refactor(desktop): load the transcript whole and virtualize it in the renderer

[Astro-Han]

Summary

The Desktop transcript was a sliding window: the Main replica paged durable history in and out under the reader, and the renderer carried a range store, gap rows, prefetch bands and eviction to match. Scrolling near a boundary changed what existed, so the scrollbar resized under the thumb and both directions stuttered. #5315 reduced that; it could not remove it, because the authority for what the reader can see was still moving while they read.

This moves the boundary. The renderer reads the whole durable transcript once — bounded on the first read by DESKTOP_TRANSCRIPT_HISTORY_MAX_BYTES (64 MiB) — and never evicts, so the set of Turns is fixed for the life of the session. Anything past that bound is reached through an explicit 载入更早的记录 control rather than by scrolling into it. Only the DOM is virtualized, by virtua, which bounds the mounted row count without making the set of Turns elastic.

That deletes the server-side transcript pager, the windowed store queries and their contract, the renderer range store, gap rows, prefetch, eviction, and the pin bookkeeping that existed to survive them. The deletion and the whole-transcript read change the same reader contract in the same files, so they land in one commit; the code leading, the measure-ahead margin, the memory measurement, each review fix and the test-tier move stand alone and revert alone.

Since #5365 every committed event takes the next ordinal and a running Turn's rows are durable pages, so the Desktop overlay that carried the running Turn beside durable history is gone too — replica overlay, overlay bootstrap page, loadTranscriptOverlay and the fragment source field. The merge rebuilt this branch on that model rather than carrying the overlay forward.

The wire loses the turn-range operation and its cursors, a review fix adds one field to the transcript page, and session.turn_landmarks.query returns backed by a Turn extent index with a lastSequence per landmark, so RUNTIME_HOST_COMPATIBILITY_EPOCH lands at 161 (#5308 took 159, main has since taken 160) — mismatched peers refuse each other at the handshake rather than at a read.

Two separate commits fix jumps that survive the refactor or arrive with it:

• Code blocks shrank during layout. Astryx's CodeBlock gives each 20-line chunk contain-intrinsic-block-size: 20lh, and lh resolves against what the box inherits. Maka's markdown contract sets line-height: 1.6 on the prose root while scripts/build-astryx-theme.mjs strips Astryx's own :where(code, pre) reset, so every chunk reserved 12% more height than its lines need and Chromium shrank the block by ~48px per chunk as it laid each one out. Declaring the code leading on pre makes placeholder and chunk agree. Astryx 0.6.2 ships the same CodeBlock byte-for-byte, so upgrading does not fix it.
• Rows were measured too late. virtua corrects scrollTop for a row measured while it is entirely above the viewport and declines to correct one still straddling the top edge. Its measure-ahead margin defaults to 200px; a wheel notch travels 600, so a Turn went from unmounted to straddling within one notch. Mounting 2000px ahead gives the measurement room to land first: on the 24-Turn mixed scene, ticks that moved the reader go 13 → 1, and 0 once every row has been measured. Against main on the 500-Turn e2e fixture, reader displacement is ≤0.2px in both directions where the pager moved it 48–239px at code blocks. itemSize — a constant in place of virtua's estimator — was tried and ablated away: it is a systematic over-estimate, so the document shrank as it was read and the scroller clamped a reader near the tail back onto it.

The geometry gate (scripts/perf/geometry-ablation.mjs --assert-stable) asserted that scrollHeight never moves and scrollTop never runs backwards. Both were proxies for the reader holding still, exact only while the whole transcript was in the DOM — under virtualization, scrollTop running backwards is the correction that holds the reader still. The gate now measures the reader directly (the anchored Turn must travel exactly as far as the wheel asked), hard-asserts it once every row has been measured, allows one slip on the first read over unmeasured rows, and records the cost of estimating without a threshold. Its membership assertion accumulates Turn ids across the sweep and requires the union to be exactly the fixture, instead of requiring all 24 rows at every instant.

Refs #5315

Review fixes

@liuxiaocs7's review found seven defects; CI found an eighth in the fix for the fourth; a follow-up review found five more; an internal review traced the rest to one missing authority, fixed under Turn extent index. All were reproduced first — most against the real Host, real SQLite or real layout — and each regression fails on the commit before its fix. Each was re-checked after #5365; the table says where the fix changed shape.

Two share a cause: a resident whole transcript removes eviction, not the need to know where a Turn begins and ends. Turns nest: a Turn started inside another takes ordinals between the outer Turn's rows, so the owner changes twice inside one Turn's extent, and a change of owner says nothing about whether a Turn is complete. (This description earlier also claimed rows could arrive below a watermark the reader already holds, because a Turn's rows became durable only when it ended. #5365 removed that — every event is durable at MAX+1 — and the test built on it is deleted.)

Recovery rebuilt the history from a budget count	runtime-host-session-observer.ts	A reset cleared the consumer's delivered boundary and rebuilt from transcriptHistoryBytes × budgets — how many times the reader had pressed the control, standing in for where its history reached. After four Turns, a same-session slow_consumer recovery handed back one. The boundary is the fact, so a reset reads back down to it; the counter is deleted. The reread stays because a reset replaces everything the reader holds: stopping at one budget would take back history the reader had loaded.
Settlement trusted the tail	session-message-settlement.ts	It skipped the targeted Turn read whenever the tail held a terminal row for the required Turn. A byte-bounded tail can begin inside that Turn — ending present, earlier rows not — so a Turn with a hole settled as whole. Deleting the shortcut alone would not have fixed it: the read was launched without being awaited. Completeness is now claimed only when that read returns carrying the Turn's ending.
A nested Turn ended the read of the Turn around it	desktop-transcript-replica.ts	readTurn treated a row owned by another Turn as the end of its target. Ownership filtering now runs to the watermark: a row of another Turn is not evidence about where this one ends.
A history answer was cut at a change of owner	runtime-host-session-observer.ts, session-transcript-reader.ts	The same contiguity assumption in the main history path: an answer could end with an outer Turn's tail and hold its opening back for the next load-earlier. No local rule is authoritative, so every transcript page reports whether it stops between two Turns — the wire field, and one reason for the epoch bump. The Host decides it from the Turn extent index below: a page stops between Turns only where no Turn's extent crosses its edge. (Two earlier versions decided it locally — a per-cluster numbering, then a walk tracking how far each entered Turn reached — and both missed a Turn with no rows on the page.) The Desktop reads whole pages and ends an answer only on a page the Host called whole, which deletes the row-by-row carry buffer outright.
…and pages almost never stopped between two Turns	session-transcript-reader.ts	Pages are cut by bytes, and transcript rows are large enough that the cut nearly always falls inside a row. The flag above was therefore almost always false and an answer ran past its byte budget to the bottom of the transcript — the e2e fixture, 18 Turns of 180 KiB against a 1 MiB budget, arrived as one answer. A page that would stop inside a Turn now gives back what came after the last point it was between Turns and stops there; only a Turn reaching the start of the page is still served in byte slices, which is the case the flag exists for. Now that a running Turn is durable, the same cut applies to it.
A prepend slid every measured height	chat-view.tsx	virtua indexes measured heights by position and grows that cache at the end unless shift says otherwise, so earlier history arriving detached every height from the Turn it was measured on — 200px of displacement on revisiting rows the reader had been past. shift is computed per projection identity, and only when the list grew at the front.
The hold was dropped when the reader moved	use-chat-scroll.ts	The hold taken when the control is pressed installed its cancellation listeners only after the prepend landed, so a reader who changed their mind during the read was carried back — 1800px in the story. Abandoning the hold on input was no better: the reader's position then depended entirely on virtua's 150 ms "still scrolling" shift window, which a slow machine misses, and CI caught the 44px the retiring control takes with it. The hold now re-anchors on every scroll for the life of the read, so what lands is wherever the reader went last.
The control hid exactly when it was needed	chat-view.tsx	It lived inside the branch the empty state replaces, so a WorkHub filter that empties the transcript — a Work whose Turns are all in unloaded history does — left the reader with an empty panel and no way out.

