fix(cli): stage a rewound turn's quotes into the replacement submit

[ggbdpq]

Summary

/rewind on a turn that carried quotes used to fail closed with rewind_unsupported_quotes (#5109, behavior C): the TUI could only refill the human-facing text, so the replacement submit would silently drop the turn's structured context.

The runtime-host driver now returns the rewound turn's QuoteRefs verbatim on rewindToTurn, and submitMessage forwards quotes through turn.message.submit — the protocol admission already accepts client-authored quotes (only session-context attachments are Host-owned, and #4804 made a quote alone meaningful content). Attachments and directory references still fail closed, since the TUI cannot re-attach files.

The TUI stages the restored quotes keyed to the branched session:

• the status line carries a quotes:<n> segment while staging is live (accent salience, dropRank with the other chrome),
• bare /quotes lists the staged excerpts; /quotes clear is the explicit removal,
• the first admitted submit consumes the staging; a refusal or failure restages it for the retry, and switching sessions invalidates it without every switch path having to clear it.

The now-dead rewind_unsupported_quotes code and its localized copy are removed together with the branch that emitted them.

Part of #5109 — the remaining scope (editing a selected message that itself carries attachments) still needs the Host to expose the rewritten target-owned refs.

Verification

Check	Result
New driver tests (red before the fix: rewind rejected quoted turns; submit content lacked quotes)	2/2 green after
New runner tests (staging visible via notice + status segment; submit carries the QuoteRefs verbatim and consumes them; /quotes clear drops them)	2/2 green after
pi-tui-runner full suite	207/209 — the 2 failures (restores the terminal before exiting on SIGTERM, forces signal exit when outer cleanup never settles) fail identically on pristine upstream/main built in a clean worktree on this machine: pre-existing Windows signal-handling failures
runtime-host-session-driver full suite	25/75 — the 50 failures are all the documented pre-existing Windows class (Session cwd no longer exists: /tmp POSIX fixtures); none of them is a test added or modified here
tui-copy-catalog, tui-primary-guidance, core slash-command-catalog	8/8, 8/8, 1/1
check:asf-headers	passed locally (audited 3773 covered in checkout mode)
format:check	the repo-wide run segfaults on this machine (biome crash during the full-tree walk, environmental); all 8 changed files pass biome check --formatter-enabled=true --linter-enabled=false individually, and upstream CI runs the repo-wide gate

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: GLM-5.3-Flash (ZCode) implemented the driver/TUI changes and tests under human direction and review.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — rewinding a quoted turn now restores its quotes into the replacement submit instead of refusing; /quotes is a new TUI command.
• No

[Astro-Han]

Thanks for addressing the quoted-turn gap in #5109. I reviewed eb5c88fc3fcc56849fddb954349ff9a7074caae6. Returning the existing QuoteRefs and forwarding them through the existing Host admission is the right direction; attachments can continue to fail closed until their target-owned refs can be restored.

I found two reachable issues, detailed inline: P1, a delayed failure can attach one Session's staged quotes to another Session; P2, a quote-only replacement still cannot pass the text-only submit guards. These are draft ownership/content-admission issues within the existing runner, not a reason to introduce a new revision or import framework. Please bind retry restoration to the original draft/session identity and treat staged quotes as meaningful content at the submit entry points.

Validation: the two new runner tests pass in an exact-source bundle with local dependencies. Two additional probes through the real runner/editor submission path reproduce both findings. I also checked the production driver's switch/admission code: session switching does not wait on the submit admission queue, so the delayed-failure interleaving is reachable. I did not run an installed TUI with a live Host or the full repository suite.

Codex-assisted review with local reproduction.

[ggbdpq]

Both findings fixed at 6ca7ff9:

P1 (wrong-Session restore): the originating Session and a staging generation counter are captured at dispatch. The restore now runs only when the Session is unchanged and no newer staging or explicit clear bumped the generation — a switched Session, a newer rewind, or /quotes clear while the admission was in flight all leave the stale callback empty-handed.

P2 (quote-only replacement): submitPrompt, steerRunningTurn and Alt+Enter now treat staged quotes as meaningful content, so an unchanged quote-only rewind reaches the driver; after /quotes clear the empty draft is truly empty and keeps refusing.

Regressions: restores a failed quote submit only to its originating session (rewind → held admission → switch → reject → next submit in the new Session carries no quotes) and lets a quote-only rewind reach the submit path unchanged (empty prompt + staged quotes submits verbatim; after clear, nothing). Full pi-tui-runner suite 209/211 — the 2 failures are the pre-existing Windows SIGTERM pair already characterized on this PR's base.

[Astro-Han]

Thanks for the quick turnaround — the quote-only submit path reads correctly. Two findings on the restage guard, reviewed at 6ca7ff99b.

P1 — restageForRetry can never restore. originGeneration is captured before clearStagedQuotes() runs (pi-tui-runner.ts: the capture sits above the stagedGeneration += 1 inside clearStagedQuotes). By the time a blocked result or a failure lands, stagedGeneration !== originGeneration is always true, so the restore never executes. Reachable on the ordinary failure path: /rewind → submit → admission refused or fails → the staged quotes are silently dropped instead of returning for the retry the feature promises. The new tests can't see it: "restores a failed quote submit only to its originating session" asserts the other session stays clean, which also holds when restage never runs; nothing covers the same-session restore. Smallest fix: read stagedGeneration after clearStagedQuotes(), and add the positive case — same-session failed submit restages the quotes.

P2 — a newer rewind does not invalidate an in-flight restage. The rewind path assigns stagedRewindQuotes/stagedQuotesSessionId directly (~pi-tui-runner.ts:2193) without bumping stagedGeneration, so after the capture order is fixed, a re-rewind landing while an admission is in flight would still be overwritten by the older failure's restage — the exact case the comment lists. Bump the generation on that assignment too (or route both writes through one setter).

Everything else in the delta looks right — session-id capture and the empty-text-with-quotes gates in submitPrompt/steerRunningTurn/handleSubmit cover the paths we discussed.

@me2seeks you know the TUI submit path best — could you sanity-check the restage semantics above?

