Consolidate verified CodeAF task, chat and runtime fixes

[santoshkumarradha]

Review summary

This batch brings 21 reviewed fixes together on Santosh/dev, frozen at 6cc872c8ea928c5a3f9c2a68c27664c20a93abd0 after the approved acceptance-fixture correction. The original PRs are closed as superseded; dev and main remain unchanged.

• Correct project and instructions: task workers use their assigned directory, selected workspaces stay anchored, and delegated work receives project standing instructions.
• Readable conversations: human updates and steering survive interruption and replay; internal activity folds compactly and completed receipts are dismissible.
• Reliable keyboard actions: Enter submits standing cards and task-room notes; declining a proposal prevents its countdown from starting work.
• Task recovery and shutdown: held work preserves its accepted request across restart, cancellation reaches queued tasks, and shutdown waits for its routing refresh.
• Bounded command output: verbose output has storage limits, while recursive searches exclude runtime logs and history.
• Accurate spending: daily limits use current ledger totals, including paid reasoning-ceiling retries.
• Consistent delegation: team members inherit approvals, single-model sessions avoid independent judge calls, and skill guidance stays isolated.
• Clear scheduled-work behavior and help: implicit setup preserves the existing timer owner; documentation explains repeating approvals and CLI budget options.

Ready for review: frozen at 6cc872c8e. All exact-head GitHub checks passed, and the independent make pr-ready run passed every affected package. Linux/arm64 and macOS/arm64 release builds were verified.

Real use: resumed an existing invoice project and completed customer-aging and priority exports. All 19 generated checks plus independent output/preservation checks passed; all 58 completed calls and receipts used DeepSeek V4.1 Flash. Watch the final continuous three-minute video · GIF, screenshot and full workflow evidence.

The approved #1630 correction fixes two test-ordering defects without changing production routing, deadlines or accounting. Two separate intermittent test observations remain documented under #814; they passed this final run but are not claimed causally fixed. Excluded work is listed below. This batch is frozen for review; further unrelated work belongs to the next batch.

Integrated changes

Source PR	Change	Reviewed source head
#1562	fix: ground task workers in the assigned project and preserve terminal plan state	1fe960214
#1603	fix: bound shell output and exclude runtime files from recursive search	734d6eb3d
#1610	fix(chat): defer independent pool judges in one-model runs	f1a677383
#1619	fix: recover and cancel held tasks through their original run	25893534b
#1625	fix: retain paid usage from reasoning-ceiling retries	6105c01e8
#1520	docs: clarify which standing approvals repeat work	82e34d5dcca434536398a08c0a2849c49a4f6ae0
#1563	fix(tui3): execute bare commands and anchor workspace selections	a59750c2234636ef280a224ece0b64214577e18c
#1595	fix(session): enforce daily spending limits with current ledger totals	3a31539e683eaf1011b4d7657c9c9ca8dbdc59c8
#1597	fix(teams): inherit approvals before starting members and centralize manager handles	fbb38632cc4e768f69de48364f53e02d2137c926
#1598	feat(session): plan-born task worker briefs carry standing project orders (#1549)	1c491ae94
#1594	fix(tui3): task proposal countdown handles keypress and avoids starting declined task (#1547)	2d60ab4b3
#1532	fix(session): skill suitability block isolation and regression tests (#1504)	c8688615e
#1531	fix(tui3): Enter key submits standing prompt card (#1506)	d8c1b0fc7
#1509	tui3: an air row under the nav — proper spacing between the top header rows	a08b1bb5d
#1502	session: the waiting sentence and its sign-in reason land together	de3204a79
#1628	fix(tui3): let task-room notes receive Enter after sidebar navigation	595aee0e6
#1615	test: preserve machine gate settings when pinning run models	53877754b
#1616	fix(session): join routing cache refresh before close returns	061c9f744
#1626	docs(cli): complete task and chat budget help	72c8ff1a4
#1622	fix: preserve the existing background timer owner on implicit setup	7eafed309
#1607	Shared compact chat activity, dismissible receipts, and durable human updates through steering/stop/replay	77f3132a2

Combined validation and rollout

• Batch frozen at 6cc872c8ea928c5a3f9c2a68c27664c20a93abd0 after the approved acceptance-fixture correction. All 21 source PRs above are incorporated and closed as superseded. No unrelated work will be added while this batch is reviewed; only confirmed acceptance blockers or requested review corrections may change it.
• Final exact-head CI, independent make pr-ready, genuine workflow acceptance, and both platform release builds passed. All 12 affected packages passed, including provider (88.685s), session (8 shards, 109s), and TUI (8 shards, 22s). Earlier failed runs remain recorded as failed; this result belongs to 6cc872c8e.
• Two test-fixture lifecycle corrections are included: credit tests isolate provider-key overrides while preserving explicit precedence coverage; the first-run judge fixture joins its own usage writer before temporary-state cleanup. Both were independently reviewed and passed repeated targeted checks.
• Live acceptance uses OpenRouter DeepSeek V4.1 Flash for all roles. Earlier evidence below retains its original source revisions and limitations; it is not a claim of final combined acceptance. The final combined recording and independent outcome checks are available in final workflow evidence.
• Generated review recordings and evidence files are kept outside the source changes and published as direct PR attachments.
• Held outside this batch: fix(standing): approve worktree isolation explicitly and retain unfinished work #1560, fix(standing): normalize scope exclusions and resolve current budget quotes in the engine #1596 and fix: make one-time standing approvals truthful and actionable #1612 pending shared-timer cleanup; broader fix: docs-audit bug batch (headless, reading helpers, held tasks, standing, teams, fan-out checks, media, remote) #1604, unverified tui3: compact Traffic ages and a middle dot in reminder times #1503 and subsequent batch-2 work are excluded.

Acceptance-fixture correction — #1630

Fixes #1630.