The follow-up review's five share a cause too, and it is the first round's mirror image: the fixes above moved how much transcript do I have to the Host, and three consumers were still answering it locally — a second pager, a per-connection consumer, and a tail assumed to begin where a Turn begins. The fourth is the same mistake in the renderer, where reader input stood in for an authority that already exists.

A guest's page was not cut where an owner's is	session-transcript-pager.ts, session-transcript-reader.ts	The shared projection was a second pager: it re-read what the reader had already cut, hid rows, and published its own boundary — so the rollback never applied to it and a guest's renderer read the whole transcript (512 Turns, 94 MiB, against a 64 MiB budget). A projection is now a function the one reader applies as it cuts, because a row the guest never sees must not take up room on their page either. readSharedDurablePage is deleted. Re-checking this after #5365 found the reader's lazily prepared wrapper dropping the projection argument, so a guest page was read unprojected; it now passes through, and the test reads with a projection that hides every row.
A replaced connection reopened onto a budget	runtime-host-session-observation-registry.ts	The delivered boundary lived on the consumer, and a consumer dies with the connection that made it; the reader it feeds does not. Reattaching a Host source therefore reset a reader who had loaded back to Turn 1 to the initial budget's tail. The boundary now lives on the registration, which outlives the connection, and the reopened consumer resumes from it.
A tail can begin inside a Turn	desktop-transcript-replica.ts, session-message-settlement.ts	The targeted-read fix above only helped callers that name a Turn. Side Chat reseeding names none, so it settled on a byte-bounded tail whose first Turn was missing its middle. Nothing in the tail says which rows are missing, so the Host's page boundary is carried through the replica to settlement as beginsAtTurnBoundary, and a caller that names no Turn still gets a whole one. Eviction clears the flag: it groups rows by owner, which is not where a Turn ends.
A navigation command lost to the prepend hold	use-chat-scroll.ts, transcript-scroll-authority.tsx	The landing loop that holds the reader for 30 frames released only on wheel, touch or key — a proxy for "the reader took over" — so the return-to-tail button or a search jump in that window was written back (33,228 → 8,506 in the review's probe). The scroll authority is what actually knows: every navigation goes through its pin. It gained a command seam, and the hold is cancelled from there; input keeps its own listeners because while the read is still pending it means something different — it moves the hold rather than dropping it.
Electron asserted renderer geometry	transcript-full-delivery.spec.ts, partial-history-notice.spec.ts	Traversal distance, mounted-row bounds, return-to-tail residual and post-prepend displacement are all owned by the browser stories over real layout. Real wheel input and CDP do not make them an Electron boundary. Deleted, with their helpers and a 180s timeout; partial-history-notice.spec.ts keeps bounded pages on request. transcript-full-delivery.spec.ts was later removed too: on CI it timed out cold-starting its 500-Turn window before any assertion, and the whole-read contract it guarded is asserted in runtime-host-session-observer.test.ts. A second partial-history-notice case (a far tick reads down once and lands) was dropped for the same reason: each step already has a unit test. NavigatingDuringAHistoryLoadOutranksTheHold became a use-chat-scroll unit test; only PrependedHistoryKeepsMeasuredHeights needs real layout and stays a story.

Turn extent index

A third, internal review found the remaining defects share one cause: where a Turn is and where a Turn ends were still answered by local rules in three places. The page reader inferred boundaries from the rows it walked, so a Turn enclosing a page without rows on it went unseen. The renderer found a bookmark or search target by loading page after page until it appeared, which was unbounded and stalled on a page that did not advance. And the rail could only tick Turns already read. Retiring session.turn_landmarks.query with the window had removed the one authority for both questions, so it comes back on a table that cannot drift from the transcript.

runtime_session_turn_extents(session_id, turn_id, first_ordinal, last_ordinal) is written in the same transaction as each visible ordinal insert. It is rebuilt when ordinals are resequenced, backfilled by schema migration 19, and deleted with the Session. A handoff or continuation that reuses a turnId widens the same extent.

Page boundaries	session-transcript-reader.ts, runtime-transcript-query.ts	A page stops between Turns only where readTranscriptTurnCrossing finds no extent spanning its edge. The walk's reach tracking and handoff-neighbour special case are deleted, and so is the accepted cost that a Turn the page never visited could be missed.
Where a Turn is	protocol/session-turns.ts, session-catalog-coordinator.ts	session.turn_landmarks.query answers from the index: up to 64 sampled, labelled landmarks for the rail, or one Turn's sequence and lastSequence by turnId. Owner credentials holding session.turns.query are migrated to the new grant as well.
Reading one Turn	runtime-host-session-observer.ts, desktop-transcript-replica.ts	readTranscriptTurn reads through the Turn's lastSequence instead of scanning to the watermark.
Reading down to a Turn	runtime-host-session-observer.ts, IPC, preload	loadEarlier(throughSequence) asks Main for everything down to a sequence in one answer, still ending only between Turns. A reopen passes the oldest held sequence as resumeFrom, so a reconnect restores the range the reader had rather than a budget.
Bookmark and search restore	transcript-reading-position.ts	A target not loaded is looked up once and read down to once, then lands or is reported unavailable. The page-by-page loop is deleted.
The rail	prompt-anchor-rail.tsx, chat-view.tsx, use-chat-scroll.ts	Ticks cover the whole Session. A tick outside the loaded range requests history down to its Turn and navigates to it; the navigation waits for the Turn to arrive and lands it at the top (see below).
A reload onto the cached view never recovered	desktop-transcript-range-store.ts	A reload that fell back to the local cache reported no failure, so recovery never retried once the Host returned. It now reports the failure like an open does.
The perf specs waited for a Turn that does not exist	scripts/perf/*.spec.ts	The fixture seeds 500 Turns; the navigation, geometry and scroll-input cases waited for Turn 120 as the tail. Scroll input also jumped to the top of the loaded history before measuring, which with the whole history loaded is Turn 1 and left nothing to travel; it now travels 60 Turns up from the tail and bounds mounted rows by that travel.

One owner for scroll writes

The same review's last cause: virtualization makes the DOM a cache, but several writers still treated it as the truth, and each took turns at scrollTop with its own idea of the list.

A search landing outlived a return to the tail	use-chat-scroll.ts	The search reveal kept writing for its mount frames after pinToTail.
The reader hold ignored the pin	use-chat-scroll.ts	holdReader restored the reader's Turn even when the transcript was following its tail.
The prepend shift guessed from the first Turn	chat-view.tsx	shift was set whenever the first Turn id changed and the list grew, so a cleared WorkHub filter — Turns returning between the ones held — shifted virtua's height cache by the wrong amount and detached every height from its Turn.
A selection starting outside every Turn lost its middle	chat-view.tsx	An end on the load-earlier control or the pending tail mapped to no Turn and was dropped, so the Turns it spanned could unmount out of the selection. It now counts as before or after every Turn by document order.

