fix(macapp): bind external runs to controls

docs/logs/INDEX.md

@@ -22,6 +22,23 @@
 
 - 2026-08-03 — Issue #1124 deterministic retry-wait callback fixture evidence
   is recorded in the engineering, observational, and system logs.
+- 2026-08-03 — Issue #1136 records immutable submission timeout capability,
+  one-shot dispatch, and reset/load all-stream detachment separately from #1133.
+
+- 2026-08-03 — Issue #1133 corrects the prior displaced-result wording:
+  displacement revokes controls but does not end A outcome observation.
+
+- 2026-08-03 — Issue #1130 submission-local outcome ownership, deterministic
+  barriers, and ToolWalk timeout ordering are recorded in all durable logs.
+
+- 2026-08-03 — Issue #1128 native submitted-run ownership evidence is recorded
+  in the engineering, observational, system, and long-term logs.
+
+- 2026-08-03 — Issue #1125 native Stop/steer/ToolWalk ownership evidence is
+  recorded in the engineering, observational, system, and long-term logs.
+
+- 2026-08-03 — Issue #1122 native interactive-state ownership evidence is
+  recorded in the engineering, observational, system, and long-term logs.
 
 - 2026-08-03 — Issue #1120 deterministic blocked-heartbeat callback fixture
   evidence is recorded in the engineering, observational, and system logs.