The independent combined gate exposed two scheduler-dependent HTTP streaming fixtures: one could let primary A earn commitment before its artificial stall; the other could let A finish before the intended hedge. The correction synchronizes the fixtures at the first-token/reasoning boundaries while preserving the original choice-count, encoded A-first order, actual-hedge and B-winner/A-loser assertions.

• Independently approved source c2c4cb6f3279b43b4f2d17482de4c13b162357e9 is incorporated in 6cc872c8ea928c5a3f9c2a68c27664c20a93abd0. Changes are limited to tests and the change entry.
• The deliberately delayed A/B scenario fails before the fix at its two-second bound and passed three times afterward. Both corrected fixtures passed 50 repetitions each in 19.079 seconds; the full exact-source provider package passed in 91.865 seconds.
• The original failed combined-gate record is retained. Passing targeted/provider checks does not replace the new full combined gate.
• Two unrelated timing observations—an extra ended row and a healthy story unexpectedly switching—received diagnostics only, with their assertions unchanged. They remain unresolved under #814; this correction does not claim to fix them.

Evidence and issue details

The sections below preserve source-PR findings, linked issues, screenshots, videos, receipts and limitations. Some videos cover combined candidate trees, and #1625 recordings show completed terminal states rather than full execution; those limitations remain explicit.

#1562: fix: ground task workers in the assigned project and preserve terminal plan state — findings, issues, recordings and limits

Real terminal workflow evidence

Goal and result: starting chat from home, build and actually use a maintenance CLI in a named project. Natural follow-ups add in-progress chores, JSON output and exact-title completion. The task worker/checker used the assigned project copy; the finished CLI persists the completed dryer chore and correctly shows the two remaining chores. 25 tests pass; all five local PlanDB tasks are done; 87/87 completed calls used OpenRouter deepseek/deepseek-v4.1-flash.

Watch the clean live follow-up MP4 · Completed-result GIF · Source PR findings and limitations

Tested at combined 41cf9cd0f, including #1562/#1603/#1604 and #1610. Original individual-head grounding evidence and CI are separate below. The clean video shows the final home-directory use; the retained original recording contains the full build/correction/task/landing-recovery sequence. The retained task branch required a natural follow-up to integrate earlier uncommitted changes; the files were manually copied and committed, then the task branch deleted; the retained-copy hint remains because this was not a successful engine landing receipt. An unnecessary cache deletion was denied in the actual approval UI before read-only use succeeded.

---

Fixes #1561.

A task started from a home-directory conversation could still run outside its project: the default bash run door bypassed the ground resolver entirely. It now uses the same resolver as proposed and legacy tasks, including a repository named in the brief or configured project fallback. Children retain their parent folder. Every plan worker and checker receives its actual assigned working directory before the work order, while the original request and unrelated reference paths remain unchanged.

Bash guidance now uses project-scoped discovery and plandb --help for missing plan documentation. A late completion of a cancelled task reports its terminal state before ownership or review validation, preserves the stored result, and retains the existing composite-placeholder completion behavior. The manual and change entry describe the resulting behavior.

Validation:

• Starting a conversation from home: named project resolved to an isolated worktree, relative design document read, missing document handled within the project, expected RESULT.txt committed, and worker/reviewer completed in 14.671 seconds. The UI showed done, one file, branch kept (the fixture used protected main). All 8 recorded calls, including auxiliary roles, used OpenRouter deepseek/deepseek-v4.1-flash. No outside-copy write was attempted after the assigned-directory change.
• Regression coverage includes the default run door, configured fallback, child folder preservation, actual worktree document availability, verbatim reference preservation, runtime worker briefing, cancellation/ownership, and the 16 KiB system-prompt budget. The actual built PlanDB CLI also rejects cancelled-task completion with the terminal-state message.
• Final make test-quick passed, and fresh e2e, plandb, and run package suites passed. An initial full session run exposed existing fixture races and a heartbeat compiler timeout (also reproduced on original PR revision f6aca9b); cleanup now waits for full run closure and heartbeat checks use a deterministic failure→repair fixture. All four initially failing tests passed 10 repetitions in 21.825 seconds.
• Exact-head CI on 1fe960214 passed all required checks, including the full touched-package suite. The redundant final local run was stopped after CI passed; it is not counted as a local full-suite pass.

Live verification used a disposable profile with its machine-load gate disabled; personal settings were unchanged.

#1603: fix: bound shell output and exclude runtime files from recursive search — findings, issues, recordings and limits

Real terminal workflow evidence

Goal and result: build a useful CSV sales reporter, correct refund handling through follow-ups, export it and run its tests. Six user turns produced verified EUR 5.30 / USD 19.75 totals and a matching export receipt. Direct verbose export succeeded while its captured snapshot remained exactly 8 MiB. 58/58 completed calls used OpenRouter deepseek/deepseek-v4.1-flash.

Watch the workflow MP4 · Watch the final handoff MP4 · Source PR findings and limitations

Tested at combined source 41cf9cd0f, including #1562/#1603/#1604 and the #1610 one-model judge fix. This is combined-candidate evidence, not a claim that #1603 alone includes those dependencies. The first video begins during the first turn; Playback is accelerated. Earlier diagnostic takes containing an independent non-DeepSeek judge are excluded. Automatic exact-PR-head CI is recorded below separately.

---

What changed

A recursive search could read its own runtime output and fill the disk. Both shell output paths now have explicit storage limits: background jobs keep their latest two 4 MiB chunks, while foreground bash retains an initial 8 MiB snapshot alongside its latest in-memory result tail. Foreground snapshots include the initial bytes; incomplete or failed snapshots no longer claim to contain full output.

Completed managed job logs and foreground snapshots each have a 128 MiB / 64-file budget per directory with seven-day expiry. Independent file leases protect active writers across processes. Background job IDs remain durable across cleanup. Foreground snapshots use exclusive random names under the state home's logs/bash/; promotion closes that snapshot before forwarding later output to the job sink. Logging failures remain visible while the child keeps draining.