The fix is not four patches. transcript-scroll-authority.tsx now owns every intentional write in exactly one of three states — pinned, positioning one Turn at one place, or writing nothing — and every command and every reader input ends a positioning. A positioning is either a navigation (bookmark, search, rail; it can wait for a Turn not loaded yet) or keeping a released reader's Turn at the same gap while the list changes under them. useChatScroll classifies each list change as append, prepend or reset: a prepend shifts virtua's cache, a reset starts a new one through the Virtualizer key, because no cached position means what it did. That deletes subscribeCommands, holdReader, pendingReveal, the reader-input hold and the chat-view shift heuristic; the command-seam fix in the follow-up table above is superseded by it.

Second internal review

Its findings reduced to two causes.

Reaching a Turn took a settled request for an outcome. A far jump is a lookup, a read down to the Turn and a navigation, and each step treated its promise resolving as having got there.

A reopen during the read declared a bookmark unavailable	transcript-reading-position.ts	A range that reopens drops the earlier answer while loadEarlier still resolves, so the restore latched loaded, found no Turn and cleared the bookmark; a search target just stopped. A read now counts only if the range generation it started in is still current; otherwise the Turn is looked up again.
A failed index read was never retried	transcript-reading-position-controller.tsx	The index is read again when the range reopens, and the previous one stays on screen until it answers.
A rail navigation waited forever	transcript-scroll-authority.tsx, chat-view.tsx	A navigation carries what brings its Turn; once that settles and the list has rendered, it lands or ends. Before, reading-position reports stayed suppressed and an unrelated load later pulled the reader away.
A Turn read trusted every page	desktop-transcript-replica.ts	It now refuses an empty continuation and rows that do not advance, as catch-up already did.

The Turn extent index decided visibility twice, under different assumptions.

One undecodable opening made the store unopenable	runtime-transcript-query.ts	Migration 19 ran json_extract over every opening, so a malformed payload failed it, rolled the version back and failed the next open the same way. The shared visibility predicate checks json_valid first.
An event committed before its opening had no extent	runtime-transcript-query.ts	An opening now covers every event its invocation already committed, so the index does not depend on commit order.

Checked and not changed: turnAt does not need the start margin subtracted (virtua's findItemIndex already does), and the landmark result is decoded and identity-checked at the Host protocol boundary.

The staged protocol-epoch hook compares against HEAD, so it rejects a merge commit and any later protocol commit on a branch that has already bumped. The merge and feat(runtime-host): say where a Turn ends in its landmark were checked with node scripts/protocol-epoch-check.mjs --base origin/main --head <rev> and committed with --no-verify.

Not changed: WorkHub's resultPreview (create-workhub-services.ts) computes and caches a 600-char preview that nothing renders, on main either. #5150 said it would be displayed and that never landed; deleting a shipped intent inside a refactor is the wrong place for that decision, so it is raised separately. It is a cross-Session readTurn consumer, so it does get the nested-Turn fix.

Accepted costs

Reviewing this PR means agreeing to these.

• Offscreen Turns are no longer in the DOM, so the browser's own in-page find cannot reach them. The story asserting otherwise (OffscreenActiveTurnsStayFindable) is deleted; transcript search already goes through the indexed path.
• Reaching a far Turn loads everything in between. The loaded range is contiguous down from the tail, so a tick, bookmark or search result outside it reads all history down to that Turn in one request. Nothing is read twice.
• Guests have no Turn index. Landmarks are owner-only, in both the grant and the IPC. A guest's rail covers only loaded history, and a guest's bookmark or search target outside it is reported unavailable instead of being paged toward.
• WorkHub's Session surface has no Turn index either, so its rail covers only loaded history.
• A per-Turn read cannot be cancelled. Settlement stops waiting at its deadline, but Main's readTranscriptTurn keeps waiting for the Host and holds the Session's observation until the Host answers. It releases once the Host recovers.
• A change to the list has to keep the reader itself. virtua shifts its offset for a prepend only while it still counts itself as scrolling (it stops 150 ms after the last scroll), and a reset discards its measurements. The scroll authority records the reader's Turn and gap and places it back for 30 frames while the rows around it measure, including the start margin the retiring control takes with it.
• Disclosure state the reader expanded inside a row resets when the row unmounts — a processing block, tool details, a quote chip, a Mermaid source toggle, a collapsed code block. Keeping it would mean lifting each component's open state out of Astryx and our own components into a transcript-level store, which is more surface to own than the state is worth; a Turn scrolled far away comes back collapsed.
• The scrollbar is an estimate over rows not yet measured. On the 24-Turn mixed scene the document's extent settles over a range of ~5,900px out of ~30,000, and is exact from then on. This is the cost of not mounting the whole transcript.
• A Turn taller than the 2000px measure-ahead margin moves the reader once, when first measured — 365px on the mixed scene. It cannot be measured before it is reached, and raising the margin to 4000px moved the number rather than removing it.
• Renderer memory is bounded by the size of the Session already read, not by DESKTOP_TRANSCRIPT_HISTORY_MAX_BYTES. That constant bounds a single history read; loads of earlier history and new messages accumulate on top of it, and DOM virtualization bounds mounting, not residency. apps/desktop/perf/transcript-memory.spec.ts weighs that in a real renderer and asserts the shape that matters — a switch away replaces the retained transcript rather than adding to it. Measured numbers: a 64 MiB read costs ~94 MiB of heap, each further load the same again, and three large transcripts visited in turn leave 70.7 / 70.9 / 71.2 MiB behind. It seeds ~360 MiB and takes minutes, so it is not a CI gate; run it with npm --workspace @maka/desktop run measure.

New dependency

virtua@0.48.8, MIT (Category A), no runtime dependencies; only its React adapter reaches the renderer bundle, and THIRD_PARTY_NOTICES.txt carries its licence. It is the one thing this PR adds rather than deletes.

Reading the whole transcript and mounting the whole transcript are separate decisions: the first fixes the set of Turns, the second is what a virtualizer prevents — asserted over real layout in UpwardTraversalHoldsTurnGeometry. What is hard is not rendering a slice; it is measuring rows of unknown height, compensating scrollTop when a measurement above the reader changes one, and keeping the reader still across a prepend. LobeHub virtualizes its chat transcript with virtua ^0.48.8 — same library and version — in a 418-line component; OpenCode uses @tanstack/solid-virtual (605 lines plus 75 for a scroll-offset observer) and carries a patch against @tanstack/virtual-core for exactly the prepend case handled here. Neither wrote their own.

Verification

After the second internal review's commits:

• npm run format, npm run lint, @maka/desktop typecheck, check-renderer-architecture --base origin/main --strict-base
• @maka/storage (1397 pass, 8 skipped; one stale dist file with no source), @maka/desktop main (2668/2668), @maka/ui (490/490)
• e2e partial-history-notice, transcript-full-delivery, workhub-return-rail, session-local-recovery (8/8)

The storage regressions were not replayed against the previous commit; the malformed-JSON failure was confirmed directly against SQLite.

