published file, and 15 executable Node assertions passed for real task matching, pre-existing route/label behavior and project-name matching. The new in-repository Vitest cases, full dashboard typecheck and browser interaction tests have not executed here (pnpm/full checkout unavailable). Exact-head hosted CI is queued; do not merge without nonzero relevant passing CI.

Remaining issue acceptance

Cross-workspace navigation, selected identities, deep links (loomRenderer, field, render), restored Loom/Brain/Cortex view choices, accessibility and browser journey validation remain mandatory for full issue closure. Nothing here claims to address all of that. No decision-model, release or protected PR changes.

---

Latest keyboard activation correction (2026-11-08)

Commit 7f5753ee prevents ArrowDown on an empty command-palette search from storing active index -1. A later matching project delivered by the shared registry without any query change previously rendered a visible row but left aria-activedescendant unresolved and Enter inert. The new DOM regression exercises empty search → ArrowDown → live registry update → announced selected row → Enter, and confirms the measured project activation and route. Before this fix the test fails at the IDREF assertion. The change preserves all existing task-hint rows, route identities, and project scope logic. One scoped two-file commit (37 additions, 2 deletions), independently reviewed and pushed using an exact-head force=false fast-forward. The in-repo Vitest regression and browser journey have not yet executed; exact-head hosted dashboard CI is required. The tracking issue remains open for the full acceptance work.

CI repair — scope-register channel type (2026-11-08)

Commit d9288b2 fixes the exact hosted Dashboard typecheck failure at ShellChrome.dom.test.tsx:117,129,178: adding the searchable Channel.taskHint made unrelated ScopeBar fixtures invalid despite the register using only path and label. The register now accepts Pick<Channel, 'path' | 'label'>, preserving the required task hint at the channel authority and accepting complete Channel objects as before. Exactly one source file changed (one insertion/one deletion); the three original behavioral assertions remain intact.

Verification: isolated TypeScript 5.8.3 strict structural test reproduced 3 missing-taskHint diagnostics before the change and zero diagnostics afterwards, including the full-Channel case. The in-repository Bazel/Vitest and browser suites are not yet confirmed for this new head. No issue closure is claimed.

Active-view deep-link preservation — 2026-11-08

Commit dccdaf9e corrects an additional navigation regression in this scope: selecting the currently open Loom, Brain or Cortex workspace through the command palette used to navigate back to the bare route and silently erase the selected loomRenderer, field, render and entity/deep-link parameters. The palette now retains the current route only when both workspace path and project scope agree. Switching workspaces or changing project scope continues to navigate via the canonical route, discarding unrelated view-only parameters.

Six keyboard-driven DOM assertions are added: three renderer/entity deep links, same-project scope preservation, cross-workspace isolation and project-scope transition. The previous implementation fails the preservation assertions. Two production/test files changed, and the commit was independently diff-reviewed and published through an expected-head, non-force fast-forward.

Execution status: exact-head hosted CI #42499324917 is queued; the new Vitest tests and browser journey have not yet been observed passing. Existing full multi-view and usability acceptance remains outstanding; the tracking issue remains open.

Hosted DOM assertion repair — 2026-11-08

The actual Dashboard Bazel job ran 2,254 tests (2,253 passed, one failed). The failing new late-registry keyboard test correctly activated and navigated to the chosen project, but its final assertion incorrectly expected the unscoped /brain path; the production scopedWorkspacePath explicitly emits /brain?scope=proj-new&scopeLabel=RareProject. Commit feeef181 corrects the assertion without removing or weakening the active-IDREF, Enter, activation or scope assertions. Independently reviewed exact one-file test-only diff, non-force expected-old-head push. New exact-head CI #42504065568 is queued and has not passed. The prior failing run leaves the PR unmerged and the tracking issue open.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 7e74baf

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[ScriptedAlchemy]

Owner-requested caller migration and legacy API deletion

Published 7e74baf2f86f5098d0ab998912ad896a825dfade on this existing branch using force=false and expected previous head 622531c49648d217d2bba3c26f09e24ab8175d1e; independent PR and ref readbacks agree. Exactly three files changed: loomUrl.ts, loomUrl.test.ts, LoomPage.dom.test.tsx.

The owner's latest direction is “In all PRs migrate callers and delete legacy apis.” This supersedes earlier promises in this PR to preserve the obsolete raw-ID loomSession fallback. loomSession now exclusively names a qualified two-string lane tuple; provider-unknown identities use loomBareSession. Deleted the raw/malformed-lane-to-bare-ID fallback and the implicit one-argument parser signature. No deprecation alias or forwarding shim was retained.

Caller audit: the production LoomPage already passes both explicit fields, the shared SessionPivots sessionHref already emits loomBareSession for provider-unknown callers (including Delivery links), and scene selection emits qualified tuples while clearing the bare field. Migrated every discovered remaining parser/unit/DOM caller to that contract. Qualified lanes, tuple-shaped literal bare IDs, ambiguity refusal and outside-page navigation retain their behavioral assertions.

Added negative parser cases and a rendered LoomPage regression proving an obsolete raw lane value cannot select an otherwise matching session. Exact commit diff reviewed; all unrelated source and maintenance corrections preserved.

Verification boundary: no local in-repository pnpm/Vitest or browser run was available. Exact-head CI 42738320620 is queued, NOT passed. Real dashboard typecheck/nonzero tests and broader #4220 acceptance remain required. This is Refs #4220; no merge or issue closure. Preserve the existing #4845 prerequisite stack, refresh this head before edits, and do not restore the removed compatibility path.