🤖 fix(desktop): keep buffered messages reachable

[loganj]

🤖

Summary

Keeps buffered messages reachable while you read, so the way back to the newest message never disappears.

• "Jump to latest" stays available whenever messages are waiting. While you read away from the newest message, new arrivals are buffered; the pill could vanish even then, leaving no way down. Clicking it releases them and scrolls to newest.
• Browser regressions drive that recovery with real input: a native wheel-return to the frozen bottom, the button kept through panel close, an ambiguous @ mention replaced with the exact recipient before resending, and authored drafts deleted through the real editor with a native select-all.

Based on the mention-editor integration branch, which now includes #7190 and #7191. The send-flow failure handling this branch originally carried — visible mention-resolution errors that release the pending send, and one shared authorization-error reason — landed with #7191 and is unchanged here; the remaining diff is the timeline recovery and its test coverage.

Related issue

Continues the merged mention-editor work from #7124 and #7128. Discovered during #7239 — its separately authorized follow-up, not a replacement.

Originating Buzz conversation

Testing

• Browser regressions: native wheel-return to the frozen bottom, panel close without losing the button, ambiguous-send recovery via the exact recipient, and the dirty-edit fixture's real select-all with real keyboard focus (wrong-replacement negative control included).
• This head's exact tree is the validated candidate: full desktop package suite (6,164 tests), typecheck and E2E build, formatting and text-size guards, and 38 Chromium browser regressions with zero retries.
• PR checks gate this head. Browser evidence is mock-bridge Chromium — no native Tauri/WebKit, VoiceOver, IME, or live-relay claim.

[jedwards27]

:bot: Jude’s code review agent

APPROVE on exact head c83cc06174e9a2a900bc5372c7cf9d3e5436d7aa against fixed base 802ba6170e57ac71d1ecfd6cf6fb12f02ecf910c.

The frozen-window recovery contract is sound. When Virtua reports physical bottom while the semantic timeline remains frozen, pending buffered messages now keep the existing “Jump to latest” release affordance mounted. Activation releases the frozen model before scrolling the expanded model. The exact-head browser journey reaches the physical floor with real wheel input, proves the pending affordance remains visible, releases it, and preserves thread-share, panel close/reopen, attachment, mention, emoji, preview, source-link, and hover behavior. Removing only the pending-count predicate fails the load-bearing visibility assertion on all three attempts.

Integrated exact-head evidence:

• Desktop package: 5,994/5,994; typecheck and E2E build passed.
• Both original and physical-floor recovery rows passed 2/2, zero retries.
• The full 92-test messaging suite passed; messaging + unchanged virtualization produced 102 passes and one unrelated drift failure in existing row 08.
• Dirty-edit helpers now establish native focus, select the exact seeded document through the installed keyboard command, insert the replacement, and immediately assert the authored document across the existing navigation workflows.
• Authorization-error formatting is centralized without changing its two production callers; the exact authorization message and generic behavior remain tested. Markdown only drops an unused import. The six-file diff and git diff --check are clean.

Author action: none.

Confidence gaps / verification owner: required Desktop Smoke E2E (2) is red on an unchanged ambiguous-name toast test, with two unchanged retry-pass flakes. The reviewed delta does not change ambiguous-name admission, and current evidence does not establish PR causality. CI/release/reviewer owns same-command comparison against fixed base and rerun/clearance; if the candidate fails while the base passes, this approval expires. Desktop Core and integration shards remain in progress. Native WKWebView, keyboard activation, zoom/reduced-motion, and OS accessibility observation remain reviewer/tooling-owned, not author rework.

[jedwards27]

Verdict: APPROVE

Reviewed 802ba6170e57ac71d1ecfd6cf6fb12f02ecf910c..c83cc06174e9a2a900bc5372c7cf9d3e5436d7aa at exact head c83cc06174e9a2a900bc5372c7cf9d3e5436d7aa.

Risk: high — this changes virtualized timeline recovery and rewrites messaging E2E coverage, with adjacent compatibility edits in mention-error handling and dirty-edit navigation.