After the scroll-owner commits:

• npm run format, npm run lint, @maka/desktop typecheck (preload, main, renderer, storybook)
• @maka/ui (489/489), @maka/desktop main (2665/2665)
• e2e partial-history-notice, transcript-full-delivery, workhub-return-rail, workhub-layout, streaming-remount, quote-window-boundary, session-local-recovery (16/16)
• perf frontend.spec.ts, geometry-navigation.spec.ts, scroll-input.spec.ts — dense upward input travels 60 Turns in 240 wheel ticks with at most 12 rows mounted and no long task

The new authority tests drive frames directly, so a list change, a superseded navigation and reader input ending a positioning are asserted in the unit tier. They were written against the new interface and were not replayed against the previous commit.

After the Turn extent index commits, including the merge of main that took epoch 160:

• npm run format, npm run lint, @maka/desktop typecheck (preload, main, renderer, storybook)
• @maka/storage (1389 pass, 0 fail), @maka/desktop main (2687/2687), @maka/ui (484/484)
• the @maka/runtime-host transcript reader, session-turns and authenticated-websocket grant tests
• e2e partial-history-notice (with a new case: a far tick reads down once and lands), transcript-full-delivery, workhub-return-rail
• the perf navigation case in scripts/perf/frontend.spec.ts

A regression test for each fix fails on the commit before it. The landing position after a rail jump is measured only in the e2e, because the unit DOM runs no frames.

After the earlier merge with main (#5365, #5308, #5368): npm run format, npm run lint, @maka/desktop typecheck (preload, main, renderer, storybook), @maka/desktop main (2658/2658), @maka/ui (482/482), @maka/storage (1378 pass, 8 skipped), @maka/runtime-host transcript and session suites (378/378), check:e2e-budget, check:renderer-architecture, check:asf-headers, and e2e partial-history-notice, transcript-full-delivery.

Before the merge, and not rerun since: the rest of @maka/runtime-host, check:app-shell-hooks, check:locale-hygiene, the full Storybook render smoke (367 stories, 396 theme renders), the geometry gate on all three scenes, and e2e quote-window-boundary, session-local-recovery, streaming-remount. CI covers these.

Not run: the whole-repo suite.

One caveat on the gate: its cold-sweep bound is one slip, and on a busy machine the 24-Turn mixed scene occasionally costs two — three of five local runs gave one, two gave two, with the worst displacement unchanged at 365px and the warm sweep exact every time. It has been green on CI on every revision so far. The count depends on whether an oversized Turn is measured before the reader reaches it, which is a scheduling question, so the bound may need to be stated per oversized Turn rather than per sweep.

Same story (NestedScrollerNearHistoryBoundaryAsksForNothing), same viewport, BEFORE from main's storybook-static:

The code-leading commit has no steady-state pixels to show — it removes a transient shrink during layout.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Claude Code — implementation, the virtua and Astryx source reading behind the root causes, the measurement harnesses, the merge with main, and this description.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[likun666661]

整体认可这个简化方向：保留已加载历史、只虚拟化 DOM，确实能删除大量窗口预取、淘汰和导航协调逻辑；代码块行高修复也直接针对根因。

这里最主要的风险是更高的 Renderer 内存负担，需要明确：DESKTOP_TRANSCRIPT_HISTORY_MAX_BYTES = 64 MiB 是每次历史读取的预算，并不是 Renderer 的总内存上限。读取会补齐预算边界上的 Turn，后续“载入更早的记录”和新消息会继续累积；Renderer 还保留消息对象、序列化字符串和索引，实际堆占用会高于消息字节数。DOM 虚拟化解决的是挂载与布局成本，并不限制这些数据的驻留成本。

另外，搜索或恢复到很早的 Turn 现在会反复 loadEarlier()，直到找到目标，用户即使没有连续点击加载，也可能加载大量中间历史。

建议合并前补一组大历史场景的内存验证：首次打开接近/超过 64 MiB 的会话、连续加载更早记录、搜索跳到很早的 Turn，以及切换/关闭会话后的内存释放。记录 Renderer JS heap 与进程内存的峰值、稳定值和加载耗时，并说明可接受范围。无需先增加新的缓存或淘汰机制，但需要用这些数据确认这次简化的内存代价可接受，并把“64 MiB 读取预算”与“总内存上限”在描述中区分清楚。

[liuxiaocs7]

Automated review by Codex (AI), posted at the contributor's request.

I would not merge revision 7fcef3a77e1dbb59c7ac3e41c824fbf47a433ff2 yet. Reviewed against aaabbbe36b62c7741f52ccdf330bcd1c6c6d8add. The latest commit improves memory-test coverage; the production code involved in the following six findings is unchanged from the revision used for the reproductions.

1. [P1] Reconnecting drops history already loaded by the renderer.

   runtime-host-session-observer.ts:1349 clears the actual oldestSequence and reconstructs history using historyBytes * history.budgets. Each read can exceed its nominal budget to finish a Turn, so combining the budgets does not reproduce the previously delivered range. New tail content can also displace previously loaded history.

   Reproduced with the production observer and renderer store, a controlled Host paging seam, a 2,500-byte budget, and 500-byte message bodies: the first read returns row-8…row-12; loading earlier returns row-3…row-12; a same-session slow_consumer recovery, with no new messages, leaves only row-4…row-12. The renderer replaces its value on reset, so the missing row does not return after assembly completes. The source-replacement reopen also loses the accumulated load count.

   Fix: preserve the actual delivered boundary across recovery/reopen and restore through it; resolve stable Turn identities again when crossing Host epochs.

2. [P1] Settlement treats a partial Turn as fully recovered.

   session-message-settlement.ts:96 skips the targeted read whenever the tail contains a terminal record. However, the new decoder completes individual messages without completing the bootstrap's boundary Turn.

   Reproduced through real SQLite, the Host pager, client decoder, Main replica, and settlement: the ledger contains [prompt, intermediate reply, final reply (32 KiB), completed], but the normal 16 KiB bootstrap yields only [final reply, completed]. Settlement returns settled: true and never calls readTurn. Merging that result into the already-held prompt through the production Side Chat merge still omits the intermediate reply generated during disconnection. Side Chat recovery also skips further recovery once it sees the terminal record.

   Fix: recover the complete required Turn, or explicitly carry and check content-completeness boundaries. A terminal record proves execution state, not that all preceding content was recovered.

3. [P2] readTurn stops prematurely at an interleaved Turn.

   desktop-transcript-replica.ts:285 stops at the first record owned by another Turn. The Host explicitly supports nested Turns with overlapping ordinal ranges: see its reader and existing SQLite test.

   A real SQLite reproduction of outer before → inner answer → inner completed → outer after → outer completed returns only outer before from readTurn(outer). Targeted Side Chat recovery cannot obtain the missing content and terminal evidence when that Turn has left the tail.

   Fix: skip unrelated records and read through the target Turn's authoritative ending boundary rather than treating a change of owner as the end.

4. [P2] Prepending history misaligns virtua's measured-height cache.

   chat-view.tsx:777 omits shift. In virtua 0.48.8, measurements are indexed by position; increasing the item count without shifting appends cache slots at the end. React keys do not migrate that cache. Restoring one reading anchor therefore leaves measurements associated with the wrong Turns.

