* fix(session-projection): keep released units in checkpoints
Since the Cordis rc.11 teardown order unloads the Web layer before the
base layer, Session Controller and harness-dev-context release their
projection units before their live Sessions detach. The projection
cache is still alive at that point and wrote a checkpoint holding only
the units that were still registered, replacing the complete record.
A blank Session then lost sessionListMetadata and listed as an untitled
conversation after every graceful restart.
A released unit now stays in the registry as a predecessor: it leaves
event drives, snapshots, restores, and change notifications, while
checkpoint() keeps each Session's last cell of it without advancing it.
Registering the same key again replaces the predecessor and refolds
the log. The projection cache keeps replacing whole records.
* test(session-projection): assert frozen released units across unload tests
Update the remaining unload tests that still expected a released unit
to vanish from checkpoint(): user-approval, agent-loop inbox and scope
lifecycle, time-context, and the agent registry now assert that the
same Session keeps its pre-unload row, that a later event does not
advance it, and that a Session created after the unload has no row.
The token-meter and goal unload tests also append an event after the
unload.
Document that a retained handle read still advances a released cell
that checkpoint() serves, and that restore() folds only live units, so
its refreshed rows omit released units.
* docs(session-projection): sync the ProjectionHandle type-equiv block
* docs(session-projection): record frozen released units and their upgrade
Add the upgrade guide for checkpoint() keeping a released unit's last
row, update the registration-handles Agent Note with the frozen-cell
decision and the retained predecessor, list both consequences under the
registry README's known limitations, note in the projection cache README
that a stored row can be frozen at its unit's release, and say that
restoreFloor() ignores released predecessors.
Update the agent-loop resource-lifecycle unload test, which read
checkpoints through an alias, to the frozen-row semantics.
* docs(upgrade-guide): mark the released-checkpoint snippet ignore-check
* docs(session-projection): state the retained-handle path and narrow a rejected alternative
* docs(upgrade-guide): re-record the released-checkpoint guide pairing
* feat(web): boot past failed optional client plugins
The Web client boot audit now follows Host startup strictness. An
inactive entry on the global required list (module system, Session
transport, renderer, application frame, Session view, and sidebar)
still rejects startup and the report marks the required entries.
Other inactive entries produce one console warning and the
application mounts without them. The boot page no longer draws a
failed entry before the audit decides.
* fix(web): audit boot entries whose creation rejects and name activation errors
ClientEntries.start() now logs a row whose Loader creation rejects, such
as a module that exports no plugin, and leaves it inactive for the boot
audit, as the Host Loader group does. The audit awaits only failed
fibers to report their recorded activation error. Notes, READMEs, and
the Web client subsystem page describe the browser boot audit; tests
cover invalid exports, carrier presentation of optional failures, and
required names absent from the boot graph.
* test(web): fail test carriers and e2e on inactive client entries
The product boot only warns about inactive entries outside its required
list, but tests must still surface every plugin that fails. TestClient
and createClientTest now require every roster entry to activate unless
a case passes allowInactiveEntries. The watchConsole tripwire, the
real-host smoke, and the assembled jsdom boot treat a web boot warning
as a failure with no opt-out.
Docs: the Web README names Session control, notes that an entry without
a fiber is reported as an import failure like the Host audit's "failed
to import", and the startup strictness note lists the browser tests.
The refusal kept the MCP manager loading in the browser preview while
the worker had no `global` binding, which cross-spawn's isexe dependency
reads at evaluation. The worker now publishes `global`, so the real
package loads. A stdio MCP server still cannot start in the preview: it
now fails through the worker child_process instead of an explicit
refusal, and HTTP MCP servers are unaffected.
Review round on the naming change.
`resolveName` now distinguishes an address from a Session id: a
slash-separated address never is one, so an unmatched path fails with
AGENT_NAME_NOT_FOUND instead of reaching member lookup as an unknown id,
while a single token keeps the Session-id fallback. Path resolution also
treats external and unknown children as leaves, so a name below an external
run reports the same clear failure instead of surfacing a session-query error
for an identity that owns no local Session.
Native V4 admission rejects a repeated sibling name in own catalog facts,
symmetrically with its duplicate-child check, so a log that would make name
lookup ambiguous fails before any member is resolved.
`SiblingNameReservations.release()` checks that it still owns the map entry,
so a stale or repeated release cannot drop a newer reservation for the same
creator.
`list_agents` explains corrupt, unsupported, and unavailable: they report that
the row's own descendants could not be read, and the row remains a member the
caller can message. The earlier wording restricted messaging to running or
inactive rows, which excluded addressable members.
`isAgentName` stays module-local; the package entry exports only
ROOT_AGENT_NAME, matching its current callers.
Package READMEs, the subsystem page, the Agent Note, and the generated API
catalogue follow; recorded-session, CLI, and Web expectations are refreshed.
* feat(client): share sidebar scrolling and dock workspace header
* fix(client): keep shared sidebar scrolling vertical
* fix(client): match sticky workspace header to sidebar fill
* fix(client): stabilize transparent sticky sidebar and compact row layout
* refactor(ui-primitives): keep sticky section observer internal
* fix(ui-primitives): limit row animations to visible scrollports
* feat(ui-workspace): drive sticky clipping with scroll timelines
* refactor(ui-primitives): bound row animations by the window
* feat(client): hand off sidebar wheel scrolling to the workspace list
The workspace list scrolls inside its own one-viewport section below the toolbar instead of sliding under a clipped sticky toolbar. The sidebar viewport scrolls the navigation away first; ui-sidebar's scroll hand-off splits each wheel event between the viewport and the section scroller, which the occupant binds through the slot-level useSectionScroller hook supplied by hookContext.
* test(client): cover the sidebar scroll hand-off and align the list scrollbar
Test-owned sidebar roles declare the slot-level scroller inject and pass its hookContext. Unit tests cover the hand-off split, wheel filtering, and listener rebinding; the e2e scenario checks one wheel event crossing from the navigation into the list and back. The list area reaches 2px from the sidebar edge for its scrollbar while rows keep the 8px inset. The unused clip module, its tests, and the sticky clearance variable are removed; READMEs and the slot catalog describe the nested scrolling.
* refactor(ui-primitives): restore MenuGroup sticky observation
The section observer was extracted for a sticky workspace toolbar that nested scrolling no longer has, so MenuGroup is its only consumer again. MenuGroup and its tests return to the master implementation.
* fix(client): keep native sidebar scrolling away from the hand-off boundary
The hand-off splits a wheel gesture in JavaScript only when its first event must move the sidebar viewport or starts outside the section scroller, and then keeps that gesture, including momentum, until wheel events pause for 100ms. Gestures the section scroller can take alone stay native, an uncancelable native gesture that reaches the section top passes the rest to the viewport, and events another listener canceled are left alone. The section is at most one viewport tall, and exactly that tall while search is expanded, so a short list leaves the navigation in place. Stale absence assertions and unused viewport declarations are removed; the READMEs document portals and the data-sidebar markers.
---------
Co-authored-by: Yif <877193178@qq.com>
Co-authored-by: imccyu <276526105+imccyu@users.noreply.github.com>
winewill