Structured recursive search excludes known runtime output, including custom state homes, foreground snapshots, input history and project task indexes, and legacy pi-bash-*.log files in the current temporary directory. Source worktrees remain searchable; explicit file inspection is bounded. Arbitrary shell commands still need explicit search exclusions, and their captured output is bounded independently.

Selected workspace/session folder aliases are resolved before opening owned log storage. Links inside that storage remain refused. This prevents the new retention checks from breaking jobs for users with symlinked home/workspace paths.

Fixes #1599
Fixes #1600
Fixes #1601
Fixes #1602
Fixes #1606

Validation

• Live chat on final combined revision 830d4c2eb passed all three corrected probes: structured search in 1.9 seconds returned only the source marker, foreground output completed in 1.7 seconds with an exactly 8,388,608-byte snapshot and a truthful limit notice, and a managed background job completed in 2.3 seconds with exit 0 and retained chunks of 4,194,304 and 3,097 bytes. All 13 completed calls used deepseek/deepseek-v4.1-flash through OpenRouter, including auxiliary roles; no call errors occurred.

• The initial terminal search exposed prompt-history self-ingestion. The corrected exact-path exclusions were added and the final terminal probe above verified that runtime history no longer enters source results. Live test configuration now pins all 22 text roles from the canonical role vocabulary, every tier, and fallback settings.

• A controlled reproduction against the original PR revision b22359d07 wrote a 12,582,912-byte foreground spill. The fixed real-shell regression retains exactly 8 MiB and preserves the latest result tail with an explicit incomplete-snapshot notice.

• Both engines reproduced the prompt-history self-ingestion before the fix; the final history/task-index and foreground-spill exclusion regressions passed in 0.87 seconds.

• Full internal/exec/bare suite passed in 12.06 seconds. Focused race checks covering foreground spills, cross-process writer leases, retention, promotion, failures, and both search engines passed in 4.05 seconds.

• Focused background spool/retention suite passed in 14.27 seconds. Final regressions for selected-folder aliases, startup expiry, unsafe linked descendants, and an actual shell search consuming its own job log passed in 0.52 seconds.

• make build passed at 9dbd1c286. Manual, performance limits, and change entries describe both storage contracts and their limits.

• The local light gate passed build, vet, manual checks, changelog validation, all 30 law packages, and the affected bare/e2e package suites. The final two-shard session suite ran for 423 seconds and had one failing test: TestAChildLandingAfterItsParentSettledReachesTheConversation timed out while observing its transient steering queue. The same failure reproduced on the original PR revision (4/30 runs); diagnostic repeats proved all four sampled failures had already delivered the exact message (queued=false, durable=true). The assertion now reads the existing transcript-plus-queues helper and preserves its timeout, expected content, and settled-parent report check. The corrected test passed 100 repeats in 3.686 seconds at 734d6eb3d. This full local gate remains recorded as failed. Fresh isolated CI at public head 734d6eb3d0bbd9eb311ca70a6e3e42c9a2dfda80 subsequently passed all checks, including touched packages: https://github.com/Agent-Field/CodeAF/actions/runs/36329255094.

Boundaries

These are per-job/per-directory limits, not a machine-wide disk quota. Active writers and unmarked/unsafe legacy files are outside completed-file retention. Existing large legacy files are preserved. No production logs were deleted by this change.

#1610: fix(chat): defer independent pool judges in one-model runs — findings, issues, recordings and limits

User workflow

Goal: With Model Pool reading enabled, build and use a pantry shopping CLI with a helper and README collaboration, then refine it for purchase quantities and fractional stock.

Observed outcome: The helper produced the initial CLI while the main conversation prepared documentation. A natural request for buy quantities and fractional values was completed in the main conversation after the helper returned its original scope. The final artifact passed 16 tests and actual text, JSON and oats/fraction output checks. All 105 receipts, including auxiliary and helper calls, used the requested DeepSeek model with no pool-judge calls/files.

Watch the workflow (MP4) · Animated GIF

Evidence: tested revision ffe8a20646a551afeed39c915951e8f70ed670e6. All 105 recorded calls used OpenRouter deepseek/deepseek-v4.1-flash, including auxiliary calls. The completed source deliverable and original evidence are retained locally.

Playback and limits: Playback is accelerated 3× with idle periods shortened. Model Pool was enabled in read mode and --one-model was supplied. Single-model sessions defer pool judging; ordinary pool resumption is verified by regression tests, not by a live run using alternate models. A note to an active helper does not replace its original acceptance contract; the recorded main conversation completed the revised requirements after the helper returned. This records that behavior rather than claiming helper scope changed automatically.

Revision note: recorded runtime ffe8a20646a551afeed39c915951e8f70ed670e6; later head f1a677383 changes only do_engine_test.go for a fixture resource-setting regression tracked in #1615. The recording is not a new-head binary claim. Final make pr-ready and CI both passed after that test-only correction.

chat --one-model could call a different model after a helper finished: Model Pool judging chose its own independent model. This launch now defers the optional task-landing judge and startup sweep. Ordinary launches keep independent judging; single-model launches neither self-judge nor consume pending judgments.

Fixes #1608.

Validation: focused launch-policy and pending-sweep regressions passed. Final make pr-ready passed at f1a677383 (affected cmd/codeaf suite 193.816s), and CI run 36334579868 is green. The original local run failed in preexisting test setup; its log is retained. The #1525 fixture correction published separately in #1615 is included here. The recorded runtime is ffe8a20646; only cmd/codeaf/do_engine_test.go differs at the final head, so runtime code is identical. All 105 live receipts used the requested model with Model Pool enabled.

