fix(history): bound external CLI replay and turn-index rebuild

docs/architecture-audit-2026-07-23/Issue443.md

@@ -0,0 +1,43 @@
+# Issue #443 architecture audit
+
+Scope: bounded replay for all built-in imported-history sources, managed CLI mirrors, replay consumers, SQLite turn-index projection, and the native-SDE isolation boundary.
+
+## Ten-layer review
+
+| Layer                        | Evidence checked                                                                                                                                    | Verdict                                                                                                                                                                                                                                                 |
+| ---------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| 1. Compilation and contracts | Rust/TS wire schemas, targeted `cargo check`, typecheck, serialized compatibility tests                                                             | Pass for the #443 change. Workspace `cargo check`, typecheck, lint, full Vitest, circular analysis, and task-scoped `-D warnings` clippy completed. Strict workspace clippy is blocked only by byte-identical `develop` baseline findings listed below. |
+| 2. Old/dead paths            | Global caller sweep for `loadFullTranscriptChunks`, `supportsWindowedReplay`, `cursorIdeFullRefresh`, `cli_agent_chunks`, and provider full loaders | Pass; production callers are zero. Removed the remaining Cursor full-refresh API. Legacy provider loaders remain only as parser/test compatibility surfaces.                                                                                            |
+| 3. Naming consistency        | `ReplayCursor`, generation/revision, source/session identity, descriptor/payload naming                                                             | Pass                                                                                                                                                                                                                                                    |
+| 4. Semantic overloading      | Core descriptor encoding versus app `PayloadRefEncoding`; EventStore hydration modes                                                                | Pass after making generation resets use `set_external_replay_window`. The two encoding enums intentionally separate persistent-core compatibility from the public event wire.                                                                           |
+| 5. Defaults and fallbacks    | Unknown source routing, missing adapter behavior, legacy cached payload descriptors, watcher fallback                                               | Pass. Unknown built-ins fail closed; only old cached descriptors may infer encoding. Watcher failure returns the typed active/visible bounded poll fallback.                                                                                            |
+| 6. Domain boundaries         | Native SDE versus imported/managed CLI, collaboration snapshot secondary reads                                                                      | Pass. Native adapters never resolve the primary replay target; Rust validates identities before creating watcher/request state.                                                                                                                         |
+| 7. Registry clarity          | Rust authoritative 15-source registry, TS metadata mirror, managed native transcript remap                                                          | Pass after centralizing an exhaustive compile-time storage-driver classifier shared by sync and payload reads.                                                                                                                                          |
+| 8. Wire and memory bounds    | 10 turns, 200 events, 4 MiB IPC, 256 KiB payload ranges/cloud segments, EventStore byte cap                                                         | Pass in code, wire tests, deterministic 30/300 MiB performance tests, a 3.0 GiB real SQLite DB migration, and both core and rendered-app runs of the 335 MiB Issue 272 Codex JSONL.                                                                     |
+| 9. Entry-point parity        | Open, poll, older/seek, prewarm, metadata/hover, provenance, Fork, Cloud, Raw Transcript, JSON/Markdown export                                      | Pass. Background/read-only consumers use compact indexes or bounded scans and do not acquire foreground watchers.                                                                                                                                       |
+| 10. Resolver symmetry        | Source/session validation, public-to-native cursor remap, generation/revision pinning, reset/release/late-result guards                             | Pass. Sync and payload range now share the same exhaustive driver routing.                                                                                                                                                                              |
+
+## Findings fixed during the audit
+
+| Severity | Finding                                                                                                                | Resolution                                                                                             |
+| -------- | ---------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ |
+| P1       | A replay generation reset called generic `EventStore::set`, marking a bounded suffix as fully hydrated.                | Use `set_external_replay_window` and assert `HydrationMode::RoundWindow`.                              |
+| P1       | Driver dispatch used guarded matches plus runtime catch-alls, so a future source could compile without a real adapter. | Added exhaustive `replay_driver_kind` and a storage-family contract test.                              |
+| P2       | Cursor IDE's unused `load_full_refresh_for_session` production API remained after consumer migration.                  | Removed the type/function; retained the single-bubble parser used by SQLite/KV replay.                 |
+| P1       | Payload meaning was inferred from a dotted field path and array export recursion reused the parent path.               | Added explicit encoding/body projection and indexed array paths, with legacy-cache compatibility only. |
+
+## Acceptance boundary
+
+- All 15 built-in sources must stay `Incremental` and route through the exhaustive driver classifier.