docs/logs/engineering-log.md

@@ -57,6 +57,112 @@
   normal/race passed in 13.200s/14.719s. Isolated foreground
   `./scripts/test-regression.sh` then passed normal/race plus 85.5% total
   coverage and zero uncovered functions in 2m26s.
+## 2026-08-03 (Issue #1136 immutable timeout authority)
+
+- Replaced the provisional public handle cancel with a package-visible opaque
+  `TimedOutSubmissionTicket`. Its initializer is fileprivate to `Runner`; the
+  only mint point is `waitForTerminal`'s final deadline-edge lifecycle check.
+  Ticket consumption retains the private `RunSubmission` owner-token/generation
+  recheck and is transport-only. Terminal, failure, reset, and load revoke it.
+- `RunSession` now tracks every submission stream by handle. Reset/load cancels
+  both displaced A and selected C rather than only the most recent stream.
+- TDD red: removing the old API produced nine expected focused compile errors
+  at former direct call sites. Gated proof now requires no ticket/action before
+  deadline, B -> C -> A exact-one dispatch, duplicate refusal, and post-ticket
+  terminal/failure/reset revocation. Remaining full-gate evidence is recorded
+  by this corrected PR rather than inherited from the superseded implementation.
+- Review correction: the first ticket implementation left a package-scoped raw
+  transport method callable before deadline. The ticket, constructor, and
+  transport closure now live in GoCodeUI; ToolWalk binds the immutable duration
+  at submission and `submissionTimeoutGate(for:)` alone verifies the derived
+  deadline and mints once. The #1146 CI-flake repair introduces an internal
+  `RunSession` monotonic-now seam shared by `RunSubmission.markStarted` and
+  `SubmissionTimeoutGate`; tests freeze/advance it at epsilon and exact
+  deadline instead of sleeping. `Runner.waitForTerminal` now accepts only its
+  poll interval so a caller cannot silently pass a conflicting timeout after
+  submission. A direct
+  gate regression plus a source-surface drift test prevents that bypass.
+
+## 2026-08-03 (Issue #1133 passive displaced-submission outcome)
+
+- Corrected the #1130 wait-policy gap: displacement is now a permanent action
+  fence, not a terminal ToolWalk result. Runner waits for its immutable A
+  handle's terminal/failure through deadline and never auto-answers/approves a
+  mismatched or displaced selected B.
+- `cancelTimedOutSubmission` retains exact locally owned A transport authority
+  after B selection, but its displaced path is transport-only: it cannot alter
+  B selection, transcript, pending UI, or cancellation state.
+- Test-first evidence: four URLSession-gated `RunSession.submit()` + Runner
+  tests were red before the repair (terminal/EOF/timeout returned displaced;
+  delayed ACK returned without A identity). The resulting #1133 tests prove
+  passive terminal, EOF failure, delayed acknowledgement, and B-safe timeout
+  policy. The stronger B -> C authority and revocation proof is tracked in
+  the separate #1136 entry above.
+- Verification: final combined focused `PassiveSubmissionOutcomeIntegrationTests`
+  passes 10/10 (not the earlier intermediate 4/4 or 8/8 counts); strict format
+  (0/7 touched Swift files require formatting) and
+  full `swift test --package-path macapp` (244 tests / 46 suites) pass. Full
+  regression, independent review, and hosted checks remain.
+
+## 2026-08-03 (Issue #1130 submission-local outcomes)
+
+- Split `RunSubmission` into independent A-local `Lifecycle` and displacement
+  facts. A terminal or failure therefore remains available to the initiating
+  caller after scheduled B selection instead of becoming a false timeout.
+- A delayed `startRun` acknowledgement now binds A's handle first, but only an
+  exact, undisplaced active handle may select/activate/account it. Stream EOF
+  and start/transport errors always settle A locally; they fail visible state
+  only while that same A still owns it. `finishRunIfCurrent` clears by object
+  identity rather than a reusable run-id lookup.
+- ToolWalk now uses typed wait outcomes. Terminal/failure precede displacement,
+  and only `.timedOut` reaches guarded A cancellation. New deterministic gate
+  tests cover late acknowledgement, late start/EOF failure, reset/load
+  detachment, and zero B mutation; outcome tests cover ordering and cancellation.
+- Verification: strict Swift formatting, focused submission/ToolWalk suites
+  (13 tests/2 suites), full `swift test` (238 tests/45 suites), and the
+  retained-pane `./scripts/test-regression.sh` pass (normal, race, 85.5% total
+  coverage, zero uncovered functions).
+
+## 2026-08-03 (Issue #1128 submitted-run ownership)
+
+- Added `RunSubmission`, returned by both native submit layers. It records A's
+  `startRun` identity, per-run transcript, terminal result, failure, and
+  displacement independently from the conversation's selected run.
+- ToolWalk now waits, auto-controls, times out, and judges the handle. A
+  selected B produces an explicit displaced result before any B endpoint call.
+  A local lifecycle timestamp is retained so later authoritative B selection
+  works without weakening provisional stale-replay protection.
+- Composer captures `.submit` or `.steer(A)` once; the pure execution seam
+  proves stale steering cannot fall through to a new submission.
+- Verification: strict Swift format; focused submission/external/ToolWalk
+  suite (37 tests/5 suites); full Swift package (230 tests/44 suites); exact
+  repository normal/race regression; coverage 85.5% with zero uncovered
+  functions.
+
+## 2026-08-03 (Issue #1125 native action-owner fence)
+
+- Added expected-run cancel/steer boundaries. Chat Stop, Composer, and ToolWalk
+  timeout carry their rendered/decision A identity; a B mismatch exits before
+  local mutation, Task creation, or HTTP.
+- Deterministic A-to-B tests prove stale Stop, steer, and timeout send zero B
+  endpoint requests while legitimate B actions still reach their endpoints.
+
+## 2026-08-03 (Issue #1007 External Scheduled-Run Controls Rebase)
+
+- System/component: `RunSession` control-owner reducer, accounting fence,
+  request generations, `RunSession+RunControls`, and `InlineRunStatus`.
+- Ownership/order: scoped conversation events select control ownership before
+  accounting. A selected terminal is rendered before a live fallback resumes;
+  a foreign terminal is tombstoned without changing the selected lifecycle or
+  accounting. Selection changes invalidate outstanding answer/input/control
+  requests.
+- Visibility/safety: the scheduled-run accessibility/status text is composed
+  alongside—not hidden by—project status. A second Stop cancels a per-run
+  stream only when that stream belongs to the selected run.
+- Verification: focused `RunSessionExternalControlTests` (6), full macapp
+  (217 tests/43 suites), and `./scripts/test-regression.sh` normal/race/
+  coverage pass from the exact rebased tree (85.5% total, zero uncovered
+  functions). Hosted CI and independent review remain promotion gates.
 
 ## 2026-08-03 (Issue #1120 blocked-heartbeat fixture)
 
@@ -4024,3 +4130,19 @@ Skipped creating separate issues for Op/EventMsg protocol (already covered by SS
 
 - Three callback deadline-release fixtures now use a one-second test lease and causal gates: admitted callback, heartbeat renewal entry, deadline signal, then cancellation-aware starter cancellation before unblocking renewal.
 - This is test-only. The strengthened assertions retain the durable safe error, attempt/run identity, retry state, and token/lease clearing contracts. Focused normal x20 (60.593s), race x20 (62.087s), and the full normal/race/coverage gate passed at 85.5% total coverage with zero uncovered functions.
+## 2026-08-03 (Issue #1122 native interactive-state ownership)
+
+- `PendingApproval` and `PendingPlan` now retain their originating SSE
+  `run_id`. `RunSession` clears approval, plan, and pending input synchronously
+  when selection changes, a selected run retires/falls back, or active runs are
+  cleared. Chat and ToolWalk pass that captured id to guarded action APIs.
+- Deterministic external-run tests cover approval, plan, and input from A being
+  displaced by timestamp-newer B; stale captured actions produce no B endpoint
+  request. They also cover selected terminal clearing and a foreign terminal
+  preserving B's interaction. The expected-red focused Swift build initially
+  failed because run IDs and explicit actions did not exist; the focused green
+  suite passes after implementation.
+- Exact final verification: focused external ownership (11 tests), complete
+  Swift package (222 tests / 43 suites), and `scripts/test-regression.sh` all
+  pass; the repository coverage gate reports 85.5% total and zero uncovered
+  functions.