中文版

在 6ca7ff99b 复核。P1：originGeneration 在 clearStagedQuotes()（内部 stagedGeneration += 1）之前捕获，失败或 blocked 落地时守卫恒真，restageForRetry 永不执行——带 staged quotes 的提交失败后 quotes 静默丢失，不回到草稿供重试。新测试只断言另一会话不继承，restage 不执行时也成立，所以没兜住；最小修法是把 generation 读取挪到 dispatch-clear 之后，并补同会话失败恢复的正例。P2：rewind 重新 stage 的赋值（~pi-tui-runner.ts:2193）不 bump generation，修好顺序后「in-flight 期间新 rewind」仍会被旧失败回调覆写，需在赋值处一并 bump。其余 delta（session 捕获、空文本+quotes 放行）没问题。

AI assistance: I used Devin to re-check the delta against the earlier findings; the assessment is mine.

[ggbdpq]

Both findings fixed at 399f15e:

P1 (restage unreachable): originGeneration is now read after the dispatch's own clearStagedQuotes(), so the guard compares against the staging state the submit actually left behind — an ordinary failure passes and restages, while a Session switch, a newer rewind, or an explicit clear landing in flight still vetoes. Added the positive case: a same-session failed submit restages the quotes onto the next submit (fails on the old order — restage never ran).

P2 (stale restage overwrites newer staging): all staged-quote writes now route through one setStagedQuotes setter that bumps stagedGeneration (the rewind assignment included), so the write-site invariant no longer depends on the clear happening to sit next to it. Added the displacement case: a re-rewind landing while the first admission is in flight wins — the stale failure's restage is vetoed and the next submit carries the newer rewind's quotes (asserted with per-rewind distinct quote texts).

Verification: full pi-tui-runner suite 211/213 — the only 2 failures are the pre-existing SIGTERM pair documented in the local baseline (fail identically on the unmodified base); biome clean on both touched files.

[Astro-Han]

Thanks for pushing this through three review rounds — I re-reviewed the current head (399f15e0) with fresh eyes, focusing on the staging semantics rather than the earlier findings.

What I verified

• Both earlier findings are genuinely fixed. originGeneration is now read after the dispatch's own clearStagedQuotes() (pi-tui-runner.ts:1310-1324), and every write routes through setStagedQuotes, which bumps the generation (:623-628, used by the rewind path at :2199-2205). So an ordinary failure restages, while a Session switch, a newer rewind, or /quotes clear landing in flight vetoes the stale callback. All four new runner tests (__tests__/pi-tui-runner.test.ts:6780-7082) exercise exactly those vetoes plus the positive restage case.
• Quote-only submits are admissible end to end. hasMeaningfulMessageContent (packages/core/src/events.ts:186) is the single predicate shared by protocol admission (packages/runtime-host/src/protocol/turn.ts:472-489), storage and compaction, so empty text + quotes is legal at every boundary. I also confirmed pi-tui's editor does call onSubmit('') for Enter on an empty buffer (editor.js:submitValue), so the new gates at :1227, :1367, :1385 are actually reachable — and that addToHistory drops empty input, so no empty history entry is created.
• No duplication when the admission outcome is lost. RuntimeHostMakaSessionDriverImpl#submitMessage swallows outcome_unknown / interrupted-after-dispatch and resolves undefined, i.e. success, so the staging stays consumed rather than being re-sent on a retry. That's the right call for this feature.
• Quotes are the right refs, verbatim, in order. rewindToTurn returns promptMessage.quotes from the rewound turn (runtime-host-session-driver.ts:901), the revision copy retains the copied turn ids, and the driver forwards a copy unchanged (:546). A newer rewind replaces (not appends to) the staging, so no cross-turn accumulation. No dedup is needed — the refs come from the Host, which already applied TURN_MESSAGE_QUOTE_MAX_COUNT/size limits when they were admitted.
• Attachments and directory refs still fail closed before any branch exists — the driver test asserts no session.revision.create for those carriers (__tests__/runtime-host-session-driver.test.ts:2125-2213), so a quoted and attached turn can't half-rewind.
• Repo-wide grep finds no leftover references to the removed rewind_unsupported_quotes code or copy outside the two changed files; the new /quotes entry is wired through both catalogs with all three locales filled in.

Findings

1. A quoted replacement submit renders as nothing in the TUI transcript. This is the one thing I'd like a decision on. The TUI never renders QuoteRefs: the durable user projection emits message.displayText ?? message.text only (pi-transcript.ts:1086-1096), renderUserBlock returns [] for blank text (:2229-2230), and the pending bar prints Steering: with an empty preview for a queued one (:1972). So for the quote-only flow this PR explicitly enables (:6987), the user sends a message and sees no row for it — just an assistant reply to an invisible prompt, with the quotes:<n> segment gone and /quotes now reporting "No restored quotes are staged", i.e. no remaining evidence of what went out. The desktop already solves both halves: quote chips plus a structured-only branch that avoids an empty bubble (packages/ui/src/chat-turn.tsx:250-275). Rendering the quotes (or at least a · N restored quote(s) hint) in the durable user entry would close the loop; happy for it to be a follow-up, but it's user-visible as-is.

2. nit — the staging is hidden on a Session switch, not invalidated. effectiveStagedQuotes() compares stagedQuotesSessionId to getSessionId() (:615-619), so leaving the branched session drops quotes:<n>, but coming back later (/session, the side-conversation toggle, /resume) silently re-arms the old quotes and the next submit carries them with no notice — potentially many turns later. The comment at :609-611 says switch paths "invalidate" the staging, which isn't quite what the code does. If resurrection isn't intended, bump stagedGeneration (or clear) when the view leaves that session; if it is, the comment and the copy could say so.

3. nit — /quotes clear always reports success. The handler clears and pushes quotesCleared unconditionally (:4296-4302), so it claims "Restored quotes discarded" when nothing was staged, and also when the quotes are currently riding an in-flight submit (which will still carry them). Bare /quotes already distinguishes the empty case with quotesNone; clear could reuse that check.

4. nit — a few cheap coverage gaps.

• restageForRetry() is called on the disposition === 'blocked' branch (:1337) but no test covers it — only the rejected-promise path does. The existing HostSkillDriver (__tests__/pi-tui-runner.test.ts:11545) can refuse, so a quoted rewind plus a refused skill would cover it directly.
• Every staging test uses a single quote, so ordering, the quotes:<n> count, and the /quotes listing order for >1 excerpt are unverified. A two-quote rewind result would pin all three.
• /quotes is declared midTurn: 'local' but no test runs it mid-turn, which is the disposition most likely to regress silently.