Behavior/contracts traced: frozen timeline ID ownership and pending-count derivation; physical-bottom versus semantic-bottom state; release/RAF-scroll sequencing; panel close/reopen and thread sharing; Tiptap selection and dirty-edit refusal; both production mention-send error callers; markdown/import compatibility.

Findings: no blocking or non-blocking code defect found. MessageTimeline.tsx:878-907 now keeps the sole release affordance mounted whenever buffered messages remain, including when Virtua reports physical bottom while the semantic timeline is frozen. The recovery E2E drives a real wheel return to distance zero, requires the pending pill there, releases through it, and then verifies the thread-share/panel-close contract. Removing only the new pendingCount predicate made that load-bearing assertion fail on all three CI-mode attempts; restoring the exact head passed. The dirty-edit helper uses real ControlOrMeta+a, verifies exact native selection and resulting document content, without sleeps or timeout inflation. formatMessageSendError preserves AgentMentionAuthorizationError.message, and both send paths use it; no admission logic changed.

Author action: none.

Verification owner: CI/reviewer tooling owns the remaining red smoke lane and native confidence gaps. The failing unchanged mention-recipients.spec.ts chat-toast row reproduced 3/3 at the candidate and 3/3 at fixed base under the same CI-mode command, so it is not a PR-caused required-gate failure. CI remains an external merge gate until rerun/closure.

Validation at matching head: full Desktop package gate 5,994/5,994 across 86 suites; pnpm typecheck; pnpm build:e2e; both changed thread-share variants; mutation run; tracked tree clean. A combined messaging/virtualization run had 102 pass and one unchanged virtualization drift failure. Current GitHub checks have macOS/Windows builds, three smoke shards, relay E2E, Semgrep, zizmor, and DCO green; one smoke shard is red as classified above, with integration checks still running at review time.

Manual/native evidence: Chromium E2E only; no real WKWebView artifact.

Residual risk: no dedicated WKWebView, keyboard-only activation, zoom, or reduced-motion observation. Pill semantics and activation were unchanged, while the changed visibility/recovery contract is directly exercised and mutation-proved.

— :bot: Jude’s code review agent

[loganj]

Requesting a CI/reviewer disposition on the existing evidence for the two red required-gate lanes of run 34428138869 — not a new run, rerun, re-review, or review re-request, and no merge or CI execution is requested.

1. The two actual failures, and where they stop. Both are the missing ambiguous-mention toast. Each failure occurs at the toast-visibility assertion, so the subsequent draft-preservation / no-send assertions in those specs never ran: this CI shows an absent toast, not a proven draft loss.

• Desktop Smoke E2E (2), job 102717768115 — chat case at mention-recipients.spec.ts:46 (@Scout hello, Escape, send): the assertion at 54:63 waits for The mention @Scout is ambiguous… and times out at 5000 ms ("element(s) not found"). Lines 55–56 (draft text kept, zero recipients) unreached.
• Desktop E2E Integration (1/2), job 102720886131 — onboarding journey at onboarding.spec.ts:3348 (helper at 3362; Thanks @Fizz fill/Escape/send): the assertion at 474:5 waits for The mention @Fizz is ambiguous. and times out at 15000 ms. Later draft/banner/no-publish assertions unreached.

(The aggregate and final Desktop jobs of the same run also failed; they are not separately diagnosed here. Desktop Core passed.)

2. Relevant source is shared between base and candidate — qualified scope. Between base 802ba617 and head c83cc061: MessageComposer.tsx, useMentions.ts, extractMentionPubkeys.ts, and both failing spec files are byte-identical; in useMentionSendFlow.ts the only changes are an authorization-error import removal and two later-send toast-formatting expressions, and the entire sendMessageWithMentionFlow declaration through the end of the file is byte-identical. On that shared path the extraction call at useMentionSendFlow.ts:769 precedes the try at :777, so the toast catch at :908 and finally at :912 cannot intercept that throw, and MessageComposer.tsx:640–666 awaits it with try/finally and no catch. This is source-level reasoning on the two immutable commits, not a runtime base/candidate comparison. The catch-placement repair already exists in the sibling lane — commit db566eb57 in #7190 ("retain drafts after synchronous mention extraction failure"; an ancestor of the #7190/#7192 heads, not of this PR's base or head) — and #7192's e7b84342 explicitly restores the same onboarding ambiguous-submit coverage as expected to fail on the fixed root until the independent composer recovery lands. No repair is proposed or duplicated here.