#1619: fix: recover and cancel held tasks through their original run — findings, issues, recordings and limits

Actual terminal acceptance on this focused revision

Tested exact source 25893534bfa9d9077e50b3d23c563f072b9a156c, with the binary hash and request receipts retained. Two useful workflows passed after real fixture-engine restarts:

Workflow	Verified outcome	Model audit
Supplier order: correct a queued request, cancel, edit from another conversation, restart, release and use output	No file changes on cancelled task; another conversation commits while held; same accepted request resumes; CSV Bolts,12,3 and Nuts,7,8;24 tests pass	53 completed transport calls all DeepSeek V4.1 Flash
Maintenance CSV: interrupt an active implementation, reopen, finish and export	Same task and working copy resume; changes merge on ordinary branch; correct two-row CSV;36 tests pass	42 request starts and endings all DeepSeek V4.1 Flash;3 stream errors retained and explained

Queued cancellation and second-conversation video · Restart, release and supplier handoff video · Active result GIF · Source PR findings and limitations

The protected-main supplier task intentionally kept its branch; an explicit follow-up brought its three finished files into the checkout. Automatic protected-main landing is not claimed. The active task used an ordinary branch and did merge. Intentional cancellations and a worker deadline remain visible in the active recording; completion succeeded. These are scoped graceful-restart scenarios, not a universal exactly-once guarantee.

The receipt audit also found a separate provider retry-usage undercount: one paid empty-at-ceiling retry attempt costing $0.0005994 was omitted from the aggregate usage ledger. All its requests still used the required model. That billing correction is tracked separately in issue #1624; the53 transport / 52 usage counts above are not a parity claim.

---

Queued tasks could take a repository lock before they were admitted, ignore cancellation, lose their accepted folder/brief on restart, or retain misleading working state. This focused series persists accepted requests before admission, restores the exact request or working copy through the normal run owner, keeps joined task lifecycle consistent, and honors external machine-limit changes both at gate creation and afterward.

This extracts only the reviewed restart/cancellation/resource-admission work from broad draft #1604. Dependencies: #1562, #1603 and #1610, included as merged reviewed dependency heads. The independently selectable focused series, after those dependencies, is 4e5309fe8 (production fixes, manual and regressions), 4cef394bd (test owner-cleanup correction), and 25893534b (PR change-entry metadata). Dependency merge base is 1cacec27f. The broader draft is preserved; unrelated auth, teams, daily-spend, standing orders and audit UI changes are excluded.

Addresses #1554's restart/stopped-state items only; its reader-handoff fallback item remains outside this PR. Addresses the resource-admission portion of #1579.

Fixes #1571.

Validation, focused session tests passed in 13.212 seconds and terminal tests in 1.460 seconds; the final focused source builds. Exact-head CI36335451163 on 25893534bfa9d9077e50b3d23c563f072b9a156c passed all required checks, including the full affected-package suite. The local light gate passed all 30 law packages and local non-heavy affected packages passed; A separate local full-suite run did not finish and is not counted as passing. Live acceptance on this exact head passed as recorded above. Earlier combined221e7 media remains separate evidence and is not substituted for this focused-head run.

Limits: older records missing their original brief/folder remain visibly interrupted rather than reconstructed by guesswork; same-copy restart does not promise exactly-once execution of arbitrary external side effects. Started delegated programs retain their existing recovery contract and durable ending receipts.

The separate paid-retry accounting defect #1624 is addressed by PR #1625; its final CI is green and settled live evidence is published there. The original recordings above do not certify that subsequent accounting fix.

#1625: fix: retain paid usage from reasoning-ceiling retries — findings, issues, recordings and limits

Actual terminal capture 1 · Capture 2 · Captions and limits

These short recordings show the actual completed terminal state, not the full task execution. Exact revisions, accounting receipts and limits are below.

Problem and behavior

Fixes #1624. A successful reasoning-only response at the output ceiling teaches the adapter to retry with more room. The first response is paid, but the session previously saw only the final answer. A real OpenRouter DeepSeek V4.1 Flash run recorded $0.058953156 across 53 transport responses versus $0.058353756 across 52 ledger rows: the missing $0.0005994 exactly matched the discarded 718-input/320-output response.

The adapter now notifies accounting owners before retrying. The session records the discarded response, including cache usage, with its model/role and original inline-versus-detached turn ownership. Existing full per-transport billing owners retain sole ledger ownership. Composed budget observers update the applicable day, task, seat and helper totals without releasing the in-flight reservation twice. The final response content, error behavior, context size and one-retry limit stay unchanged.

This is a separate dev-based accounting fix. It contains no task-admission or broad restart-audit changes.

Verification

• Original production-source overlay fails the new regression: successful retry loses the first $0.0005994; failed retry loses all of that paid first attempt.
• Six real-HTTP session cases repeated three times pass: success/error; inline/detached turn attribution; full billing ownership; independent ledger cost/call counts; cache-read/cache-write counts; day/task/seat/helper budgets and reservation release.
• Provider contract cases cover successful retry, HTTP failure, cancellation, observer composition, unchanged final response and full per-transport billing. Focused race cases repeated five times pass.
• Full provider package passes in 91.256 seconds. Live verification and final exact-head gates are reported separately below when complete.

Limits

The existing adapter may spend one retry within an already admitted logical call; this change records that spend and makes subsequent budget decisions accurate. It does not add a new admission policy for internal retries. Current direct consolidation/sentinel roads send no output ceiling and cannot enter this specific ceiling-learning retry. Auxiliary call ownership is explicit at the existing seven detached request sites, rather than inferred from role names.

Final revision and real terminal acceptance

Exact PR head: 6105c01e8dddbf988eced24008ee83d5fbc84fa5 (changelog identity only after independently reviewed production 1f4f3c51fed3d9c5f8be109138eebca2c61b83c7). Clean build and changelog checks pass; build SHA256 0085c71b3fd48b541ffd92e8c0440347d75fe7774dca80621ec5331f717e9858.

Two bounded live workflows ran using only deepseek/deepseek-v4.1-flash. Live source was the explicitly combined 961c98c0d50860ab517f33a4e148628abd290965: focused #1619 head25893534b plus this reviewed production fix, without broad #1604. This is not isolated-head live evidence.