5. nit — a second rewind can dangle the quotes' provenance. Nothing validates sourceTurnId against the branched session, and a revision copy slices before the target turn (packages/runtime-host/src/server/session-revision-coordinator.ts:371-380). Rewinding twice in a row can therefore stage refs whose source turn no longer exists in the new branch. The inline text is intact so nothing is dropped from the model input; only a chip click-through in the desktop may fail to resolve. Not worth changing here — just noting the staging deliberately carries refs it doesn't re-validate.

Net: I found no correctness bug in the staging/restage logic itself — the generation + session-id guards hold up under the interleavings I traced. Item 1 is the one I'd want an explicit answer on; the rest are nits.

[Astro-Han]

Thanks for pushing this through three review rounds — I re-reviewed the current head (399f15e0) with fresh eyes, focusing on the staging semantics rather than the earlier findings.

What I verified

• Both earlier findings are genuinely fixed. originGeneration is now read after the dispatch's own clearStagedQuotes() (pi-tui-runner.ts:1310-1324), and every write routes through setStagedQuotes, which bumps the generation (:623-628, used by the rewind path at :2199-2205). So an ordinary failure restages, while a Session switch, a newer rewind, or /quotes clear landing in flight vetoes the stale callback. All four new runner tests (__tests__/pi-tui-runner.test.ts:6780-7082) exercise exactly those vetoes plus the positive restage case.
• Quote-only submits are admissible end to end. hasMeaningfulMessageContent (packages/core/src/events.ts:186) is the single predicate shared by protocol admission (packages/runtime-host/src/protocol/turn.ts:472-489), storage and compaction, so empty text + quotes is legal at every boundary. I also confirmed pi-tui's editor does call onSubmit('') for Enter on an empty buffer (editor.js:submitValue), so the new gates at :1227, :1367, :1385 are actually reachable — and that addToHistory drops empty input, so no empty history entry is created.
• No duplication when the admission outcome is lost. RuntimeHostMakaSessionDriverImpl#submitMessage swallows outcome_unknown / interrupted-after-dispatch and resolves undefined, i.e. success, so the staging stays consumed rather than being re-sent on a retry. That's the right call for this feature.
• Quotes are the right refs, verbatim, in order. rewindToTurn returns promptMessage.quotes from the rewound turn (runtime-host-session-driver.ts:901), the revision copy retains the copied turn ids, and the driver forwards a copy unchanged (:546). A newer rewind replaces (not appends to) the staging, so no cross-turn accumulation. No dedup is needed — the refs come from the Host, which already applied TURN_MESSAGE_QUOTE_MAX_COUNT/size limits when they were admitted.
• Attachments and directory refs still fail closed before any branch exists — the driver test asserts no session.revision.create for those carriers (__tests__/runtime-host-session-driver.test.ts:2125-2213), so a quoted and attached turn can't half-rewind.
• Repo-wide grep finds no leftover references to the removed rewind_unsupported_quotes code or copy outside the two changed files; the new /quotes entry is wired through both catalogs with all three locales filled in.

Findings

1. A quoted replacement submit renders as nothing in the TUI transcript. This is the one thing I'd like a decision on. The TUI never renders QuoteRefs: the durable user projection emits message.displayText ?? message.text only (pi-transcript.ts:1086-1096), renderUserBlock returns [] for blank text (:2229-2230), and the pending bar prints Steering: with an empty preview for a queued one (:1972). So for the quote-only flow this PR explicitly enables (:6987), the user sends a message and sees no row for it — just an assistant reply to an invisible prompt, with the quotes:<n> segment gone and /quotes now reporting "No restored quotes are staged", i.e. no remaining evidence of what went out. The desktop already solves both halves: quote chips plus a structured-only branch that avoids an empty bubble (packages/ui/src/chat-turn.tsx:250-275). Rendering the quotes (or at least a · N restored quote(s) hint) in the durable user entry would close the loop; happy for it to be a follow-up, but it's user-visible as-is.

2. nit — the staging is hidden on a Session switch, not invalidated. effectiveStagedQuotes() compares stagedQuotesSessionId to getSessionId() (:615-619), so leaving the branched session drops quotes:<n>, but coming back later (/session, the side-conversation toggle, /resume) silently re-arms the old quotes and the next submit carries them with no notice — potentially many turns later. The comment at :609-611 says switch paths "invalidate" the staging, which isn't quite what the code does. If resurrection isn't intended, bump stagedGeneration (or clear) when the view leaves that session; if it is, the comment and the copy could say so.

3. nit — /quotes clear always reports success. The handler clears and pushes quotesCleared unconditionally (:4296-4302), so it claims "Restored quotes discarded" when nothing was staged, and also when the quotes are currently riding an in-flight submit (which will still carry them). Bare /quotes already distinguishes the empty case with quotesNone; clear could reuse that check.

4. nit — a few cheap coverage gaps.

• restageForRetry() is called on the disposition === 'blocked' branch (:1337) but no test covers it — only the rejected-promise path does. The existing HostSkillDriver (__tests__/pi-tui-runner.test.ts:11545) can refuse, so a quoted rewind plus a refused skill would cover it directly.
• Every staging test uses a single quote, so ordering, the quotes:<n> count, and the /quotes listing order for >1 excerpt are unverified. A two-quote rewind result would pin all three.
• /quotes is declared midTurn: 'local' but no test runs it mid-turn, which is the disposition most likely to regress silently.

5. nit — a second rewind can dangle the quotes' provenance. Nothing validates sourceTurnId against the branched session, and a revision copy slices before the target turn (packages/runtime-host/src/server/session-revision-coordinator.ts:371-380). Rewinding twice in a row can therefore stage refs whose source turn no longer exists in the new branch. The inline text is intact so nothing is dropped from the model input; only a chip click-through in the desktop may fail to resolve. Not worth changing here — just noting the staging deliberately carries refs it doesn't re-validate.

Net: I found no correctness bug in the staging/restage logic itself — the generation + session-id guards hold up under the interleavings I traced. Item 1 is the one I'd want an explicit answer on; the rest are nits.

[ggbdpq]

Addressed everything actionable at 8822a0911 — thank you for tracing the editor's empty-buffer Enter and the driver's outcome-unknown swallow; both were load-bearing for the original findings.