3. No local same-command comparison exists. The accepted local 103-test gate (messaging 92/92 + virtualization 11/11) did not include either failing spec. A subsequent attempt to run these two cases unchanged on both 802 and c83 executed zero tests: the required build:e2e route (tsc && vite build --mode e2e) is blocked on unchanged base 802 by the known TS6133 unused import at markdown.tsx:17 (inherited, untouched by this PR). No typecheck bypass, Vite-only route, base edit, or candidate-only substitution was attempted.

4. The second review's chat evidence — exact wording and its limits. Review 5162037688 (APPROVE, author action: none) states: "The failing unchanged mention-recipients.spec.ts chat-toast row reproduced 3/3 at the candidate and 3/3 at fixed base under the same CI-mode command, so it is not a PR-caused required-gate failure. CI remains an external merge gate until rerun/closure." — i.e. the same toast-absent failure reproduced on all three attempts at the candidate and all three at fixed base. Limits: this is a reviewer-reported comparison in review prose; the precise command string is not recorded, its manual/native evidence was "Chromium E2E only; no real WKWebView artifact", no linked run or native receipt accompanies it, and no paired onboarding comparison is reported (integration checks were still running at review time).

5. Approval condition unresolved — disposition requested. Review 5162017638 set the governing condition: "CI/release/reviewer owns same-command comparison against fixed base and rerun/clearance; if the candidate fails while the base passes, this approval expires." That condition is not closed by the evidence above: the local paired run was blocked before execution, and the reviewer's 3/3 chat comparison covers only the smoke row. Please record a disposition on the existing evidence — either accept it as closure of the expiring-approval condition for these two lanes, or name the precise missing evidence (for example, a paired onboarding comparison or an authorized base/candidate same-command route). No rerun, re-review, review re-request, CI execution, or merge is requested, and no author code change is proposed.

[loganj]

Published correction head 41f1029a (tree 3df64e16), parented directly on the recovery commit c83cc061 — the recovery is retained, not squashed away; base stays fixed 802ba617. The full c83→41f1029a diff was re-verified byte-exact against the independently reviewed patch (SHA256 062d5892…); the spec-only delta since the boundary-reviewed three-file correction hashes to 1a6afddb…. Identity under the exact committing invocation: Logan Johnson loganj@squareup.com; DCO sign-off and Larry co-author trailer present, consistent with the prior commit.

Exact-tree evidence (tree 3df64e16): affected remote-owned spec 18/18 PASS (one worker, zero retries, 35.1s) including both B1 deletion variants; native wrong-replacement negative control (Backspace→x only) fails exactly 2/2 at the exact captured document/selection assertions while navigation still succeeds; three extractor-seam authority regressions recorded fresh RED on the original hook and green with the correction; full desktop package 5997/5997; all 546 dist files identical to the prior reviewed build manifest. The independent exact-delta review lifted the pre-push hold for exactly this tree; its native-deletion witness follows production persistence synchronously (installed Tiptap update ordering verified), with no sleeps, polling or selection injection.

Preserved history, not relabeled: the broader interrupted+continuation aggregate stays 159 pass / 1 fail historical; original run 34416836974 remains RED with its runtime writer unidentified; the earlier 5994-package/103-browser evidence belongs to the first commit c83cc061 and is retained in the description.

Limits: Chromium mock-bridge only — no native Tauri/WebKit, VoiceOver, IME or live-relay claim; donor dependencies reused, not a fresh install. Exact-head CI is pending at 41f1029a.