Both runs naturally triggered a paid reasoning-ceiling response, which now appears immediately in the ledger. Their retries hit a provider-stream deadline; existing later reconciliation added the retry cost. No transport-cost parity or successful final live retry is claimed:

Settled trial	First paid response retained	Known transport cost	Later reconciled cost	Final ledger
1 (14 calls / 14 rows)	$0.0005985	$0.009988692	$0.0014391	$0.011427792
2 (14 calls / 14 rows)	$0.000446472	$0.009559980	$0.0013488	$0.010908780

Both generated supplier CSVs contain Bolts:12 available/3 needed and Nuts:7 available/8 needed; all24 inventory tests pass in each. A separate reviewer checked the settled raw receipts, model IDs and artifacts. Successful-retry semantics are covered by the HTTP regression cases above.

All required exact-head checks pass in run36337200573, including the full affected-package gate (4m42s) and light gate (3m51s). Independent source review and live receipt audit are complete. These are source-PR results; aggregate readiness is reported in the review summary above.

Evidence: images and videos below are direct PR attachments. Original recordings, detailed receipts, verification records and generated examples are retained locally. Exact source revisions, audited outcomes and limitations are stated alongside each workflow.

Reviewed standing, workspace, spending and team changes

These four exact ready heads were merged normally into Santosh/dev, with make build passing after each merge. Remote ancestry was verified after publication. Their original CI, local checks and live evidence remain attached to the source PRs; this is not a claim that the combined aggregate has completed final acceptance.

Source #1520 — Related #1505

Documents the different consequences of reminders, rules and repeating checks. Source: PR #1520, exact head 82e34d5dcca434536398a08c0a2849c49a4f6ae0.

Screenshot · video. All 34 calls used OpenRouter deepseek/deepseek-v4.1-flash, including auxiliary roles.

Validation/limits: source CI and acceptance passed. Documentation only. Live recording keeps the model’s brief pending/approved confusion and user correction; it does not claim new card behavior. Model Pool was disabled in these historical recordings; the separate #1610 fix is already included in this aggregate.

Source #1563 — Issue #1548

Runs complete bare slash commands and anchors a project-less conversation to its selected workspace. Source: PR #1563, exact head a59750c2234636ef280a224ece0b64214577e18c.

Screenshot · video. All 39 calls used OpenRouter deepseek/deepseek-v4.1-flash, including auxiliary roles.

Validation/limits: source CI and acceptance passed. Live proof verifies the selected repository and actual generated-project work; earlier model-policy failures are excluded from acceptance. Model Pool was disabled in these historical recordings; the separate #1610 fix is already included in this aggregate.

Source #1595 — Issue #1546

Enforces daily limits using current ledger totals across conversation/task/helper guards, with receipt catch-up and date rollover. Source: PR #1595, exact head 3a31539e683eaf1011b4d7657c9c9ca8dbdc59c8.

Screenshot · video. All 36 calls used OpenRouter deepseek/deepseek-v4.1-flash, including auxiliary roles.

Validation/limits: source CI and acceptance passed. Live proof covers budget refusal and recovery. Cross-process reservations are not atomic, calls in flight may finish, and midnight rollover is regression-tested rather than live-tested. Model Pool was disabled in these historical recordings; the separate #1610 fix is already included in this aggregate.

Source #1597 — Issue #1551

Persists inherited approval posture before starting team members and centralizes manager handles. Source: PR #1597, exact head fbb38632cc4e768f69de48364f53e02d2137c926.

Screenshot · video. All 182 calls used OpenRouter deepseek/deepseek-v4.1-flash, including auxiliary roles.

Validation/limits: source CI and acceptance passed. Live manager/builder/reviewer workflow completed a useful CLI and 19 tests; allow inheritance was exercised. Refusal/persistence failure use regressions. Initial manager polling and later wake-up are preserved. Model Pool was disabled in these historical recordings; the separate #1610 fix is already included in this aggregate.

Integration publication: b096a949c8b349a9b75d2e751783564d02890288. Source PRs are superseded by this draft aggregate, not merged into dev; their branches and full review/media history are retained. The separate holds on #1560, #1596 and #1612 are unchanged.

Shared background timer ownership — #1618 / #1622

Integrated exact ready source 7eafed30975b89026f3f699687bb587859d6099b. Implicit first approval preserves another profile’s shared timer; ownership checks and mutations share an interprocess lock. Each waking approval distinguishes a saved item from unavailable closed-window execution. Explicit settings keep deliberate takeover behavior.

Recorded useful pantry workflow, screenshots, video and full evidence.

Exact live runtime dddee8c4e differs from the integrated source only in test fixtures. All 22 calls used OpenRouter deepseek/deepseek-v4.1-flash, including auxiliary roles; --one-model with Model Pool off is the disclosed #1610 workaround in that source run. The model produced a useful shopping report, honestly explained the open-window limitation, then stopped the weekly item. Both real shared service and timer files stayed byte-identical, inventory stayed unchanged, and 19 actual pantry tests passed. light gate and all affected packages passed, including full session in two shards (303 seconds); source CI was fully green before integration. These are source-branch results, not a claim of aggregate acceptance.

Cleanup limitation: the coordinating task’s earlier shared-timer intended owner is unknown. This task did not restore or modify that shared timer; all its own test schedules were retired. The current aggregate status is in the review summary above.

Additional reviewed fixes — original green PRs

Source	Exact reviewed head	Change
#1598	1c491ae94	feat(session): plan-born task worker briefs carry standing project orders (#1549)
#1594	2d60ab4b3	fix(tui3): task proposal countdown handles keypress and avoids starting declined task (#1547)
#1532	c8688615e	fix(session): skill suitability block isolation and regression tests (#1504)
#1531	d8c1b0fc7	fix(tui3): Enter key submits standing prompt card (#1506)
#1509	a08b1bb5d	tui3: an air row under the nav — proper spacing between the top header rows
#1502	de3204a79	session: the waiting sentence and its sign-in reason land together

All required source CI passed. Integration preserves both standing orders and assigned worker directories across the1598/1562 API overlap; focused combined regressions and build passed. These are historical integration results; see the review summary above for current combined validation. Preserved source descriptions and validation.