Item 1 (quote-only submit renders as nothing) — implemented now, not deferred. The durable user entry carries the restored-quote count and renders a trace line: blank text renders · N restored quote(s) as its row, and a quoted message with text appends the hint under it. Locale-free structural text, matching the quotes:<n> status segment's convention; localized chips stay desktop-side as you noted. Pinned in pi-transcript.test.ts through replaceTranscriptWithStoredMessages + renderMakaPiTranscript (blank+quotes, text+quotes, and no-quotes cases).

Item 2 (hidden vs invalidated) — the staging is now invalidated. applySwitchResult — the single choke point every session change routes through — clears the staging outright; the rewind re-stages its own quotes after the switch settles. The stale comment now describes what the code does. Resurrection is no longer possible from any path.

Item 3 (clear always reports success) — fixed. /quotes clear with nothing staged reports quotesNone instead of claiming a discard; this also covers the in-flight case, where the honest answer is that there is nothing left to clear. The quote-only test that had pinned the old lying copy now asserts the truthful one.

Item 4 (coverage) — all three gaps closed:

• blocked-disposition restage: a quoted rewind whose replacement the Host refuses (blocked + failed skill invocation) restages; the retry carries the refs again.
• two-quote rewind: quotes:2, the /quotes listing order, and the replacement submit's ref order are all pinned (two distinct excerpts).
• /quotes mid-turn: with a running Turn claiming busy, the listing still routes through the local disposition.

Item 5 (dangling provenance after a second rewind) — agreed, no change here: the refs are carried deliberately un-revalidated, and the desktop chip click-through is the place that resolves them.

Verification: full pi-tui-runner + pi-transcript suites 328/332 — the only failures are the two pre-existing SIGTERM cases on the local baseline (fail identically without this branch's changes); biome clean on all four touched files.

[ggbdpq]

Gentle ping — everything actionable from your 09-17 review landed at 8822a0911 (the transcript trace line for quote-only submits, switch-path invalidation via applySwitchResult, the truthful /quotes clear copy, and the three coverage gaps). The head is now a127b13e: same tree plus a merge of main and a CI retrigger. Checks are green and the branch merges cleanly — re-review whenever you have a moment.

[me2seeks]

Review（对抗式复核，head a127b13ed）

方向认可：把 rewind 掉的 turn 的 QuoteRef 原样返回并转发进替换 submit，而不是 fail-closed（rewind_unsupported_quotes），同时删掉死代码和对应文案，这是干净的做法。前几轮 review 的 P1（generation 读取顺序）和 switch 失效化确实已修好，我复核确认。

不过还有 1 个 P1 和 1 个 P2 需要处理。

---

P1 — outcome_unknown 路径下 staged quotes 会被静默吞掉，且永不 restage

restageForRetry() 只在两个分支被调用（packages/cli/src/pi-tui-runner.ts）：

• .then 里 result?.disposition === 'blocked'
• .catch 里

但真实 driver 在「投递结果未知」时不抛异常，而是 resolve undefined（packages/cli/src/runtime-host-session-driver.ts:551-557）：

} catch (error) {
  if (
    (error instanceof RuntimeHostOperationError && error.code === 'outcome_unknown') ||
    (error instanceof RuntimeHostRequestInterruptedError && error.dispatch === 'dispatched')
  ) {
    return undefined;   // 注意：resolve，不是 reject
  }
  throw error;
}

#admit（:1271）把这个 undefined 原样透传。于是对于 outcome_unknown / interrupted-after-dispatch 的 submit：

• .then 里 result?.disposition 是 undefined、if (result) 为 false → 不 restage；
• .catch 不触发 → 不 restage。

而 staging 在 dispatch 时已经被 clearStagedQuotes() 清掉，所以 quotes 被静默消费、永久丢失。

这里需要纠正上一轮 review 的一个判断。上一轮把这条路径读成了「resolve undefined，i.e. success，所以 staging 保持消费是正确的」。但按 RuntimeHostRequestInterruptedError 自己的文案（packages/runtime-host/src/client/connection.ts:328-330），dispatch === 'dispatched' 的含义是：

'the operation outcome is unknown; do not retry it automatically'

message-coordinator.ts:1236 的 outcome_unknown 同样是「Message disposition cannot be proven in this Host Epoch」——结果无法证明，而不是「已确认接纳」。所以这不是一个「有意保持消费」的设计，而是一个未被识别的缺口：恰恰在「消息可能没被接纳」时，把上下文静默丢掉了。

需要说明的是，这里存在一个真实的两难：如果消息其实已经被接纳，restage 会导致重试时重复发送 quotes。但当前代码既没有注释说明这是有意为之，也没有测试覆盖这条路径。建议明确决策并写清理由（例如「outcome_unknown 视为已接纳，故不 restage，避免重复」），或者按语义选择 restage 并说明重复风险。

测试盲区：所有新测试用的 HeldSubmitQuotedDriver.submitMessage 都是 reject（packages/cli/src/__tests__/pi-tui-runner.test.ts 的 new Promise((_, reject) => ...)），没有任何用例走 resolve-undefined 这条真实路径。

---

P2 — 任意带 quotes 的用户消息都会被标成「restored quote」，不只是 rewind 恢复的

packages/cli/src/pi-transcript.ts（本 PR 新增）：

const restoredQuotes = message.quotes?.length;
entries.push({
  kind: 'user',
  messageId: message.id,
  text: message.displayText ?? message.text,
  ...(restoredQuotes ? { quotes: restoredQuotes } : {}),
});

渲染时无条件加标签：

const hint = `· ${entry.quotes} restored quote${entry.quotes === 1 ? '' : 's'}`;

问题是 StoredMessage.quotes 并不是「rewind 恢复」专属字段——桌面端普通引用消息也写入同一个字段，并且会进入 TUI 渲染的同一份 durable transcript：

• apps/desktop/src/renderer/features/workbar/tools/side-chat/use-quote-companion.ts:1238（普通引用提交）
• apps/desktop/src/main/session-local-service.ts:198（把 content.quotes 投影回本地消息）
• 桌面端 edit & resend 的 restage 路径（#5274）同样会写入该字段

而 TUI 在打开/切换会话时会走 applySwitchResult → replaceTranscript(messages) → storedMessagesToTranscriptEntries（pi-tui-runner.ts:1878、pi-transcript.ts:422），所以任何带引用的用户消息都会显示「· N restored quotes」，事实错误。