   Reproduced in Chromium using the production scroll hooks/authority and virtua: measure all 24 heterogeneous rows, then prepend one 500px row. Expected total height: 30,800px; actual: 25,180px. Revisiting previously measured rows produces 40px of reader displacement. Shifting the cache for the prepend corrects the total height and removes that displacement. This occurs after the rows were already measured, beyond the accepted first-measurement cost of unusually tall Turns.

   Fix: preserve measurement correspondence during prepends and coordinate it with custom anchoring. Do not enable shift indiscriminately for live appends.

5. [P2] A pending history load overrides subsequent user navigation.

   use-chat-scroll.ts:270 captures the reading position at click time, but cancellation listeners are installed only after the prepended rows arrive. Input during the request does not cancel the old hold, and land() subsequently writes that stale position for multiple frames.

   Chromium reproduction: click “Load earlier” at Turn20, scroll 1,800px to Turn24 while the request is pending, then resolve it—the viewport returns to Turn20. Returning to the tail during the request is also overridden.

   Fix: cover the entire hold lifecycle, including the pending request. Cancel or update the hold on newer input/navigation and Session changes.

6. [P2] An empty WorkHub filter hides the only history-loading control.

   workhub-conversation.tsx:122 removes the filter's history controls, leaving the only load-earlier button inside ChatView's nonempty branch.

   When the selected Work appears only in unloaded history, filtering produces an empty message list and hides the button despite hasEarlierHistory=true. Production-component rendering reproduces this: the same transcript has the button before filtering and loses it in the filtered empty state. Users must clear the filter before they can continue loading.

   Fix: keep history loading available independently of whether the filtered message list is empty.

Testing and structure:

• The load-earlier component test uses uniform 400px rows and synthetic scrollHeight. Keep its state/button coverage, but replace the geometry assertions with real-browser coverage of heterogeneous measured rows and navigation while loading.
• The scroll-cost E2E assertions cover renderer geometry, mounted row count, and return-to-tail behavior. The repository's Electron admission rules require these assertions to use the browser tier; CDP and real wheel input alone do not establish an Electron boundary. Extend the existing browser scenarios and remove the replaced Electron assertions.
• The latest commit addresses the earlier memory-test gap by rotating through distinct Sessions. That earlier finding is withdrawn.
• One deletion opportunity is the WorkHub resultPreview read/cache pipeline: current UI consumers only pass this field through and do not display it, while the pipeline still reads whole Turns. Removing it would leave Side Chat's separate need for readTurn intact.

The architectural direction—retaining loaded transcript data and virtualizing its DOM—is reasonable. The current implementation needs focused work on actual delivered-history boundaries, Turn completeness, measurement-cache correspondence, and cancellable scroll commands before it is ready to merge.

Verification: local builds succeeded; UI tests 478/478, selected Desktop tests 285/285, and selected Host tests 58/58 passed (821 total). Additional SQLite, component, and real Chromium probes reproduced the failures above. Tests ran on 0471059; the latest commit changes only five E2E/fixture files, whose incremental diff was reviewed. The affected production code and reproduction dependencies are unchanged. The latest memory E2E, full Electron suite, and full Storybook suite were not run locally; the latest CI test check was still running when this comment was prepared.

The visible behavior and protocol changes require independent human review under CONTRIBUTING.md. This automated review is not a human approval.

[Astro-Han]

Thanks — the read budget and the renderer's total footprint were indeed conflated in the description. Both are now separated, and the cost is measured rather than asserted.

apps/desktop/e2e/transcript-memory.spec.ts weighs a real renderer against three seeded Sessions, each past the 64 MiB budget: one of ~216 MiB (12,000 Turns at ~18 KiB) and two of ~72 MiB. Turns are moderate rather than enormous, since that is where the per-message object and index overhead you describe dominates the byte count. Every sample is taken after two forced collections.

	renderer JS heap	renderer resident	elapsed
a small Session, for comparison	25.4 MiB	274 MiB	—
Session 1 opened, read stopped at the budget	119.5 MiB	452 MiB	13.0 s
earlier history, load 1 of 3	211.5 MiB	560 MiB	3.9 s
load 2	302.2 MiB	676 MiB	3.9 s
load 3 — whole 216 MiB transcript loaded	357.0 MiB	736 MiB	2.9 s
reader moved to another Session	183.3 MiB	553 MiB	—
Session 2 opened at the budget, then left	120.3 → 70.7 MiB	489 → 431 MiB	18.1 s
Session 3 opened at the budget, then left	120.5 → 70.9 MiB	488 → 432 MiB	18.0 s
Session 1 opened again, then left	120.8 → 71.2 MiB	492 → 434 MiB	13.0 s

So a 64 MiB read costs ~94 MiB of JS heap — about 1.5× the bytes — and each further load of the same size costs the same again. 119 → 211 → 302 MiB is linear, which is the part I could not answer before. Search back to an early Turn is that path repeated until the target is in range, so its ceiling is the whole transcript: 357 MiB of heap for a 216 MiB one.

On release, the renderer holds one transcript past the switch — the Session just left — and replaces it rather than adding to it. Three different large transcripts visited in turn leave 70.7, 70.9 and 71.2 MiB behind: 0.5 MiB of growth over three visits, against ~50 MiB apiece if they accumulated. That shape is what the spec asserts, per visited Session, because it is the failure that would actually matter — a renderer keeping every transcript it had ever opened would fail it while every single-visit number above stayed respectable. The absolute numbers are recorded without a gate, since a ceiling on them would only misfire when the fixture changes.

No new cache or eviction was added, per your note. The PR description now states the 64 MiB budget as a per-read bound and carries the table above.

One thing the measurement is not: a CI gate. It seeds ~360 MiB of durable transcript and takes minutes, and a CI runner cannot even host it — the one round it ran there, the Runtime Host election deadline elapsed while the fixture was still being written. It also protects no contract: nothing regresses when it is absent, and its assertions describe the renderer's appetite rather than something a change could break. So it lives in apps/desktop/perf/, outside the E2E budget and outside every workflow, and is run on demand with npm --workspace @maka/desktop run measure.

中文

感谢指出——描述里确实把「单次读取预算」和「Renderer 总内存」混为一谈了，现在已经区分开，而且代价是实测出来的，不是断言出来的。

apps/desktop/e2e/transcript-memory.spec.ts 在真实 renderer 上称重三个都超过 64 MiB 预算的会话：一个约 216 MiB（12000 个 Turn，每个约 18 KiB），两个约 72 MiB。Turn 刻意做成中等大小而不是少数超大，因为那才是你说的每条消息对象与索引开销占主导的形态。每个采样点之前强制 GC 两次，数据见上表。

也就是说：一次 64 MiB 的读取约消耗 94 MiB JS 堆（约为字节数的 1.5 倍），而且后续每一次同样大小的载入代价相同——119 → 211 → 302 MiB 是线性的，这正是我上一版答不出来的部分。搜索跳回很早的 Turn 就是这条路径的重复，上限是整份 transcript：216 MiB 的会话对应 357 MiB 堆。