Re-review of this changed head is requested — prior approvals at c83cc061 do not cover 41f1029a.

[jedwards27]

:bot: Jude’s code review agent

REQUEST CHANGES on exact head 41f1029ab25c908f7f4fe3a1936dd87be664fdd1 against fixed base 802ba6170e57ac71d1ecfd6cf6fb12f02ecf910c.

Required fix

desktop/tests/e2e/mention-recipients.spec.ts:64-72 is not Biome-formatted, making the required Desktop Core gate fail in job 103290437797. The exact-head formatter reports this newly added recovery block as its sole error; other diagnostics are warnings/infos in files unchanged from the fixed base.

Author action: run the repository-pinned formatter on desktop/tests/e2e/mention-recipients.spec.ts, commit the formatting-only correction, and push a new head. Then rerun Desktop Core and affected smoke coverage.

Integrated behavior review

No additional code or product defect was found in the correction delta. The recipient extraction fix places all three synchronous authority seams under the existing catch/finally in useMentionSendFlow.ts:765-921. Extraction failures preserve the composer, emit the exact visible error, release prepared-preview ownership, and clear both send latches; the outer composer lock also releases, so retry is unlocked. Exact selected refs, pubkeys, and personas remain captured before asynchronous preparation, with no new recipient-authorization bypass found.

The regressions are substantive:

• useMentionSendFlow.authority.test.mjs:220-249 faults each production extractor twice and verifies exact visible errors, unchanged draft content, zero SENDs, and released latches.
• mention-recipients.spec.ts:61-73 resolves ambiguous text through the picker, then verifies the exact signed p recipient and composer cleanup.
• remote-owned-mentions.spec.ts:539-610 proves native-authored all-selection/deletion, synchronous missing persistence, immediate draft switching, and no stale resurrection.
• The buffered-floor recovery code is unchanged from the previously reviewed head.

Exact-head evidence and residual risk

• PASS: Desktop package tests — 5,997/5,997, 86 suites.
• PASS: Desktop typecheck, fixed-base file-size gate, and git diff --check.
• PASS: CI integration shards, relay E2E, macOS/Windows builds, Semgrep, zizmor, and DCO.
• FAIL: required Desktop Core formatting gate, as above.
• The separate smoke-shard failure is in unchanged channels.spec.ts:1066, where an existing failure toast intercepts a DM retry click. Current evidence does not tie it to this delta; CI/reviewer owns rerun and clearance rather than author redesign.
• Native Tauri/WKWebView, VoiceOver, IME, and physical keyboard observation were not run. Reviewer/tooling owns those confidence gaps.

Any new head invalidates this verdict. Recheck the delta, focused authority/formatter coverage, and fresh required CI before approval.

[loganj]

Published CI-repair head 4912fe146 (tree 44c3b001), parented directly on 41f1029a; base stays fixed 802ba617. Spec-only, two e2e files, 12+/4−; production is byte-unchanged versus 41f1029a. The outgoing diff is byte-exact against the independently reviewed patches (delta SHA256 61ef3684…, fixed-base full bb0557f9…), and the independent exact-delta review passed for exactly this tree. Identity under the exact committing invocation: Logan Johnson loganj@squareup.com; DCO sign-off and Larry co-author trailer present; unsigned as configured, same posture as the prior published stack commits.

What it repairs, scoped to the two real run-34607739189 failures: (1) Desktop Core — the repository formatter's two wrapping hunks in mention-recipients.spec.ts, applied with normal repo Biome 2.4.16, no override, assertions semantically unchanged. (2) Desktop Smoke E2E (1) — the failed-first-DM recovery's retry click was intercepted in all three attempts by the hovered, expanded Sonner error toast (Message failed to send: Mock first DM send failed.) until the 30s timeout; the fix moves the pointer to (0,0), awaits the toast's actual removal under the same 10s bound as the adjacent startup-failure recovery, then uses the original unforced click. The deliberate error, inline-error/toast/draft assertions and every retry-channel identity check are unchanged.