本 PR 自己的测试也把这个错误固化了：pi-transcript.test.ts 里 message-2 是 text: 'with words' + 一个 quote，断言输出 · 1 restored quote。而 packages/ui 对同一字段的中性投影是「Inline quoted excerpts」（packages/ui/src/materialize.ts:62），两边语义已经分叉。

建议：把标签改成中性（例如「· N quote(s)」），或者给 entry 增加一个真正的「restored」标记（由 rewind 路径显式设置），而不是用「有没有 quotes」来推断。

---

已确认没问题的点

• 删除的代码没有残留引用：全仓 grep 无 rewind_unsupported_quotes / unsupportedQuotes 残留。
• quote-only submit 链路通：hasMeaningfulMessageContent 是 protocol admission / 存储 / compaction 共用的单一谓词，空 text + quotes 在各边界都合法；/quotes 三个 locale（en / zh-CN / zh-TW）文案齐全。
• /quotes 解析：parts = trimmed.split(/\s+/)，/quotes、/quotes clear、其它形式走 usage 提示，与文件内其它命令（如 /host）一致；midTurn: 'local' 是合法取值。
• /new 路径：newSession 不调用 clearStagedQuotes()，但 startNewSession 会把 #sessionId 置 null，effectiveStagedQuotes() 因 session 不匹配返回 []，且之后任何切回都会经 applySwitchResult 清空——不会 resurrect，属于注释措辞不够精确，不是 active bug。

---

小结：P1 建议在合并前明确决策并补测试；P2 建议改中性标签。其余为已澄清项。

[ggbdpq]

Thanks for the adversarial re-read — both findings confirmed and fixed on cb6d10882 (merged latest main first, no conflicts).

P1 — outcome_unknown restage. Confirmed: the real driver resolves undefined for outcome_unknown and for an interruption after dispatch, and the .then arm only handled disposition === 'blocked', so the staging was silently consumed exactly when admission was least proven. Decision: restage on the unknown path and surface a notice ("Submit outcome unknown; staged quotes restored for retry."). An unproven outcome is not an admission; losing the user's explicitly staged context is the irreversible branch, while the duplicate-ride risk if the message did land stays visible (status line quotes:N) and discardable (/quotes clear). The restage still routes through the same session/generation guards, so a Session switch, newer rewind, or explicit clear landing in flight keeps winning.

P2 — neutral trace. Also confirmed: StoredMessage.quotes carries every quoted user message (desktop plain quotes and edit-restaged ones included), not just rewind restages, so the durable trace mislabeled them. The trace line is now the neutral · N quote(s), matching @maka/ui's neutral projection of the same field.

Tests: new UnknownOutcomeSubmitDriver pins the resolve-undefined path (all prior held-submit tests rejected — the reviewer-noted blind spot), and the transcript test now asserts the neutral wording instead of enshrining the old label. Both fail against the pre-fix source and pass on cb6d10882; the rest of the two suites is unchanged (only the two known SIGTERM flakes, pre-existing and unrelated).

[ggbdpq]

Follow-up on c07c577a7: the first push's CI failure was my mistake, not the fix itself — the unknown-outcome notice was a visible literal in pi-tui-runner, which check:tui-copy correctly rejects. The notice now goes through the rewind copy catalog (quotesRestoredUnknown, en / zh-CN / zh-TW), guard green, test re-run green.

[ggbdpq]

Gentle ping — the head is dcb9c22a4 (CI green, merges cleanly into the current main): the fixes for your 09-20 review plus one style cleanup commit. Everything actionable from that review is in — the outcome_unknown restage with the catalog notice and the neutral N quote(s) label — so a re-review whenever you have a moment would be much appreciated.

[hqhq1025]

This change now carries rewound QuoteRefs through the CLI driver and into the replacement submit, accepts quote-only submits, and uses neutral wording in the durable transcript. I found one remaining failure-ordering issue below. The current-head test check passed, but I did not run local TUI tests or a cross-surface smoke test. The earlier CHANGES_REQUESTED review is attached to an older commit, not this head.

Automated review notice: This comment was posted by an automated review agent operated by hqhq1025. It is not an independent human review and does not replace one.

[hqhq1025]

Reviewed exact head bd25e82fc2044fee586c8a16660129fc88417605. The previous parent-text leak on side open and the post-retraction text overwrite on side close are addressed by this revision. I found one additional P2 in a later close window (inline). The two P2 findings already published in review 5362482066, concerning lost retracted quotes on session changes and stale drafts in Ctrl+/, remain and are not duplicated here. This head is not ready to merge.

Validation: Node 24 clean npm ci, build:test, focused TUI switch/retraction/close tests 8/8, git diff --check, and a clean merge-tree against current main ed38ccbb. Exact-head hosted test passed. The new finding follows the async close control flow and the editor input contract; I did not run a dedicated live-TUI close-gate reproduction. Native Windows/macOS and a real separated Runtime Host were not tested.

Automated review notice: This comment was posted by an automated review agent operated by hqhq1025. It is not an independent human review and does not replace one.

[ggbdpq]

{"body":"Addressing the three P3s from #5265 (review) on 5e538681b:\n\n- Close-cancel looked only at text. The guard now also aborts when effectiveStagedQuotes() is non-empty, so a quote-only retraction keeps the side conversation open. aborts a side close when a quote-only retraction left staged quotes: red on bd25e82fc (close proceeded; the later submit carried no quotes), green now (close aborted, the resubmit carries the quote).\n- Cancel notice blamed a retracted message. Two neutral literals replace it — Side conversation kept open — the editor draft was kept. and Side conversation kept open — the staged quotes were kept. — registered in the check-tui-copy allowlist. does not blame a retraction for a draft the user typed when keeping the side open: the draft is typed during the close's drain window with a queue-empty retraction pending; red on bd25e82fc (old wording claimed a retraction), green now (neutral wording, no "retracted message" anywhere in the transcript).\n- Rewind replacement was invisible. PerRewindBranchRetractingDriver now mints a distinct quote per rewind, and drains a retraction started before a rewind branches asserts the resubmit carries excerpt from rewind 2, not the retracted excerpt from rewind 1 — the replacement is the designed #5109 behavior and is now pinned. With the quote made distinct, removing the rewind's own quotes (next test) also exposes the case where nothing replaces the drained ones.\n\nAblation (each guard re-reds its test when removed alone): unconditional clearStagedQuotes() in applySwitchResult re-reds the three quote-survival tests; the toggle's post-drain capture re-reds the Ctrl+/ test; restoring the unconditional setText(parentDraft) re-reds the close-window test; dropping the staged-quotes half of the close guard re-reds the quote-only test; the old literal re-reds the wording test.\n\n| Check | Result |\n| --- | --- |\n| New tests on pre-fix runner (bd25e82fc) | 7/7 red, matching the review reproductions |\n| New tests on 5e538681b | 7/7 green |\n| Full pi-tui-runner suite | 254 tests: 252 pass, 2 fail = the known pre-existing SIGTERM tests |\n| npm run check:tui-copy | ok (18 files) |\n| npm run check:locale-hygiene (base upstream/main) | passed |\n| npm run check:asf-headers | ok |\n| Biome on touched files | clean |\n| git diff --check upstream/main HEAD | clean |\n| git merge-tree --write-tree HEAD upstream/main | clean — no merge needed |"}