+- A native SDE session must make zero external replay calls and retain its existing EventStore/FSM behavior.
+- No renderer API may expose a built-in full-transcript loader.
+- Completed evidence on the final tree includes 711 Vitest files / 6,426 tests, 482 passing `orgtrack_core` tests (4 intentionally ignored), 416 event-pipeline tests, 3,088 passing `agent_core` tests plus both loopback-only tests rerun successfully outside the sandbox, 68 `perf_utils` tests, 42 `orgtrack_cli` tests, 13 turn-index tests, the #425 ignored RSS stress, streamed 327.1 MiB export hash verification, bounded 30→300 MiB growth, and first-open/reopen of the real DB.
+- The Issue 272 core run parsed 52,477 rows from a 335.2 MiB JSONL into a 200-event/10-turn window, then performed an unchanged poll with zero parsed bytes and reopened in 55.64 ms. Cold open completed in 19.637 seconds with 39.4 MiB peak RSS growth.
+- The final-tree real SQLite clone migrated 5,227 events / 199 turns from index v11 to v12 in 595.138 ms, reopened in 44.888 ms, and increased peak RSS by 93.0 MiB. The original `~/.orgii/sessions.db` was never opened writable.
+- The final-tree rendered Issue 272 run opened and released the real session ten times with 26 events per window. First-open growth was 0 MiB relative to the sampled 609.9 MiB startup baseline, measured-tail step growth was 0 MiB, backend step growth was 0 MiB, and the 30-second idle settled at 494.1 MiB with 0 MiB growth. The #435 native/vmmap comparison was 609.9 MiB versus 566.7 MiB, a 43.2 MiB difference within the acceptance threshold.
+- A separate Computer Use pass opened the same 351,503,887-byte Issue 272 source through the visible sidebar and used `Command+5` to inspect runtime behavior. Reopen performed one bounded `es_merge_events`, twelve idle seconds produced zero API calls / zero likely polling, switching away issued `unsubscribe_session_events`, and A→B→A restored the same newest turn without a late result.
+- Deterministic performance stayed within every hard gate: 30 MiB cold-open growth was 9.7 MiB, extending to 300 MiB added 52.5 MiB, and the 327.1 MiB streamed export retained SHA-256 `a8ba9a1712ca6758f85f52101855d530b410f6fa12b716c78b0d7932c1ecfa3d` while adding 16.1 MiB peak RSS.
+- New #443 production files stay below the 1,500-line hard limit. The largest is the Codex JSONL driver at 1,370 lines; the Qoder sidecar driver is 1,316 lines and the managed-chunk bridge is 1,301 lines.
+- The live dual-instance sharing/presence spec now loads correctly and reports all 12 live scenarios as `SKIP`; execution remains externally blocked because no `E2E_CLOUD_*` test credentials are configured.
+- `pnpm check:circular` processed 5,849 files and found no circular dependency. ESLint completed with zero errors and two non-blocking warnings in byte-identical `develop` Cloud Realtime code.
+- Strict workspace clippy is still blocked by pre-existing findings in files byte-identical to `upstream/develop`: an item-after-test-module in `bin-gateway-chat-cli`, duplicated test modules in `perf_utils`, the existing usage-dashboard argument list, Key Vault enum naming, several existing Agent Core type/trait/style lints, and two existing ORG2 doc/constant-assertion lints. A scoped `-D warnings` run for all six #443 crates passed after allowing only those verified baseline lint classes on the command line; no source-level blanket allow was added.