Task-room keyboard fix — source #1628

Source	Exact reviewed head	Change
#1628	595aee0e6	fix(tui3): let task-room notes receive Enter after sidebar navigation

Coordinator-approved acceptance blocker 0c757ba6365a2d3d6b61ae7df4b4ba8b4679342f was cherry-picked: config credit tests clear inherited provider keys and explicitly cover env precedence/stale credit. No runtime change. Independent review and four environment matrices passed ; issue #1489 evidence.

Source CI, full local gate, independent review, and actual 21-call DeepSeek workflow passed. Integration build passed. These are historical integration results; see the review summary above for current combined validation. Preserved source descriptions and validation.

Added verified CLI and session-lifetime fixes

Integration revision ef1ba797ab6adbf4ff519d5808316d07d982c002: make build passed after each of the three merges. Source gates below passed before integration; current combined validation is in the review summary above.

#1615: test: preserve machine gate settings when pinning run models — exact source evidence and limitations

Reviewed head 53877754b0835743d5ff4b4572766222bffb6967.

Three run-model tests replaced the complete profile after the shared fixture disabled machine load and memory gates. On a busy host this silently restored the default load limit, so the scripted jobs never started and timed out.

Apply model pins through the settings API, preserving the fixture's resource settings. This only changes test setup. Partially addresses #1525.

evidence: unchanged base 837b2b0 reproduces the load refusal in 61.486 seconds; with the fix all three affected tests pass in 5.736 seconds while sharing the same loaded host. Final make pr-ready passed at 53877754b, including the complete affected cmd/codeaf suite in 233.832 seconds. CI run 36334534140 is green. No product runtime changed, so this fixture correction requires no separate model-driven workflow. Separate cleanup-race failures are investigated in #1616 and #1612; they are not masked by this change.

#1616: fix(session): join routing cache refresh before close returns — exact source evidence and limitations

Reviewed head 061c9f7441ff9c81de7d50e82c99aeacaca616db.

User workflow

Goal: Continue an existing pantry shopping CLI: harden invalid-input handling through natural follow-ups, preserve its JSON and fractional-quantity behavior, then close the real session cleanly.

Observed outcome: The completed CLI passed 28 tests and produced the expected shopping quantities. Natural follow-ups covered blank names, non-finite or negative values, fractional quantities and negative thresholds. The inventory stayed unchanged. After normal exit there were no remaining product processes and all 109 recorded profile files remained unchanged for five seconds.

Watch the workflow (MP4) · Animated GIF

Evidence: tested revision aad6ef9a868a60b0c4c9b3ef5cd5b0d2cd70335e. All 61 recorded calls used OpenRouter deepseek/deepseek-v4.1-flash, including auxiliary calls. working CLI source and its tests.

Playback and limits: Playback is accelerated 3× with idle periods shortened. This live run exercises ordinary work and shutdown; a deterministic blocked-refresh regression separately proves the specific late-writer lifetime. Five seconds of observed quiescence does not establish every possible shutdown race is fixed. Model Pool was disabled for separately tracked #1608. The CLI uses ordinary float subtraction, so some fractional displays have normal floating-point precision artifacts; no rounding fix is claimed. Full affected-package checks remain tracked below.

Closing a session cancelled its routing-cache refresh without joining the goroutine. A refresh finishing a cache or ledger write could still use the state directory after Close returned. The session now cancels and joins its own beat before returning, with the same optional lifetime as the existing beat.

Related to #1499 and #1491. This proves and fixes one late-writer lifecycle gap; it does not claim that every previously reported cleanup race has this cause.

A deterministic blocked-sheet test fails on unchanged base (Close returned while cancelled refresh was held) and exercises the final join. Focused regression and live close verification passed. Full affected-package verification also passed.

Validation: final head 061c9f7441ff9c81de7d50e82c99aeacaca616db passed make pr-ready SHARDS=2 (exit 0; full session suite, both shards, 266 seconds) and all GitHub checks. Recorded runtime aad6ef9a8 differs only in six test files: fixes synchronize receipt journaling, run/store teardown, reading observation, decision ownership, and the young-bash fixture. No runtime behavior or timeout changed after recording. The two earlier failed local runs are retained; those fixture corrections and pinned Go caches address their established causes. Original validation and runtime-equivalence records are retained locally.

#1626: docs(cli): complete task and chat budget help — exact source evidence and limitations

Reviewed head 72c8ff1a4f5cfd7a547d96ea4e6e9374e5db444b.

The main help synopsis omitted supported task model/worker flags and chat budget flags, and its shared headless-work explanation contained a garbled sentence. The summary now names those options and explains that chat budgets require --yolo.

Part of #1558. The token-count correction is already present in #1604. The engine command's deliberate omission from public help and home-relative workspace semantics are unchanged. Includes the existing test-only model-pin fixture correction from #1615 so full CLI verification preserves its disabled load gates.

Validation: final head 72c8ff1a4f5cfd7a547d96ea4e6e9374e5db444b passed make pr-ready (exit 0; complete CLI package 191.015 seconds) and all GitHub checks. Built with make build; actual --help, do --help, and chat --help all exit 0 and include the missing options. Existing help layout tests pass with the original page/column limits unchanged. No model call is needed for this help-only change.

The original help output and validation records are retained locally. Initial help-layout failures are preserved; the correction shortened existing prose instead of raising layout limits.

Excluded from batch 1

• fix(standing): approve worktree isolation explicitly and retain unfinished work #1560, fix(standing): normalize scope exclusions and resolve current budget quotes in the engine #1596 and fix: make one-time standing approvals truthful and actionable #1612 remain draft awaiting confirmation of the previous shared-timer profile and its restoration. Their technical checks passed; no guessed timer restoration is authorized.
• Broad draft fix: docs-audit bug batch (headless, reading helpers, held tasks, standing, teams, fan-out checks, media, remote) #1604 remains separate; only explicitly listed focused extractions are included.
• tui3: compact Traffic ages and a middle dot in reminder times #1503 is excluded because CLA status alone does not establish readiness.
• A task typed on Home can land in another project's repository #1466 is reserved for batch 2.