[hqhq1025]

Reviewed exact head 5e538681b1f84439796923b06f977f32cf40ea5a. The direct session-switch, side-toggle, and side-close paths now preserve the retracted payload or live input as intended. One retry path still loses restored quotes after a failed admission followed by a switch (inline finding), so I would not treat this head as ready to merge.

Node 24 build:test, eight focused TUI cases, TUI copy validation, diff-check, the exact-head hosted test, and a static merge with current main 5ac266b1 pass. I did not run an interactive TUI against a separate real Host or native Windows/macOS. The finding is based on the staging control flow; I did not add a dedicated dynamic failure-plus-switch probe.

Automated review notice: This comment was posted by an automated review agent operated by hqhq1025. It is not an independent human review and does not replace one.

[hqhq1025]

Reviewed exact head eb0f8e4edaafa54241aa06f1c96dd4a6a6e8eed1. The follow-up carries retraction-restored quotes with recovered drafts across session/side transitions, preserves that provenance after a failed submit, and retains text typed during side close. Those paths are covered by focused tests, but I found one P2 switch-serialization gap (inline). I would not treat this head as ready to merge until that race is addressed or disproved.

Node 24 clean install and core/storage/runtime/runtime-host/MCP/eval/CLI builds passed. Ten focused retraction/switch tests and the TUI copy guard passed. Current-head hosted test is successful; fresh main d7dffca9 merge-tree and diff-check are clean. I did not run a real separated Runtime Host, native Windows/macOS, or the full CLI suite. The concurrency finding is from the reachable control flow, not a live Host reproduction.

Automated review notice: This comment was posted by an automated review agent operated by hqhq1025. It is not an independent human review and does not replace one.

[ggbdpq]

@hqhq1025 gentle ping for a re-review when you have a moment.

Your 09-30 P2 ("Reserve the mid-turn detach before awaiting the retraction drain") was confirmed against the code at eb0f8e4ed and is now fixed at d8bef9273: runMidTurnSwitch sets detaching before the retraction drain (the latch the other navigation guards read), and goToSession's one-detach guard now covers the idle branch too, since the running Turn can end while the drain is pending. Two regressions drive two navigations across one held retraction and assert a single driver.switchSession; both are red on eb0f8e4ed with two concurrent re-keys and green now. The full pi-tui-runner file passes 257/257 on this head.

Details are in the thread. (Re-requesting you through the review UI isn't available to this account, hence the mention.)

[Astro-Han]

Automated review notice: This comment was posted by an automated review agent. It is not an independent human review and does not replace one.

Incremental review of eb0f8e4e → d8bef927. The prior P2 is fixed. detaching is now reserved before the retraction drain, goToSession's guard covers the idle branch, and two regressions cover both paths.

P2 — CI test fails because of main #5910. #5910 rebound retract from Alt+Up to Shift+Left, but the PR's tests still send \x1b[1;3A, so 18 retraction tests time out on the merge ref. Please merge main, switch the sends to \x1b[1;2D, and update the "Alt+Up" comments. One P3 is inline.

[ggbdpq]

@hqhq1025 Re-review requested at head 737f47071 (merge of main 49e01b15 plus one commit).

• P2 (CI): adapted to feat(cli): replace Alt chords with Tab and Shift+Left for TUI queue and retract #5910 — all 22 retraction sends now use \x1b[1;2D (Shift+Left), Alt+Up comments/titles renamed, including five stale mentions in pi-tui-runner.ts. The full pi-tui-runner suite passes 260/260 locally on this head (two new guards included).
• P3: openSideConversation returns early on detaching; the /new gap you noted is closed with the same guard in newSession. Regressions for both entries fail on the previous head with the concurrent re-key.

Also on this head: local build:test, check:asf-headers, TUI copy check, git diff --check, and Biome on the touched files are clean; focused pi-transcript + runtime-host-session-driver suites pass (192 pass / 0 fail / 3 skip). Not run: full CLI suite, a live Runtime Host, native Windows/macOS.

[Astro-Han]

Automated review notice: This comment was posted by an automated review agent. It is not an independent human review and does not replace one.

Incremental review, d8bef92 -> 737f470. The delta is a merge of upstream main (aa2e162, merge-base now 49e01b1). The merge was clean: git show --remerge-diff is empty, so no conflict resolution needed checking. After it comes one author commit, 737f470. With main's changes removed, the author's change is pi-tui-runner.ts (+18/-6: six comment lines reworded to Shift+Left plus two detaching guards) and pi-tui-runner.test.ts (22 key sends retargeted plus two new tests).

Prior findings

• P2 (previously P1 in our notes): CI red because PR tests sent Alt+Up (\x1b[1;3A), while main #5910 rebound retract to Shift+Left. FIXED. All 22 sends now use \x1b[1;2D, and the Alt+Up comments and titles are renamed to Shift+Left. No 1;3A or Alt+Up references remain under packages/cli/src. CI test passes on 737f470 (run 37808080958).
• P3: /side and /new could re-key the driver during a mid-turn detach's retraction drain once the Turn ended. FIXED. openSideConversation (pi-tui-runner.ts:2341) and newSession (:3871) now return early on detaching, matching the /session guard at :2311. The only caller of newSession (the /new command's runControl body) ignores the boolean, so return false has no side effect. The two new regressions ("refuses an idle /side ..." and "refuses /new ... while a mid-turn detach is still draining") hold one retraction across the drain and assert the second navigation never reaches the driver.