关于释放：切换之后 renderer 只留住一份 transcript，即刚离开的那个会话，而且是被替换、不是被累加。依次访问三个不同的大会话，离开后分别是 70.7、70.9、71.2 MiB——三次访问总共涨 0.5 MiB，而如果累积的话每份约 50 MiB。测试断言的就是这个形状（逐个会话比较），因为那才是真正要命的失败：一个把打开过的每份 transcript 都留着的 renderer 会在这条上挂掉，而它的单次数字可能仍然好看。绝对数值只记录、不设门禁，给它编一个上限只会在夹具变化时误报。

按你的意见，没有新增缓存或淘汰机制。PR 描述现在把 64 MiB 明确写成单次读取的界限，并附上了这张表。

有一点要说明：这个测量不是 CI 门禁。它要种约 360 MiB 的 durable transcript、耗时数分钟，而且 CI runner 根本扛不住——在 CI 上跑的那一轮，夹具还在写入时 Runtime Host 的选举截止时间就到了。它也没有保护任何契约：去掉它不会让任何东西回归，它的断言描述的是 renderer 的内存胃口，而不是某个改动会破坏的约定。所以它放在 apps/desktop/perf/，不在 E2E 预算里、不在任何 workflow 里，需要时用 npm --workspace @maka/desktop run measure 手动跑。

[Astro-Han]

Thanks. All six are reproduced and fixed, each regression failing on the commit before its fix. Five are introduced by this PR; the guard behind #2 exists identically on main.

One of them changed what the fix was. I had planned to delete the recovery rebuild in #1 rather than repair it — with the whole transcript resident, recovery could keep what the renderer holds and append what arrived since. That is wrong, and the counterexample is now in transcript-history-read.test.ts against real SQLite: a Turn's rows become durable when the Turn ends, carrying the ordinals they were written at, so a nested Turn that ends first publishes a watermark above rows the Turn around it has not published yet. Rows arrive below a boundary the reader already holds. Residency removes eviction, not synchronisation — so the reread stays, and only its boundary changes.

1	d2d6e3e	A reset now reads back down to the oldest sequence the consumer was actually given. history.budgets is deleted — a count of how many times the reader pressed the control was standing in for where its history reached. Regression: after delivering four Turns, a same-session slow_consumer recovery with no new messages used to hand back one.
2	aff4dd4	Deleting the shortcut alone would not have fixed it: readTurn was launched without being awaited, so the tail settled the question first either way. Completeness is now claimed only when the targeted read returns carrying the Turn's ending; a tail that moves is a reason to read again, a tail that does not is not. Regression: a byte-bounded tail that begins inside the required Turn.
3	364f2cc	Ownership-filtered traversal to the watermark. I did not stop at the Turn's terminal row: projectTerminalTurnState appends a step_limit note after it on tool_step_cap_reached, so that ending is another proxy. A row of another Turn is not evidence about where this one ends, and nothing short of the watermark is.
4, 5	a4fb607	shift computed per projection identity, only when the list grew at the front — a Turn arriving at the tail must leave every measurement where it is. The hold's cancellation watch now starts when the hold is taken, not when the prepend lands. Both covered by browser stories over real layout: PrependedHistoryKeepsMeasuredHeights (200px of drift here, ≤1px after) and NavigatingDuringAHistoryLoadOutranksTheHold (1800px mid-flight scroll, anchor within 2px after).
6	67547f8	The control rides along with the empty state instead of sitting in the branch that replaces it, which also keeps the list's only child a single null — the shape ChatMessageList needs to render an empty state at all.

On the testing notes, both taken, in 31b85ce:

• The load-earlier component test gives up its scroll-offset assertion and keeps its state/button coverage. The two stories above are the replacement.
• The scroll-cost spec loses its frame probe and every per-frame geometry assertion; UpwardTraversalHoldsTurnGeometry already asserted the same contract per step over real layout and to a tighter bound, and it now also carries the mounted-row bound. What stays in Electron is the Session the Host delivered: one whole read across preload/IPC with nothing left to load earlier, walkable with real wheel input and returning to its tail. The run drops from minutes to 17s, and e2e-budget.json says why the file is still there.

On resultPreview: agreed that nothing renders it, on this branch or on main — #5150 said it would be displayed and that never landed. I would rather not delete a shipped intent inside a refactor, so it is left alone here and raised separately. It does pick up the #3 fix, being a cross-Session readTurn consumer.

One the review did not list, which is the same contiguity assumption in the main history path: #sendTranscriptHistory cuts its answer at a change of owner, so in nested order it can end an answer with an outer Turn's tail and hold its opening back for the next load-earlier — a split Turn at the history edge until the reader presses the control. Fixing it authoritatively needs a Turn's extent, which storage knows (RuntimeTranscriptInvocationHeader.firstOrdinal/lastOrdinal) and the wire does not carry; every local stopping rule I could find is another proxy. That is a Host change and another epoch bump, so it is written up in the PR body rather than guessed at here.

The memory-test withdrawal is noted, thanks.

[Astro-Han]

Follow-up to my earlier reply: the seventh finding — #sendTranscriptHistory cutting a history answer at a change of row owner — is now fixed in this PR rather than deferred, since the PR already moves the compatibility epoch.

The Desktop cannot derive a Turn's extent locally: in nested order the owner changes twice inside one Turn, and terminal row / latest state are proxies too. The Host's transcript reader already drains mutually overlapping Turns as one cluster, so it now numbers those clusters and every transcript page carries endsAtTurnBoundary. The Desktop reads whole pages and ends an answer only on a page the Host called whole, which also deletes the row-by-row carry buffer. The epoch lands at 159.

Regression: session-transcript-reader.test.ts pages a real nested ledger one row at a time and requires every page but the last to report endsAtTurnBoundary: false — the naive owner-change rule reports a boundary in the middle of that cluster. Suites re-run: runtime-host 1939, storage 1370, desktop main 2619, all green.

[liuxiaocs7]

Automated follow-up review by OpenAI Codex, at 9b00471049dd4a81829dcb458ecba6f0361dc939 (including the latest byte-page rollback fix). This follows my earlier review and both author replies. I still recommend changes before merge: four behavioral issues remain reproducible (two P1, two P2), plus one standards issue (P3).

The fixes address several of the original failures. In particular, retaining the recovery reread is justified by nested Turns becoming durable below an already-observed watermark. Preserving the delivered boundary is the right direction; the remaining problem is its lifetime across connection replacement.

Behavior / spec findings:

1. [P1] Apply the cluster-boundary rollback to shared transcript pages too.

   In readSharedDurablePage, the shared projection still fills the byte allowance inside the next row, returns that fragment, and reports endsAtTurnBoundary: false. It bypasses the owner reader changed by the latest commit. The Desktop stopping condition consequently keeps reading past its budget, potentially to the beginning of the transcript.

   Reproduced through real SQLite, the Host pager, client decoder, Desktop observer, and renderer store, using independent completed Turns with 180 KiB bodies:

   Fixture / history-read budget	Owner projection	Shared projection
   18 Turns / 1 MiB	6 Turns; 1,107,720 bytes; hasOlder=true	all 18; 3,323,097 bytes; hasOlder=false
   512 Turns / production 64 MiB	364 Turns; 67,204,228 bytes; hasOlder=true	all 512; 94,528,268 bytes; hasOlder=false

   Each Turn is far below the budget, so this is not the intentional allowance for finishing one oversized Turn. Shared Sessions lose the explicit load-earlier boundary and can automatically retain the entire transcript. Extend the authoritative cluster-boundary selection to the projected path and cover both projections with byte-sized integration fixtures. The owned-path failure is fixed in the reviewed revision.