#1607: clean conversation across chat, manager and task views — issues, recording and verification

The shared renderer retains human questions, steering, completed replies and explicitly addressed interim updates. Internal activity uses the existing three-row scrolling animation and folds when complete. Errors stay compact with details available on demand; settled task receipts can be dismissed and restored while pending decisions remain actionable.

Typed, occurrence-owned audience and interruption metadata survive replay, compaction and rewind without changing provider history. Consumed steering clears abandoned tool arguments; stopped human updates remain readable and marked interrupted. Ambiguous older mixed prose is preserved because legacy records lack reliable audience metadata.

Continuous video verification passed on previous combined revision d590d41a3: see the workflow recording and outcome. Fresh live verification on the new test-only head is in progress. The earlier preview remains excluded from qualifying live-video evidence.

In the historical source workflow, the user added real steering, resized the terminal, opened/closed command details, dismissed receipts and challenged the final import advice. Human messages and updates remained visible. Independent execution passed 39 tests and checked strict export, unchanged input, failed-output preservation, successful replacement and import-only-on-success behavior.

• Historical workflow application revision: 18a6ec5f21386c1a2e1d5c6165b55a4804086c2d; all 41 sustained-workflow calls used OpenRouter deepseek/deepseek-v4.1-flash.
• Four additional live terminal scenarios passed in 112.054 seconds, with 35 audited DeepSeek requests: chat/task receipts, manager replay plus live follow-up, failed-call recovery, and steering/update/reopen. Manager team traffic is a historical fixture, not a claim of live teammate delivery.
• Full make pr-ready passed on 561e1c5f1, after documentation and test-fixture-only follow-ups, including reuse of already-reviewed fix: recover and cancel held tasks through their original run #1619/fix(standing): preserve shared timer ownership on first approval #1622 teardown fixes; application code is unchanged from the recording. Original source validation records are retained locally.
• Source head CI passed at 77f3132a20b52f9776809353c57a1da20aed78a8. Integrated as efc86fdfdb94933eeae9a6787b5526338717a504; make build passed on that exact merge. Current combined validation is reported in the review summary above.

Closes #1564
Closes #1565
Closes #1605
Closes #1609
Closes #1613
Closes #1614
Closes #1617
Closes #1620

Original detailed source PR preserves the full implementation and evidence history. No features or underlying task results were removed.

Earlier combined workflow — d590d41 (superseded by the exact-revision continuation below)

Goal: use codeaf normally to build a useful invoice follow-up tool, inspect its output, and refine it for weekly bookkeeping. Five natural conversation turns produced a dependency-free Python CLI, customer-ranked CSV export, exact-cent totals, row-numbered validation errors, and atomic intentional report replacement.

Result: ran the generated tool independently. Today's sample reports 3 unpaid overdue invoices totaling 1,599.95, grouped into 2 customers. Next-week preview totals 2,399.95 across 3 customers. All 10 generated regression checks passed; independent black-box checks also confirmed the exact exported rows, invalid-input rejection preserving the existing report, and successful weekly refresh. No codeaf blocker was observed in this workflow.

Model evidence: all 48 completed transport calls and all 48 usage receipts use OpenRouter deepseek/deepseek-v4.1-flash, including turn, title, caption, reflex, markreader, router, and routerconfirm. Completed calls returned HTTP 200. Revision: d590d41a3a2afb5120a6d61904ee0b526a325dec.

Recording: continuous 3-minute excerpt at original speed from the actual live application session; original full 5-minute recording retained. Only the bottom location footer is cropped. This earlier recording is retained as historical workflow evidence; the final exact-revision continuation below supersedes it for #1607 acceptance. It shows follow-up requirements, live edits and checks, safe refresh behavior, and the useful resulting report.

workflow-final.mp4

Scope and limits: this is meaningful end-to-end use of the combined binary, not proof that every feature is exhaustively covered. Specialized cancellation/restart and other regression evidence remains linked in the source coverage sections. Full combined release gates are reported separately; this workflow result does not imply those gates have finished.

Final exact-revision workflow acceptance — 6cc872c

Goal: return to the existing invoice project and finish a practical weekly workflow. The recorded session resumes the prior conversation, adds a customer aging export, checks a realistic older-invoice sample, adds an inclusive 61-day priority filter, and handles the normal case where no seriously late invoices exist.

Result: the original invoice sample produces an aging total of 2,399.95. The older sample exercises all aging boundaries (30/31, 60/61, 90/91) and totals 1,650.00; filtering to at least 61 days correctly produces 1,200.00. An empty priority export is a valid header-only CSV. The original collection report remained byte-for-byte unchanged. Independently ran all 19 generated checks, then separate black-box CLI checks of exact exported values, inclusive filtering, invalid thresholds, empty export, and preservation of the earlier report. No codeaf blocker was observed.

Exact revision and model: 6cc872c8ea928c5a3f9c2a68c27664c20a93abd0. All 58 completed HTTP 200 transport calls and 58 usage receipts in this continuation used OpenRouter deepseek/deepseek-v4.1-flash, including turn, caption, reflex, markreader, router, and routerconfirm. Prior-run receipts were excluded from these counts.

Final #1607 recording: approximately three continuous minutes at original speed from the actual application session. It shows ordinary follow-up requests, live implementation, actual report output, and the finished weekly commands. Only the bottom location footer is cropped; the full original recording is retained.

workflow-final.mp4

Limits: this useful workflow verifies the combined binary at the stated revision; it does not replace the separate full acceptance gates or every specialized regression scenario. Those gate results are tracked separately. Earlier media remains explicitly tied to its original revision.

[santoshkumarradha]

Lane DONE; remaining owned candidates/blockers: none. Reconfirmed #1562, #1603, #1619 and #1625 CLOSED with replacement links to #1627; their source branches/history and direct media attachments are preserved. #1610 remains the review lane’s responsibility; broad #1604 stays excluded. No work duplicated for the coordinator-owned config credit test-isolation blocker.