docs/logs/long-term-thinking-log.md

@@ -38,6 +38,86 @@
   later same-run admission; normal/race/package/full gates are green.
 - Guardrails: no product source, API, SQLite schema, config, client, UI, or
   lifecycle change; no sleep/timeout increase or synthetic production defect.
+## 2026-08-03 (Issue #1136 immutable timeout authority)
+
+- Command intent: make a timed-out submitted A independently and exactly
+  cancellable after B/C selection without allowing the timeout path to affect
+  B or C.
+- Success: only a Runner deadline-minted opaque ticket can consume A's
+  started-only capability once; terminal, failure, reset, and load revoke it;
+  reset/load physically stop every A/C submission stream. Direct deterministic
+  proof complements #1133 policy waits.
+- Non-goal: reintroducing run-ID lookup, changing server cancellation, or
+  mutating selected-run UI from timeout transport.
+
+## 2026-08-03 (Issue #1133 intent correction)
+
+- Command intent: a callback/cron continuation must visibly continue B while
+  the initiating tool walk truthfully observes its own submitted A outcome.
+- Success: B displacement is sticky for control authority; A terminal/failure
+  after B is a valid A verdict; an A deadline cancels only A and produces no B
+  action or visible-state mutation.
+- Non-goal: making B a hidden fallback, treating displacement as success, or
+  using shared `currentRunID` to judge/control A.
+
+## 2026-08-03 (Issue #1130 submission-local outcomes)
+
+- Command intent: repair the #1128 review findings without weakening the
+  native external-run ownership fences.
+- User intent: an initiating A turn must receive its real terminal/failure
+  outcome, while a visible callback/cron B remains correct and controllable.
+- Success: barrier-proven A terminal/failure survives B selection; late A work
+  cannot change B; ToolWalk cancels only a genuine A timeout; reset/load/EOF
+  are deterministic ownership boundaries.
+- Guardrails: stacked native/ToolWalk-only change; preserve #1122/#1125
+  expected-run guards and #1128 A-only transcript/displacement behavior.
+
+## 2026-08-03 (Issue #1128 submitted-run ownership)
+
+- Command intent: close the remaining native composer/ToolWalk A-to-B ownership
+  gaps identified by Sol review after #1125.
+- User intent: an agent-walk or user click must continue/control the submitted
+  conversation turn, never a later cron/callback continuation that happens to
+  be visually selected.
+- Success: immutable composer action selection plus an A-only handle whose
+  identity comes only from `startRun`, with deterministic zero-B-action proof,
+  retained A terminal verdict, and safe failure/reset behavior.
+
+## 2026-08-03 (Issue #1125 native action-owner fence)
+
+- Command intent: repair the remaining stale native action paths identified in
+  Sol review of #1123 as a single stacked slice.
+- User intent: no scheduled continuation receives Stop, steer, or timeout cancel
+  meant for an earlier rendered run.
+- Success: expected-run guards and captured client identities with deterministic
+  zero-B-endpoint proof, while #994 and #1122 semantics remain intact.
+
+## 2026-08-03 (Issue #1122 Native Interactive-State Ownership)
+
+- Command intent: prevent a stale approval, plan, or input affordance from
+  directing a user decision to a newer scheduled continuation.
+- User intent: cron/callback conversation continuation must be visibly and
+  safely controllable, not merely runnable through the harness.
+- Success definition: every pending affordance carries its exact run identity;
+  owner changes and retirement synchronously erase stale UI; captured stale
+  actions cannot start a B request; selected B survives foreign terminal replay.
+- Guardrails: stack on #1118, preserve #994 delayed acknowledgement ownership,
+  change no server/TUI/callback behavior, and keep a deterministic TDD record.
+
+## 2026-08-03 (Issue #1007 External Scheduled-Run Control Rebase)
+
+- Command intent: make scheduled callback/cron continuations visibly active
+  and safely actionable in native chat without regressing main's accounting or
+  acknowledged control behavior.
+- User intent: a deployment-watch continuation must carry its conversation
+  forward in the GUI, including visible status and correct Stop/approval/input/
+  steering targeting—not merely fire on the harness.
+- Success definition: selected external runs visibly resume activity; all
+  actions target only that run; stale/replayed/foreign events cannot resurrect
+  or displace it; full macapp/repository and later live acceptance evidence
+  pass before merge/proof claims.
+- Guardrails: no server protocol/persistence changes, no status fallback that
+  hides scheduled state, and no account mutation before control authority.
 