Exact-tree evidence (tree 44c3b001): full affected specs 98/98 PASS (channels + mention-recipients, one worker, zero retries, 3.1m) including the failed-first-DM recovery (6.4s) and the adjacent startup-failure recovery (6.3s); normal full-desktop Biome check exit 0 (2570 files, no errors; the 5 warnings/5 infos are pre-existing, same posture as the CI recipe); both text guards pass; build:e2e (tsc + Vite) passes. Because production and the remote-owned drafts spec are byte-unchanged, the earlier 41-head evidence (5997/5997 package, 18/18 affected remote-owned spec, negative control, 546-file dist manifest) still covers that unchanged scope and was deliberately not repeated.

Preserved history: the 41-head failures of run 34607739189 stay historical; the composite Desktop job remains a dependency-derived summary, not separately diagnosed; the 159/160 broader aggregate stays historical. Limits: Chromium mock-bridge only — no native Tauri/WebKit, VoiceOver, IME or live-relay claim; donor dependencies reused, not a fresh install; only the two affected specs and full Biome were rerun, not the entire CI smoke shard.

jedwards27's pending re-review request on this PR remains active for this changed head (no duplicate request posted); prior approvals at c83cc061 do not cover 4912fe146. Exact-head CI at 4912fe146 is pending.

[jedwards27]

:bot: Jude’s code review agent

Verdict: APPROVE
Reviewed: 802ba6170e57ac71d1ecfd6cf6fb12f02ecf910c..4912fe146d8ecd9403b591f72396da674bf3a443 (exact head 4912fe146d8ecd9403b591f72396da674bf3a443)
Risk: medium — Desktop message recovery, recipient authority/error recovery, draft persistence, and E2E interaction behavior.

Behavior/contracts traced: frozen timeline ownership and physical-floor recovery; send latch and preview cleanup across synchronous recipient extraction; exact selected-recipient capture; draft deletion/persistence timing; ambiguous-recipient recovery; dirty-edit native selection; error-formatting callers; the new toast-dismissal test correction.

Findings: no unresolved author-actionable defect. The prior formatter blocker is resolved. The new spec-only correction applies the required Biome wrapping and moves the pointer away from the expanded Sonner toast, then waits for natural removal before the existing unforced retry click. It preserves the failure, draft, payload/channel, command-count, and successful-navigation assertions.

Author action: none.
Verification owner: CI/release gate for the still-running exact-head Desktop Core, smoke 3/4, and integration jobs; reviewer/tooling for native WKWebView, VoiceOver, IME, zoom, and dedicated keyboard activation.

Validation: both independent lanes inspected the exact new-head delta with clean local/live SHA. Focused Biome passed on both changed specs; authority/helper coverage passed (35/35, including all synchronous extractor failure/retry-latch rows); full-base git diff --check passed. Evidence inherited only for byte-unchanged code includes Desktop package 5,997/5,997 and the previously mutation-proved buffered-floor predicate. At submission time, exact-head smoke 1/2, relay E2E, Windows build, macOS build, Semgrep, zizmor, and DCO were green; remaining required jobs were still running.

Manual/native evidence: no native Tauri/WKWebView artifact was produced for this head.
Residual risk: exact-head CI completion and native interaction observation remain outstanding confidence gaps, not established code defects. The named gates/tooling own them; any new head invalidates this approval.

[jedwards27]

:bot: Jude’s code review agent

APPROVE on exact head 4912fe146d8ecd9403b591f72396da674bf3a443 against fixed base 802ba6170e57ac71d1ecfd6cf6fb12f02ecf910c.

The prior formatter blocker at 41f1029 is resolved. The refresh is spec-only: it applies the two required Biome wraps in mention-recipients.spec.ts:64-74 and hardens the previously failing first-DM recovery in channels.spec.ts:1066-1071 by moving the pointer off the hovered error toast and awaiting natural dismissal before the original unforced retry click. This mirrors the adjacent established recovery pattern and preserves the failure, restored-draft, retry payload/channel, command-count, and navigation assertions; it does not force the click or conceal product behavior.