docs/e2e-testing-2026-07-23/Issue443.md

@@ -0,0 +1,29 @@
+# Issue #443 rendered E2E evidence
+
+Scope: the real 335 MiB Codex “Issue 272” session, external replay open/switch/close lifecycle, native memory attribution, and the requested dual-instance sharing/presence smoke.
+
+## Evidence matrix
+
+| Surface                           | Result  | Production-path evidence                                                                                                                                                                                        | Result details                                                                                                                                                  |
+| --------------------------------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Real Codex first open             | PASS    | The rendered Tauri app indexes the isolated external root through the production rescan command, resolves the imported Codex session through the production bounded-replay adapter, and opens the chat session. | 26 events were hydrated; first-open Physical Footprint did not exceed the sampled 609.9 MiB startup baseline, against the 400 MiB growth limit.                 |
+| Ten open/release cycles           | PASS    | Each cycle opens the same real external session, switches back to New Session, releases the replay owner, and measures the app process tree.                                                                    | Measured-tail step growth was 0 MiB and backend step growth was 0 MiB.                                                                                          |
+| Idle release / #446 compatibility | PASS    | After the final explicit release, the app remains idle while native process memory is sampled every five seconds for a bounded 30-second window.                                                                | The app settled to 0 MiB over baseline without lowering the 250 MiB threshold.                                                                                  |
+| #435 native attribution           | PASS    | Every process row returned by `get_app_memory_snapshot_v1` is compared with `/usr/bin/vmmap -summary`.                                                                                                          | Native total 609.9 MiB versus vmmap 566.7 MiB; 43.2 MiB difference is within `max(10%, 50 MiB)`.                                                                |
+| Hard event bound                  | PASS    | The open-session result returns only compact identity and event count; it does not serialize the full event store back through WebDriver.                                                                       | Every cycle returned 26 events, below the 200-event hard cap.                                                                                                   |
+| `Command+5` manual runtime check  | PASS    | Computer Use opens the 351,503,887-byte source from the visible sidebar, observes the monitor, switches away, and reopens the same session.                                                                     | One bounded merge per reopen, zero calls during a 12-second idle window, normal unsubscribe on release, and no A→B→A late-result resurrection.                  |
+| Dual-instance sharing/presence    | BLOCKED | `cloud-dual-instance-ui.spec.mjs` loads on the current tree and reaches its live credential gate.                                                                                                               | All 12 live scenarios are explicitly skipped because `E2E_CLOUD_SUPABASE_URL`, `E2E_CLOUD_ANON_KEY`, and a service-key or email/password credential are absent. |
+
+## Failure-driven harness correction
+
+An earlier post-merge run sampled each release after only one second and failed with a renderer-dominated 330.4 MiB “settled” growth even though the backend and measured-tail step growth stayed bounded. The acceptance test preserves the same 250 MiB limit but adds a bounded 30-second idle sampling window, distinguishing delayed allocator reclamation from retained live replay state without manufacturing a pass.
+
+The first current-head rerun used a brand-new isolated ORGII home and correctly failed before memory measurement because the test tried to open the imported session before any catalog scan. The harness now establishes the same precondition as the real sidebar/data-source flow by calling the production `external_history_rescan_source` command. It also sets `ORGII_EXTERNAL_HISTORY_HOME` to an isolated root containing only the real Issue 272 JSONL. The open/release assertions still use the production session adapter; no full cache or debug-only success path is seeded.