 ## 2026-08-03 (Issue #1120 blocked heartbeat fixture)
 

docs/logs/observational-log.md

@@ -31,6 +31,70 @@
 - The pre-deadline checkpoint includes retry state, exact due time, reserved
   run ID, attempt one, and empty token/lease; checking all of them prevents a
   no-call assertion from masking an accidental claim or fence leak.
+## 2026-08-03 (Issue #1136 timeout capability proof)
+
+- A real deadline is suitable for #1133 wait-policy coverage but is not enough
+  if any caller can turn a submission handle into authority. The opaque ticket
+  is absent before deadline and can be constructed only at Runner's deadline
+  boundary; deterministic consumption makes B -> C -> A exact-one dispatch
+  and terminal/failure/reset non-dispatch observable.
+- A single mutable stream task would leave displaced A running when C starts.
+  The handle-keyed task registry permits reset/load to stop both streams.
+
+## 2026-08-03 (Issue #1133 passive outcome observation)
+
+- The #1130 handle correctly retained A lifecycle after B selection, but the
+  consumer stopped polling it on `.displaced`; durable A evidence was therefore
+  present but unobserved. A control authority and outcome observation are
+  separate concerns.
+- Gated integration runs show B can precede A terminal, A stream EOF, A timeout,
+  or A start acknowledgement. Each retains B as the selected scheduled run;
+  only the deadline scenario emits an A cancel request.
+- B can itself terminal before A while a user submits C. This proved timeout
+  authorization must follow A's stream lifetime, not `activeSubmission` or the
+  one current local-stream pointer. The final contract uses an immutable A
+  handle owner token plus reset/load generation and cancels every live local
+  submission stream when detaching a session.
+
+## 2026-08-03 (Issue #1130 submission-outcome observation)
+
+- The original single `State` made displacement overwrite terminal/failure
+  evidence. ToolWalk then saw only a nonterminal displaced handle and could
+  report an A timeout even when A had completed.
+- A late `startRun` response is not a stale response to discard: its run ID is
+  needed for A-local diagnostics and outcome handling. It is stale only for
+  shared selection, accounting, streams, and visible error state.
+- EOF is an ownership-sensitive failure: the visible A must stop spinning, but
+  the same EOF after B selection must not make B look failed.
+
+## 2026-08-03 (Issue #1128 submission observation)
+
+- A rendered run ID is insufficient when the action type is re-derived at
+  click time. Both the mode and owner must be captured together. Likewise,
+  shared session state is a presentation authority, not proof of which run a
+  ToolWalk submission started.
+- The red regression additionally showed that a local run must record its own
+  first timestamped lifecycle frame. Otherwise it remains permanently
+  provisional and a genuinely newer scheduled continuation cannot become the
+  selected owner.
+
+## 2026-08-03 (Issue #1125 action-owner observation)
+
+- Stop and steer are authority-bearing UI actions: retaining a SwiftUI closure
+  across A-to-B selection means a fresh current-ID lookup changes the user's
+  target. The identity must be captured and checked before draft/cancel state.
+
+## 2026-08-03 (Issue #1007 Rebase Observation)
+
+- The original #1007 action fixture attempted approve, deny, answer, steer,
+  and cancel concurrently. Main's #994 contract intentionally permits exactly
+  one acknowledged control request; the repaired test now proves the competing
+  calls are rejected until the same run emits a decision lifecycle frame.
+- Focused native evidence covers external action routing, stale conversation
+  rejection, foreign-terminal shielding, terminal tombstones, first active
+  evidence, and timestamp ordering. Full macapp (217 tests/43 suites) and
+  repository normal/race/coverage gates now pass; this remains distinct from
+  the later live installed-app acceptance proof.
 
 ## 2026-08-03 (Issue #1120 heartbeat ordering observation)
 
@@ -813,3 +877,12 @@ Use this file for observations about system behavior without immediately prescri
 ## 2026-08-03 (Issue #1141 callback deadline-release observation)
 
 - A heartbeat's absence from `ExtendLease` is not evidence that deadline cancellation failed: under CI load the independent deadline can cancel the admission first. Fixtures now observe both the deadline and starter context cancellation, so their outcome no longer depends on heartbeat scheduling. Normal and race stress x20 and the full regression passed without callback runtime changes.
+## 2026-08-03 (Issue #1122 ownership observation)
+
+- A visible native interaction is an authority-bearing object, not just a
+  transcript decoration. If it is retained across `currentRunID` replacement,
+  resolving the action at click time changes the user's target from A to B.
+- Generation checks alone cannot protect this: they invalidate asynchronous
+  completions, while a stale SwiftUI closure can issue a fresh request. The
+  captured run ID must be checked before creating its task and again before
+  issuing its network operation.