[santoshkumarradha]

Task-room keyboard correction integrated by green-PR review

Task notes typed after opening a room from the sidebar were visible but Enter did not send them. The shared room lifecycle now releases keyboard focus, including reselecting the same room without discarding its draft. Full local gate, all source CI and independent review passed. Fresh workflow consumed three notes, produced the corrected shopping report and passed 13 artifact tests; all 21 model receipts were OpenRouter deepseek/deepseek-v4.1-flash. Final source 595aee0 differs from recorded b1b00fd only in the change-entry PR number and filename. The original before-fix diagnostic and accepted recording are retained with explicit resizing/dependency limitations. Combined acceptance remains coordinator-owned.

Source #1628 — fix(tui3): let task-room notes receive Enter after sidebar navigation

Exact reviewed head: 595aee0e67a2e35357c8e5231b0d07540e7e9c0a. Original source and evidence: #1628

User workflow

Goal: Open a running task from the keyboard roster, send a change to a shopping report, reselect the same room and send another note without losing its draft.

Observed outcome: All three actual notes reached the worker: raise the target from 3 to 6, preserve the last good report when input is invalid, and document usage. The task produced tea: buy 1, rice: buy 4, beans: buy 6 and passed 13 independently rerun artifact tests. The retained working copy contains the changes; the original main checkout stayed clean.

Watch the workflow (MP4) · Animated GIF · Original terminal recording (.cast)

Evidence: tested revision b1b00fd43f9a5d37fab9996b50ca1832ddad3dfd. Execution/binary identity, model receipts, checksums and playback details. All 21 recorded calls used OpenRouter deepseek/deepseek-v4.1-flash, including auxiliary calls. Consumed notes and workspace proof, artifact tests, before-fix regression, final focused regression, full local gate, actual report, and coverage.

Playback and limits: Playback is accelerated 3× with idle periods shortened. Recorded build b1b00fd includes the reviewed keyboard fix 94e7499 plus its manual clarification. Final checkout 595aee0 differs only in changelog filename/PR number; no new runtime is implied. full pr-ready passed, including all eight TUI shards; all final CI checks passed (run 36338452123). Narrow-terminal live success is not claimed; regression tests cover 80- and 140-column layouts. Model Pool was explicitly disabled; separate #1610 covers it. The before-fix 1569 recording below is diagnostic only and retains its missing #1562 grounding dependency/source-workspace writes. This fix addresses only the room-note part of #1556.

Opening a task with Alt+T → Enter left keyboard focus in the sidebar. A note appeared in the task composer, but Enter reopened the row instead of sending it. The shared room-opening lifecycle now releases sidebar focus. Selecting the already-open room does the same while preserving its draft, scroll position, and subscription. Part of #1556; this addresses the room-note item only.

The regression drives the actual keyboard route at 80 and 140 columns, sends a note to the task engine, reselects the same room, and sends a preserved second draft. It fails on the original source at both widths. Focused room, hosted-page, sidebar and steering checks pass on the final source. The manual explains the behavior only for tasks accepting notes.

Fresh acceptance on runtime 94e7499 / built b1b00fd used OpenRouter deepseek/deepseek-v4.1-flash for all 21 recorded calls. Three notes were consumed by the worker: change a shopping-report target from 3 to 6, reject invalid quantities while retaining the previous report, and document usage. The actual output contains tea: buy 1, rice: buy 4, beans: buy 6; all 13 independently rerun artifact tests pass. The original project remains clean and the protected-main task branch is retained. The initial 60-second sleep gives the operator time to enter real notes; it is not simulated model output.

The recorder used a fixed 140-column child. An outer-terminal resize caused clipped display and is retained in the raw recording; it is not claimed as narrow-terminal live acceptance. Unit coverage verifies both application widths. Model Pool was explicitly off; independent pool behavior has separate acceptance in #1610.

The full make pr-ready gate passed, including all eight TUI shards in 35 seconds. Final focused checks passed in 1.912 seconds. All final CI checks passed (run 36338452123). Final source 595aee0e6 differs from recorded build b1b00fd43 only in the changelog filename and PR number. Immutable media and raw evidence are linked above. No merge into dev/main is part of this PR.

Before the fix — diagnostic failure, not acceptance

The earlier broad #1604 runtime e556a5b21 opened the task room with Alt+T → Enter but left the typed follow-up note unsent. This screenshot preserves the note in the composer and the roster’s Enter behavior.

Before-fix video · GIF · unmodified original recording · manifest

All 29 receipts used OpenRouter deepseek/deepseek-v4.1-flash. The duration CLI passed 11 tests, but this was partial diagnostic evidence: the worker followed an absolute source path despite retaining a working copy. That broad head lacks the separately owned #1562 grounding commits 780f22cb9 and 23d1ab588. No isolation success or #1569 closure is claimed. A later keyboard recovery attempt occurred after task completion, so the original note’s successful delivery is not claimed. The corrected workflow above used a fresh fixture and kept the original checkout clean.

Model receipts · diagnostic proof · coverage and limitations. Both previews use 3× playback with idle intervals capped at 3 seconds; both originals are retained without edits.

[santoshkumarradha]

Review evidence should describe what the user sees and what passed. Keep private environment and execution notes out of public descriptions and captions. Use direct PR attachments showing the actual application with its authentic colors; reconstructed text screens or screenshot slideshows are not substitutes for a live interaction recording. Existing evidence limitations must remain accurate.

The header-spacing description and copied evidence have been corrected. The two unsuitable header images were removed; a verified colored application preview is now attached directly.

[santoshkumarradha]

@AbirAbbas this consolidated batch is ready for your review and merge into dev when approved. It is frozen at 6cc872c8e, contains 21 superseded source PRs, and has green exact-head CI, independent affected-package checks, and real-workflow acceptance.

Please start with the combined summary and final recordings, screenshot and verification. Exclusions and known test observations are documented. No unrelated changes will be added to this batch.