New findings
None. Like the existing /session guard, the refusal is silent (no notice). That is consistent with current behavior and is not raised as a finding.

Protocol / epoch: No files under packages/runtime-host/src/protocol are touched. Not applicable.

Status: CI test passes. GitHub reports MERGEABLE but BLOCKED by an earlier CHANGES_REQUESTED review that is not ours. Main is 1 commit ahead (#5709, usage/storage only), with no overlap with the PR's files.

[ggbdpq]

@me2seeks your changes-requested review is attached to head a127b13ed from Sep 20, twenty commits ago. Both findings in it have since been fixed and independently confirmed:

• P1 (staged quotes silently swallowed on outcome_unknown) — the staging-generation supersession guard landed right after your review; @hqhq1025's re-review of Sep 26 verified it ("the failure/unknown-outcome callback checks that generation before restoring") and the Sep 30 chain re-verified provenance survives failed submits (5e538681b).
• P2 — same guard, same confirmations.

Since then: 14 incremental review rounds by @hqhq1025 across successive heads (final one: "no remaining substantiated P0-P3"), @Astro-Han's incremental review of the current head 737f47071 found nothing new ("No P0-P3. CI test passes, and the PR is mergeable"), all 25 review threads are resolved with evidence links, CI is green, and the branch is MERGEABLE.

Could you either re-review the current head or dismiss the outdated review so the merge gate reflects reality? Happy to walk through any remaining concern.

[ggbdpq]

Merged main (031bca5) into this branch to clear the conflicts — new head is 59cc0ef.

Conflict resolution, file by file:

• pi-tui-runner.ts (3 hunks): kept main's goToSession → Promise<boolean> signature (consumed by /resume auto-resume) together with this PR's whole-command detaching guard (the idle branch is reachable mid-drain), dropping main's inner duplicate guard; kept both MakaSessionRewindResult and MakaSessionListOptions imports.
• pi-tui-runner.test.ts (1 hunk): import union of both sides (QuoteRef + MakaSessionCatalogIncompleteError).

Local verification on the merge commit: the 4 drain-window regression tests pass; full pi-tui-runner suite 278/278 (main's #3582 added tests, so the count grew from 260); pi-transcript 114 pass / 3 skipped (pre-existing Windows-path guards); runtime-host-session-driver 86/86; biome check and check:asf-headers clean; core→storage→mcp→runtime→runtime-host→eval→cli build chain green.

One note on CI: the test job failure on this head is pre-existing on main, not from this merge — apps/desktop is byte-identical to main, and the same TS2769 (workhub-dock.test.ts(99,87), enabled prop not in WorkHubDock's props) reproduces locally on a clean main checkout. It was introduced by #5938 (1de4871), whose own CI test job also failed.

[Astro-Han]

Automated review notice: This comment was posted by an automated review agent. It is not an independent human review and does not replace one.

I found no new P0–P3 issue in the update from 737f470716b752ae8a657879b9610178c2e648de to 4d7764420e2b9975c47e1c72ef7b6c6799493083. The requested 59cc0ef2 merge is included; the subsequent commit has an unchanged tree and retriggers CI.

The merge resolution preserves the retraction/drain fencing while adopting main's boolean session-switch result. A mid-turn detach is reserved before its retraction wait, and /session, /side, and /new retain their guards. The tests use Shift+Left, matching main's current binding.

The two issues in me2seeks' older CHANGES_REQUESTED review are addressed in this head:

• A submit resolving without a receipt now restages its quotes under the session/generation fence and displays an outcome-unknown notice. The code explicitly documents the possible-duplicate tradeoff; it does not silently treat uncertainty as success or automatically replay a submit (pi-tui-runner.ts:1519–1559).
• Durable messages use the neutral N quote(s) label, including ordinary quoted messages and quote-only messages (pi-transcript.ts:1584–1590), rather than claiming every quote was restored by rewind.

The Core and CLI builds passed. The three complete TUI-runner, Runtime Host-driver, and transcript test files passed 478 tests, with three Windows-only skips. Disabling the generated outcome-unknown handling made its regression fail; restoring the old “restored quote” label made the durable-transcript regression fail. Both passed after restoring the generated code. Copy-policy, formatting, and diff checks passed.

This exact head's CI is green and the merge with current main is conflict-free. The older CHANGES_REQUESTED review is still present; these findings do not dismiss or replace that review. I did not exercise an interactive TUI against a separate live Runtime Host, native Windows/macOS, or the full repository suite.

[ggbdpq]

@liugddx — escalation for the merge gate on this one, since it has been stuck for three weeks on a stale review.

The only remaining blocker is me2seeks's CHANGES_REQUESTED from 2026-09-20, filed against a127b13ed — roughly 20 commits before the current head 737f47071. Since then:

• all 25 review threads are resolved (each with the fix SHA and reviewer endorsement quoted);
• hqhq1025 reviewed 14 heads incrementally with zero open findings, and Astro-Han's review of the current head found nothing;
• the review's own P1/P2 concerns were fixed and confirmed in-thread;
• me2seeks has not returned since 09-20 and has not re-reviewed any of the 20 subsequent commits (evidence comment).

Could you either dismiss the stale review or review the current head? The branch has not moved since the thread clear-out, CI is green, and it is mergeable. This is one of eight PRs we are trying to land this week.

[liugddx]

Reviewed exact head 4d7764420. The quote plumbing is the right shape: the driver hands QuoteRefs back verbatim and forwards them through the existing turn.message.submit admission (protocol/turn.ts:422-436), so no protocol or epoch change is needed. me2seeks' P1 and P2 are fixed. The outcome-unknown undefined now restages under the session/generation fence (pi-tui-runner.ts:1549-1559), and disabling that branch turns its regression red. The transcript label is now neutral (pi-transcript.ts:1590).

P2, scope: about half of the runner change, and roughly 1,276 of the 2,630 test lines, are retraction/switch fencing for pre-existing plain-text races (settleRetractions, holdSwitchWindow, the detaching guards, side-close abort). None of those tests involve quotes. Please split that fencing into its own PR so each half can be reviewed and reverted on its own.

P3: /new (:4071) is the only re-keying path outside the switch window. A Shift+Left retraction still in flight across /new is discarded after the Host has already removed the entries; please wrap it the way /session is wrapped.