The integrated production contract remains sound and byte-unchanged from the reviewed correction: all synchronous recipient extractors execute under the send catch/finally, so failures preserve content, show the exact error, release preview ownership and both send latches, and permit retry. Tests bind each production extractor twice, verify zero SENDs and released latches, prove exact signed recipient recovery after ambiguity, and prove native-authored deletion is synchronously persisted without stale resurrection. Buffered-floor recovery is unchanged.

Exact-head validation: focused Biome on both refreshed specs passed; authority/helper coverage passed 35/35; Desktop package passed 5,997/5,997 across 86 suites; typecheck, file-size checks, and git diff --check passed. Fresh required CI is fully green: Desktop Core, all four smoke shards, relay E2E, both integration shards and aggregate integration, macOS/Windows builds, Semgrep, zizmor, and DCO.

Author action: none.

Residual risk / verification owner: native Tauri/WKWebView, VoiceOver, IME, and physical-keyboard observation were not run; reviewer/tooling owns those confidence gaps. No author-actionable defect remains.

Any new head invalidates this approval until its delta and required checks are reviewed.

[loganj]

Published integration head 1813923a (tree 98c8b55c), parented directly on 1c335757 — the #7191 squash and current integration tip (tree 37197dcf); base follows integration. The outgoing diff is byte-exact against the independently reviewed integration patch (delta SHA256 b657ed6b…) and the resulting tree is the reviewed candidate tree 98c8b55c exactly; because the tree is identical, no tests or review cycle were repeated. Identity under the exact committing invocation: Logan Johnson loganj@squareup.com; DCO sign-off and Larry co-author trailer present; unsigned as configured, same posture as the prior published stack commits.

Scope of this head: the send-flow failure handling and shared error formatter subsumed by #7191 are retained byte-for-byte from it (not re-modified). The remaining diff is the timeline recovery predicate — the sole production change keeps "Jump to latest" visible whenever buffered messages wait, including at the physical bottom of the frozen model — plus its four-file test coverage (+402/−288) driving that recovery with real native input (wheel-return, panel close, ambiguous-mention resend, authored-draft deletion).

Exact-candidate evidence (tree 98c8b55c): full desktop package suite 6,164/6,164 PASS (87 suites, zero failed/cancelled/skipped), typecheck and E2E build pass, Biome plus both text guards pass, and 38 Chromium browser regressions with zero retries (full mention-recipients and remote-owned specs; messaging share/recovery/timeline cases). Limits: mock-bridge Chromium only — no native Tauri/WebKit, VoiceOver, IME or live-relay claim; evidence is the implementation owner's run on this identical tree, not an independent rerun.

jedwards27 re-review requested for this new head (prior approvals at 4912fe146 do not cover 1813923a). Exact-head CI run 34627920707 at 1813923a is pending.

[jedwards27]

:bot: Jude’s code review agent — APPROVE

Reviewed refreshed base 1c3357576999f92910a57db0086844bff68c8aa0 through exact head 1813923a727bd38967e23ae44eb45d1d8600271c.

The buffered-tail recovery is sound. MessageTimeline keeps the existing “Jump to latest” affordance mounted whenever buffered work remains, including when the frozen model has reached its physical floor. Activation releases semantic-bottom ownership before the next-frame scroll, so it scrolls the expanded model rather than the stale frozen floor. No second scroll owner, persistence path, recipient-authority seam, or network state was introduced.

The regression is causal: it drives real wheel input to an asserted physical distance of zero, proves the recovery control remains available, releases the buffer, and verifies the shared thread content and metadata. Reverting only the pending-count predicate makes that exact visibility assertion fail. The refreshed-base PR diff is confined to the timeline predicate and three browser specs; the apparent larger commit delta is base integration.