2. [P1] Preserve explicitly loaded coverage across replacement of the Host connection.

   #restoreTranscript reopens only the Session, consumer, target, and mode. The new observer starts with oldestSequence: null, so it sends a fresh initial-budget reset; the renderer installs that reset as the entire value.

   With the production registry, observer, and renderer store, using controlled Host pages: initial open contains row-7…row-12; explicit load-earlier expands it to row-1…row-12; a same-observer slow_consumer recovery now correctly retains all 12. Detaching that observer, closing it, and attaching a fresh observer returns the same active renderer to row-7…row-12, with no transcript changes. This is the detach/attach path used by runtime-host-desktop-candidate.ts, not another invocation of the already-fixed same-observer reset.

   Keep the delivered coverage in an owner that survives source replacement, and carry it into the reopened consumer. Preserve the authoritative reread, including its protection for late durability below the watermark. Add a registry replacement regression in addition to the existing subscription-recovery regression.

3. [P2] Side Chat reseeding still treats an incomplete tail as recovered content.

   observationSeeded calls readSettledMessages(forkId) without requiredTurnId. That skips the new targeted read and allows settlement as soon as the tail is ready.

   Reproduced with production useQuoteCompanion, settlement, SQLite/Host bootstrap decoding, and a fresh production observer: an owned Turn's prompt is already retained from its live overlay before disconnection. While disconnected, it persists [prompt, intermediate response, 32 KiB final answer, completed]. Reconnection seeds a terminal root with only queue_update, so no replayed complete event triggers targeted recovery. The real 16 KiB bootstrap tail expands to [final answer, completed]. Reseeding then leaves the UI with the prompt and final answer but no intermediate response. The recorded recovery makes one unqualified settlement read, zero targeted Turn reads, and zero execution queries: reconciliation exits when no prompt remains pending.

   Recover owned Turns whose content has not been proven complete during reseeding, including already-reconciled prompts. The targeted requiredTurnId fix passes, but this caller never reaches it. Although the unqualified settlement guard existed on main, this PR changed cold-tail decoding from completing the edge Turn to completing the edge message, exposing this caller's assumption.

4. [P2] A navigation command after history delivery is still overwritten by the prepend hold.

   The pending-read watcher now correctly follows the reader, but the 30-frame landing loop continues writing its captured position after delivery. It releases on wheel, touch, or keyboard input; an explicit navigation command does not supersede it.

   In real Chromium with production ChatView and ChatSurfaceLayout, clicking the rendered Scroll to bottom button three animation frames after a prepend moves scrollTop to 33,228. The landing loop then moves it back to 8,506, leaving scroll authority at { pinned: true, awayFromTail: true }. A search navigation during the same interval is also overwritten. Cancel/supersede the hold through the scroll authority's navigation commands for the whole hold lifetime, and test navigation after delivery as well as while loading is pending.

The following original paths now pass the focused reproductions:

Earlier finding	Re-review result
Same-observer recovery discards delivered history	Fixed; full connection replacement remains in finding 2
Required-Turn settlement accepts a truncated tail	Fixed for callers passing requiredTurnId; reseeding remains in finding 3
Nested readTurn stops at another owner	Fixed; outer rows before and after the nested Turn are returned
Prepending corrupts measured-height associations	Fixed in the production ChatView Chromium probe; no drift on revisit
Navigation while the history request is pending	Fixed for wheel movement and return-to-tail; after-delivery race remains in finding 4
Empty WorkHub filter hides load-earlier	Fixed; the empty-state control is present
Byte pages bypass the history budget	Fixed for owner projection; shared projection remains in finding 1

Standards review: one remaining documented-standard issue, separate from the behavioral findings.

[P3] Finish removing renderer-only Electron assertions. partial-history-notice.spec.ts:91–96 still asserts pixel displacement after prepend, and transcript-scroll-cost.spec.ts:80–104 retains wheel traversal, mounted-row bounds, and return-to-tail geometry already covered in browser stories. The Electron admission rules apply per assertion, explicitly say real wheel/CDP or another IPC assertion does not establish Electron ownership, and require deleting replaced checks. Keep the actual preload/history-delivery journey; remove the duplicate renderer assertions and unused helpers, and update the budget rationale. Moving the memory measurement out of CI and removing the fake-DOM pixel assertion address the previous concerns. No additional substantiated Fowler smell found.

Validation: 719 existing tests passed locally: UI 479, focused Host 55, focused Desktop 185. Dependencies and affected compiled workspaces were built; Host was rebuilt after 9b00471049. git diff --check passed. The findings above also use dedicated behavioral probes; the reconnect probe controls the Host page seam, while the paging and Side Chat probes use real SQLite/Host transcript code. UI probes use production components in Chromium with synthetic transcript fixtures. I did not run the full repository suites, full Storybook, Electron suite, or memory benchmark locally. At the latest check, the current revision's CI test job was still running; Windows packaging had passed. Earlier revision failures are not attributed to this head.

Required conclusions:

1. Optimal for the problem? The resident-history / virtualized-DOM direction fits the problem, but the current implementation still breaks the coverage and navigation contracts above.
2. Production code to delete? None newly identified. resultPreview is also unused on main and is already tracked separately; it is not a new blocker here.
3. Tests to delete or replace? The duplicate Electron geometry/traversal assertions identified in the standards review; retain their browser coverage and the independent IPC journey.
4. Deeper refactor? Targeted ownership corrections are needed: authoritative cluster cuts for both projections, delivered coverage that survives connection replacement, explicit content completeness for Side Chat recovery, and scroll commands that supersede prepend holds. These fit the new architecture.
5. Ready to merge? No, pending the remaining behavioral fixes and their regressions.
6. Residual risks / gaps? The unrun suites and pending checks above remain. This changes user-visible transcript behavior and the Host wire contract, so independent human review is required under CONTRIBUTING.md; this automated review is not that approval.

[Astro-Han]

All five are fixed and pushed. Each was reproduced first, and each regression fails on the commit before its fix (verified by reverting the source and rebuilding).

The four behavioral findings share a cause, and it is the mirror image of the first round's. Those fixes moved how much transcript do I have to the Host — clusters, page boundaries, the delivered watermark. Three consumers were still answering it locally, and the fourth is the same mistake one layer up, in the renderer.

1 — shared pages (P1), 8aba1f5c4. Right, and the second pager was the defect rather than the missing rollback. readSharedDurablePage re-read rows the ledger reader had already cut, dropped some, and published its own boundary, so no fix inside the reader could reach it. A projection is now a TranscriptRowProjection the one reader applies as it cuts — a row the guest never sees must not take up room on their page either — and readSharedDurablePage is deleted (−95 lines), along with its own hidden-scan constant. cuts a guest page where it cuts an owner page walks createSessionTranscriptBootstrap + readSessionTranscriptPage over real SQLite for both projections and requires the same boundaries. Deleting the duplicate also fixed a stale seam in session-continuity-coordinator.test.ts: it blocked readDurableRecords to hold a page in flight, which the shared path no longer touches, so the test now blocks readDurablePage.