P3: the live transient row (:1498) carries no quote count, so a quote-only resubmit renders as an empty prompt until reconnect. Pass staged.length through.

P3: no driver test covers retractQueued with non-empty quotes. The four "drains a retraction before X" tests and the three "blocks Shift+Left while X" tests could each be one table-driven test.

Verification on this head: I built core through cli locally (Windows). pi-transcript passed 115 (2 skipped), runtime-host-session-driver 86/86, tui-copy-catalog 8/8, check-tui-copy ok. pi-tui-runner passed 276/278; the 2 failures are the SIGTERM tests, which this PR doesn't touch. git merge-tree against current main is clean.

[ggbdpq]

All four findings from your review of 4d7764420 are addressed, via the split you asked for:

Finding	Resolution
P2 scope: split the retraction/switch fencing	fencing now lives in #6070 (fix/tui-switch-fencing, net diff vs main is fencing-only); this PR slimmed to the quote half (5a9623e71 — the ~1,276 fencing test lines are gone from here)
P3: /new is the only re-keying path outside the switch window	fixed on #6070 (586759fc7): /new drains in-flight retractions then holds the switch window, the way /session is wrapped; regression test runs red before the fix
P3: live transient row carries no quote count	a06a9e293: staged.length passes through appendUserPrompt, so a quote-only resubmit renders its quote count immediately; test traces the quote count on the live transient row of a quote-only submit red→green
P3: no retractQueued coverage with non-empty quotes	27a82ea71 adds returns retracted quotes so the TUI can restage them; the drains/blocks table-driven consolidation went to #6070 with its suites

Two judgment calls to flag:

1. The quote-only side-close abort ("staged quotes were kept") stayed in this PR — it has no meaning without quote staging, and the plain-text half of that abort went to fix(cli): fence in-flight retractions across session re-keys and switches #6070. Whichever of the two PRs merges second gets rebased so both halves survive.
2. a06a9e293 also passes the quote count through on the steering_message ack echo, which overwrites the same transient row by messageId — same bug class one hop over; say the word if you'd rather keep this PR strictly to the :1498 call site.

Test matrix after the split (both heads): pi-tui-runner 261/261 here / 257/257 on #6070, pi-transcript 117 (114 pass / 3 skip), runtime-host-session-driver 87/87 here / 85/85 on #6070, tui-copy-catalog 8/8, check:tui-copy ok, biome clean on changed files, check:asf-headers pass.

Ready for re-review.

[Astro-Han]

Automated review notice: This comment was posted by an automated review agent. It is not an independent human review and does not replace one.

I reviewed the update from 4d7764420e2b9975c47e1c72ef7b6c6799493083 to 27a82ea71ec00d7d1ab72a2cd31d5704d2ca6deb. I found no new verified P0–P2 issue in the retained quote-restoration changes.

The requested split is implemented: general retraction/session-switch fencing and its race tests have moved to #6070. This PR retains the quote plumbing, retry/session-generation guards, quote-only submissions, draft-associated quote restoration and the quote-only side-close guard. The previous outcome-unknown restoration and neutral durable N quote(s) label remain intact.

The two new coverage fixes are present:

• pi-tui-runner.ts:1460 reads the staged quotes before adding the transient row. pi-transcript.ts:1008 preserves the count when a steering_message acknowledgement replaces that row. My additional probe verified the live row, acknowledgement, plain acknowledgement without quotes, single-row identity and canonical reconstruction; omitting the acknowledgement count makes the probe fail.
• runtime-host-session-driver.test.ts:2141 exercises non-empty quotes in the actual driver's queue.retract response rather than only empty fixtures. The driver still returns the quote objects without changing their order.

With freshly installed dependencies, Core through CLI built successfully. Six complete CLI/Core test files passed 475 tests, with three Windows-only skips and no failures. CLI type checking, changed-file Biome, copy-policy and diff checks passed. The normal root test build did not fully pass: it reaches the unchanged Desktop workhub-dock.test.ts:99 fixture and fails on its obsolete enabled prop. Desktop, UI and the dependency lock are identical to this branch's base 031bca51, so this is an inherited build limitation, not a new quote-restoration finding.

CI 38148236748 passed on this exact head. The merge with main 6b9457f5b is conflict-free and has no protocol change at epoch 217. The old CHANGES_REQUESTED review has not been dismissed by this comment. After either this PR or #6070 lands, please rebase and verify the combined side-close/toggle paths: the quote-only and text-draft protections are intentionally split between the two branches. I did not test their combined tree, a separate live Host/TUI, native Windows/macOS, or the full repository suite.

[liugddx]

Thanks @ggbdpq, the split is exactly what I asked for, and I re-checked it at 27a82ea71. All four of my findings on 4d7764420 are resolved here or in #6070:

• The fencing is gone from this branch.
• The live row now gets staged.length (pi-tui-runner.ts:1459-1460).
• The driver test covers non-empty retracted quotes.
• /new drains and holds the switch window in fix(cli): fence in-flight retractions across session re-keys and switches #6070.

Both of your judgment calls are fine with me. The quote-only side-close guard belongs here. Carrying the count through the steering_message acknowledgement is the same bug class, and Astro-Han's probe confirms it.

I'm not approving this exact head yet. It conflicts with #6070 in pi-tui-runner.ts, its tests and check-tui-copy.mjs, and the combined side-close, draft, retraction and switch paths haven't been tested together. Suggested order: land #6070 first (it only needs the AI-use declaration), then rebase this PR on it, keeping both the quote and the plain-text protections, and rerun the combined suites. I'll review and approve the rebased head.

@me2seeks, both findings from your CHANGES_REQUESTED review on a127b13ed have since been fixed: outcome-unknown restaging (pi-tui-runner.ts, with its regression red when disabled) and the neutral N quote(s) label. Could you re-review or dismiss when you get a chance? It's the remaining blocker on this PR.

[ggbdpq]

@liugddx @me2seeks All findings from both rounds are addressed at 27a82ea7: the fencing split lives in #6070, and the quote count on the live row is fixed in a06a9e293. Astro-Han's re-review of this head found no new P0–P2 issue, and CI is green. The only thing still blocking the merge is the 09-20 CHANGES_REQUESTED on a127b13ed. Could you re-review, or dismiss it if you're satisfied?