+
+## Commands
+
+- `E2E_ISOLATED_RUN=1 E2E_ORGII_HOME=<temp> ORGII_EXTERNAL_HISTORY_HOME=<issue272-only-temp> E2E_ISSUE_443_REAL_CODEX_SESSION_ID=codexapp-rollout-2026-07-12T01-13-48-019f522b-c7de-7c50-885f-ab6790d68469 E2E_CHAT_RENDERING_SCENARIOS=issue-443-real-codex pnpm test -- --spec './specs/core/external-replay-ui.spec.mjs'`: PASS on the final tree, one real rendered scenario in 2m 41s including service startup and graceful cleanup.
+- Computer Use: launched the current debug binary from a uniquely identified temporary app bundle, opened the real Issue 272 source through the normal sidebar, toggled `Command+5`, exercised expand, idle, switch, reopen, and quit, then verified the frontend, IDE server, and WebDriver ports were all released.
+- `E2E_ISOLATED_RUN=1 E2E_ORGII_HOME=<temp> pnpm test -- --spec './specs/core/cloud-dual-instance-ui.spec.mjs'`: current-tree infrastructure gate reached; all 12 live scenarios explicitly BLOCKED/SKIPPED for missing cloud credentials.
+
+The large real JSONL and isolated ORGII homes remain outside Git.

docs/frontend-ui-audit-2026-07-23/Issue443.md

@@ -0,0 +1,20 @@
+# Issue #443 frontend UI audit
+
+The repository-listed `frontend-ui-audit` skill was unavailable at both configured paths, so this report applies its documented scope manually to the eight changed TSX files.
+
+| Line                                      | Element                         | Verdict          | Reason                                                                                                                                                                    | Suggested change |
+| ----------------------------------------- | ------------------------------- | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------- |
+| `TurnPageList.tsx:59`                     | Virtualized turn selector       | keep with reason | Reuses existing dropdown tokens and icon-button primitive; virtualization removes the session-sized derived item array without changing interaction semantics.            | None             |
+| `BlockOutput.tsx:293`                     | External payload range controls | keep with reason | Uses the shared Button component, bounded 256 KiB reads, request invalidation, disabled states, and an alert role for failures.                                           | None             |
+| `SessionRawTranscriptContent.tsx:47`      | Per-payload range viewer        | keep with reason | Uses design-system Button, semantic `article`/`time`/`role=alert`, existing color and spacing tokens, and never assembles the full payload.                               | None             |
+| `SessionRawTranscriptContent.tsx:274`     | Virtualized external transcript | keep with reason | `react-virtuoso` keeps rows bounded and preserves logical anchors while older pages prepend; native transcripts retain the existing CodeMirror view.                      | None             |
+| `SessionRawTranscriptDialog/index.tsx:54` | Raw transcript dialog actions   | keep with reason | Reuses Modal, Button and Message; Copy is disabled above the memory budget and streamed Export All is clearly exposed. Existing responsive modal dimensions are retained. | None             |
+| `SessionRawTranscriptView/index.tsx:15`   | Workstation raw view            | keep with reason | Delegates to the same audited bounded transcript component, avoiding a second UI pattern.                                                                                 | None             |
+| `CloudShareImportDialog.tsx:227`          | Cloud import client swap        | keep with reason | Behavioral transport substitution only; rendered component structure and styling are unchanged.                                                                           | None             |
+| `SessionImportExportModal.tsx:128`        | Streamed external export        | keep with reason | Existing modal UX remains unchanged; only external sessions switch to the Rust streaming exporter.                                                                        | None             |
+
+Summary: 0 fix, 8 keep-with-reason, 0 abstract. No new arbitrary Tailwind values, duplicate dialog primitives, or basic accessibility regressions were found.
+
+The final module-splitting commit was rechecked on 2026-07-24. Its TSX changes are import, prop-type, and source-neutral naming moves only; rendered markup, CSS, ARIA, keyboard behavior, and the verdict counts above are unchanged.
+
+The final hardening pass added localized Raw Transcript status/error text for all 13 shipped locales without changing rendered structure, design-system components, keyboard behavior, or the audit verdict counts.