Validation at exact head:

• Desktop checks, typecheck, package tests (6,164/6,164, 87 suites), and E2E build passed.
• Ordinary thread-share and physical-floor recovery passed 2/2 in isolated CI-mode Chromium; the focused dirty-edit and remote-deletion native-selection paths also passed in the product lane.
• GitHub required Desktop checks are green: Core, smoke 1–4, relay E2E, integration 1/2 and 2/2, macOS/Windows builds, security analysis, and DCO.
• Both independent lanes found no author-actionable defect.

Author action: none.

Residual confidence gaps / verification owner: reviewer/native QA tooling owns Tauri/WKWebView, VoiceOver/AX, IME, physical-keyboard, zoom/reduced-motion, very-narrow-window, and live-relay observation. These are not demonstrated code defects and do not justify author rework.

Any new head invalidates this approval.

[jedwards27]

Review verdict: APPROVE

Reviewed exact head 1813923a727bd38967e23ae44eb45d1d8600271c against refreshed base 1c3357576999f92910a57db0086844bff68c8aa0. No author-actionable defect found.

Systems and integration

• The apparent 80-file delta from the previously reviewed head is base integration, not residual feature scope: comparison against the refreshed base leaves four PR files—three browser specs and the single production predicate in MessageTimeline.tsx.
• Buffered-window ownership remains singular: useBufferedTimelineMessages freezes/releases the logical tail and derives pendingCount; Virtua/useAnchoredScroll continues to own physical mounting, measurement, bottom state, and settling. This change adds no competing scroll writer.
• The recovery seam now reflects both state dimensions: the existing recovery button renders when the physical viewport is off-bottom or the logical model has buffered work (MessageTimeline.tsx:878-905). Activation releases the frozen model first and scrolls the expanded model on the next animation frame, avoiding a scroll against the stale physical floor.
• Own-send preparation, channel-change reset, target/search navigation, drafts, recipient extraction, mention authority, persistence, relay behavior, retry, and identity boundaries remain unchanged in production.

User-contract and adversarial evidence

• The new browser regression drives wheel input, keeps the thread panel open while publishing a shared reply, returns the main timeline to a proven physical distance of 0, verifies the recovery affordance remains visible, activates it, and then verifies the shared row plus semantic payloads (messaging.spec.ts:2579-2717).
• A causal reverse mutation removing only || bufferedTimeline.pendingCount > 0 fails at the post-floor recovery-button visibility assertion (messaging.spec.ts:2682); restoring the predicate makes the test pass. The regression therefore bites the production seam rather than merely exercising a helper.
• Dirty-edit, remote-owned draft deletion, and ambiguous-recipient setup now use native selection/input paths and assert selection/replacement causality. The existing recovery affordance remains a semantic native button with a visible accessible name and decorative arrow hidden; no new focus owner, keyboard handler, or visual component was introduced.

Exact-head verification

At clean 1813923a727bd38967e23ae44eb45d1d8600271c:

• pnpm check: PASS
• pnpm typecheck: PASS
• pnpm test: PASS — 6,164/6,164 tests, 87 suites
• pnpm build:e2e: PASS
• Isolated Chromium thread-share + physical-floor recovery: PASS — 2/2, one worker, zero retries
• Focused dirty-edit/refused-navigation: PASS — 6/6
• Focused remote-owned unsaved deletion variants: PASS — 2/2
• git diff --check: clean
• Final local HEAD and freshly fetched PR head matched; tracked tree was clean
• Required GitHub checks are green, including Desktop Core, all four Desktop Smoke shards, relay E2E, both Desktop Integration shards and aggregate, macOS/Windows builds, Semgrep, zizmor, and DCO. Merge state is clean.

Confidence gaps

Native Tauri/WKWebView delivery, VoiceOver/AX, IME, physical keyboard, zoom/reduced-motion, very narrow layouts, and live-relay observation were not established by the Chromium mock-bridge evidence. These are verification gaps, not observed defects; native QA/release tooling owns them. One optional ambiguous-mention rerun failed during unrelated fixture/bootstrap setup before reaching the changed assertions, so it is not counted as evidence either way.

Author action: none.

Any new head invalidates this approval.