2 — connection replacement (P1), c49dfbcc6. The delivered boundary lived on the consumer, and a consumer dies with the connection that made it; the reader it feeds does not. It now lives on the registration, which outlives the connection, and #restoreTranscript passes it to the reopened consumer as resumeFrom. The reread stays, watermark protection included. keeps the history already delivered across a replacement of the Host connection attaches source A, loads earlier, detaches, attaches source B, and requires the reset to carry everything previously delivered.

3 — Side Chat reseeding (P2), febb9a4b5. Correct that the targeted read only helps callers that name a Turn. Rather than teach this caller to name one, the missing fact is now carried: a byte-bounded tail knows nothing about the Turn it begins inside, but the Host's page does, so endsAtTurnBoundary reaches the renderer as beginsAtTurnBoundary through the replica and the preload contract (a Desktop-side field, no Host wire change, so the epoch stays at 159). Settlement reads that Turn whole when the tail begins inside one, whether or not a requiredTurnId was passed. Eviction clears the flag — it groups rows by owner, which is not where a Turn ends.

4 — navigation vs the hold (P2), 5d80936c1. READER_INPUT_EVENTS was standing in for "the reader took over", and the scroll authority is what actually knows: every navigation goes through its pin. It gained a command seam, fired by pinToTail and releasePin before the viewport moves, and the hold — pending capture and landing loop both — is cancelled from there. Input keeps its own listeners deliberately: while the read is still pending it means something different, moving the hold rather than dropping it, which is the behavior your previous round asked for. returning to the tail during a prepend landing is not undone by it clicks through the authority three frames into the landing and requires the offset to stay at the tail; it fails at 1,600 against 2,400 without the fix.

5 — Electron geometry (P3), d0be522bd. Deleted: traversal distance, mounted-row bounds and the return-to-tail residual in the scroll spec, the post-prepend displacement in the notice spec, and the helpers and 180s timeout that served them. Each spec keeps the boundary it needs — a Session under the budget crossing preload/IPC whole in one read, one over it arriving a bounded page at a time — and the first is renamed transcript-full-delivery.spec.ts for what it now proves. Budget rationales updated for both, check:e2e-budget green, and scripts/perf/geometry-results.md no longer points at the deleted wheel coverage. The replacements were already in place and stay green: UpwardTraversalHoldsTurnGeometry, PrependedHistoryKeepsMeasuredHeights, NavigatingDuringAHistoryLoadOutranksTheHold.

Ran: format, lint, typecheck, @maka/ui 480/480, @maka/desktop main 2,622/2,622, the runtime-host transcript and continuity suites 80/80, the full Storybook smoke (367 stories), check:e2e-budget, and the two e2e specs. CI is green on this head, including the Electron suite and the geometry gate. One caveat recorded in the description: the gate's cold-sweep bound is one slip and a busy machine occasionally produces two on the mixed scene, worst displacement unchanged and the warm sweep exact — the bound may belong per oversized Turn rather than per sweep.

[jackwener]

Independent agent review. Reviewed at 30dbb56edf66bdf95ab316cfdfce26fb558d6b99. I am an AI agent (executing seat @kabi-opus) publishing through a shared GitHub account; this is an automated review and does not substitute for independent human review.

No P0–P2 findings. One precision note on the byte bound, and a clear statement of what no reviewer verified.

129 files and a net −2,536 lines, so I went at the deletions, the new bound, the new dependency, and the gate — the four places where a refactor this size can quietly lose something.

The gate change is a correction, not a relaxation

Replacing a gate's assertions is where a weakening hides, so this was my first stop. The old gate asserted that scrollHeight never moves and scrollTop never runs backwards. Under virtualization those are not weaker proxies — they are wrong: a backwards scrollTop is precisely the correction that holds the reader still while a row above is measured. A gate that fails on correct behaviour is worse than no gate.

What replaces it measures the reader directly and hard-asserts the strict case:

expect(row.warmReaderSlips, `${scene}: measured transcript moved the reader`).toBe(0);
expect(row.warmHeightDrift, `${scene}: measured height drift`).toBeLessThanOrEqual(1);
expect(row.coldReaderSlips, …).toBeLessThanOrEqual(1);

toBe(0) on the measured case is stricter than anything the old gate expressed. The single allowance is confined to reading over unmeasured rows, with the mechanism stated in the comment rather than asserted as a magic number.

The 64 MiB bound is a floor plus a Turn, not a ceiling

The description says the first read is "bounded ... by DESKTOP_TRANSCRIPT_HISTORY_MAX_BYTES (64 MiB)". The enforcement is:

if (bytes >= budget && reachedFloor && page.endsAtTurnBoundary) break;

All three conditions must hold, and the comment above it is explicit that "a page that leaves a Turn half-read is read past, however much of the budget has already been spent." So the real contract is at least 64 MiB, then rounded up to the next Turn boundary — the overshoot is one Turn, unbounded in principle by this check alone. A separate hard guard does exist (#adjustTranscriptDeliveryBytes throwing "Desktop transcript delivery capacity was reached"), so this is not unbounded memory; it is a description that reads like a ceiling for something that is a floor.

Not a defect — refusing to show half a Turn is the right call, and it is documented in the code. But "bounded by 64 MiB" is the sentence a reader will quote when reasoning about worst-case memory, and one large Turn past the floor is the part that sentence hides.

The new dependency is handled correctly

virtua is pinned exactly ("virtua": "0.48.8", no range) in packages/ui/package.json — the right choice for something this load-bearing. It is MIT, and it already appears in apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt at the same version with declared and selected license both MIT, so the notice generator was actually run rather than the entry being assumed. Installed size is 1.6 MB.

Evidence

Built core, storage, runtime, runtime-host and ui from a cleaned dist: zero TypeScript errors. UI 489/489. Desktop main 2665/2665 after build:test (main, preload and overlay — build:main alone leaves dist/overlay missing and produces six unrelated ENOENT failures).

A note for anyone re-verifying: this PR adds a dependency, so an existing checkout needs npm install before the build will typecheck. Without it you get Cannot find module 'virtua' in chat-view.tsx and use-chat-scroll.ts plus cascading implicit-any errors, which look like defects in the diff and are not.

What no one verified

Every headline number in this PR rests on real Electron, and no reviewer ran it. The geometry gate itself imports electron and Playwright's _electron, so --assert-stable cannot run in my environment at all — meaning the gate that backs "ticks that moved the reader go 13 → 1", "≤0.2px displacement against main on the 500-Turn fixture", and the itemSize ablation is unexecuted here rather than passing. Those figures are the author's measurements.

I invited the one seat with working Electron on this repository twice; they declined both times, on the explicit grounds that taking a 129-file change needing real browser pressure evidence while already holding another review would compress evidence quality on both, and asked to be recorded as not counted. That is the right call on their side and I am recording it as they asked: this is a single-seat review, and the seat that could close the gap is not in it.

Relationship to #5365

This branch already contains #5365's model — transcript-overlay-settlement.test.ts is deleted, the overlay.release grant migration is present, and pendingRunningStartedAt has zero occurrences, matching that branch exactly. The description says so directly ("the merge rebuilt this branch on that model"). The 34 overlapping files are therefore an ordering question, not a conflict: #5365 first, then this. Its epoch (161, after #5308's 159 and main's 160) is consistent with that order.

Code review, CI status and merge readiness are separate. At this SHA mergeable=MERGEABLE, mergeStateStatus=BLOCKED. This approval covers code only and is not a statement that the PR may be merged.