cacheplane · blove · Sep 24, 2026 · Sep 24, 2026
diff --git a/fixtures/react-parity/runtime/README.md b/fixtures/react-parity/runtime/README.md
@@ -1,5 +1,45 @@
 # Installed native runtime consumers
 
+## Checkpoint review
+
+Open `/?checkpoints` on either installed review URL for the separate fixed
+`checkpoint-thread` workflow. One application-owned session lives outside
+component lifetime. React observes it with `useAgent` under StrictMode; Angular
+uses `observeAgent` in its component injection context. Selected checkpoint
+references and command outcome/completion counts are application state. The
+session's execution position is private and is not invented as a snapshot field.
+
+Follow the sequence displayed in the view: **Load → Select A → Select B → Select
+A → Fork selected → Select B → Continue branch → Load → Select P → Fork selected
+→ Drop branch → Reconnect branch → Dispose → Continue branch → Fork selected**.
+Selection performs no I/O and changes no transcript or values. Fork A reads the
+exact completed source and confirms A1; continuation uses A1 even while B is
+selected. The subsequent Load reads exact A2 and retains the earlier B/A/P
+history page. Pending P rejects after its source read without a creation POST or
+optimistic state change. Drop from A2 ends with physical status running; explicit
+reconnect joins that same run at its cursor and confirms A3. Commands after
+disposal resolve aborted without I/O.
+
+`checkpoint-execution.mjs` is an independent, bounded wire oracle. The server's
+global latest remains B. It checks all 15 requests in order: one history POST,
+six exact checkpoint-read POSTs, three creation POSTs, four physical status GETs
+and one cursor join GET. Root checkpoint maps, input, catalog and stream modes
+are exact; the installed SDK serializes join modes as one JSON query parameter.
+Unexpected requests fail verification. The same six browser scenario groups run
+in both package verifiers and the interactive review command, alongside the main
+and thread workflows; scenario totals are derived from completed assertions.
+Node oracle tests also reject original-A/selected-B continuation, missing routing,
+wrong root maps/catalog/modes, extra POSTs and wrong join cursors/modes.
+
+The development factory exports its existing fixture checkpoint vocabulary and
+adds a narrow `fork(checkpoint, input, options?)` return signature. Installed type
+probes pass an observed readonly history reference directly, reject malformed
+inputs and reserved routing, and check `Promise<CompleteOutcome>`. Its emitted
+declaration uses installed core and fixture data types only, with no private
+source or SDK references. This fixture changes no public API or production
+branch UI. The strict HTTP fixture complements the separate real-server tests;
+it does not establish general backend compatibility or cross-client atomicity.
+
 ## Durable tool claims
 
 The private runtime can use an application-supplied execution store. Only a newly
@@ -299,7 +339,7 @@ are missing. `node scripts/react-parity/review-runtime.mjs --help` prints the
 prerequisite and review sequence.
 
 The runner packs those artifacts, installs and strictly type-checks isolated
-React and Angular consumers, builds each app, and runs all twenty-one browser
+React and Angular consumers, builds each app, and runs all main, thread and checkpoint browser
 scenarios on fresh fixture servers. Only after those checks pass does it print
 two new, untouched loopback URLs. Open each URL manually; no browser opens
 automatically. The review servers have made no SDK requests at that point.
@@ -485,7 +525,7 @@ React uses a Vite production build. Angular uses the existing consumer template'
 installed Angular CLI application builder and real APF linking, with output in
 `dist/consumer/browser` and input evidence from `dist/consumer/stats.json`.
 
-Both built apps run the same twenty-one browser scenarios in installed Playwright
+Both built apps run the same main and thread browser scenarios in installed Playwright
 Chromium: inert mount, explicit history load, equal history refresh, empty history
 replacement, successful text, a real local tool handler and exact
 two-request result continuation, protected visible server error, held streaming

diff --git a/fixtures/react-parity/runtime/angular-checkpoints.ts b/fixtures/react-parity/runtime/angular-checkpoints.ts
@@ -0,0 +1,145 @@
+import { Component, signal } from '@angular/core';
+import { bootstrapApplication } from '@angular/platform-browser';
+import { observeAgent } from '@threadplane/angular';
+import { createFixtureSession } from './runtime-entry.js';
+import {
+  checkpointInstructions,
+  display,
+  type FixtureCheckpoint,
+} from './scenarios';
+
+// Application ownership is independent of component creation and destruction.
+let handlerCalls = 0;
+const session = createFixtureSession('/api', 'checkpoint-thread', () => {
+  handlerCalls++;
+});
+
+@Component({
+  selector: 'app-root',
+  template: `
+    <main class="review-shell">
+      <header>
+        <p class="eyebrow">Installed package review · Angular</p>
+        <h1>Checkpoint review</h1>
+      </header>
+      <section class="panel">
+        <h2>Review sequence</h2>
+        <p>{{ instructions }}</p>
+      </section>
+      <section class="panel">
+        <h2>Application selection and session execution</h2>
+        <p>
+          The selected ID is local application state. The active execution
+          position is retained privately by the session after a confirmed
+          command; observed values below come from saved server state.
+        </p>
+        <div class="controls">
+          <button [disabled]="busy()" (click)="load()">Load</button>
+          @for (id of ['A', 'B', 'P']; track id) {
+          <button [disabled]="busy() || !reference(id)" (click)="select(id)">
+            Select {{ id }}
+          </button>
+          }
+          <button [disabled]="busy() || !selected()" (click)="fork()">
+            Fork selected
+          </button>
+          <button [disabled]="busy()" (click)="run('Continue branch')">
+            Continue branch
+          </button>
+          <button [disabled]="busy()" (click)="run('Drop branch')">
+            Drop branch
+          </button>
+          <button
+            [disabled]="busy() || !snapshot().reconnect"
+            (click)="reconnect()"
+          >
+            Reconnect branch
+          </button>
+          <button
+            [disabled]="busy() || owner() === 'disposed'"
+            (click)="dispose()"
+          >
+            Dispose
+          </button>
+        </div>
+        <div class="fields">
+          @for (field of fields(); track field[0]) {
+          <div>
+            <h3>{{ field[1] }}</h3>
+            <output [attr.data-testid]="'checkpoint-' + field[0]">{{
+              field[2]
+            }}</output>
+          </div>
+          }
+        </div>
+      </section>
+    </main>
+  `,
+})
+export class CheckpointApp {
+  readonly snapshot = observeAgent(session);
+  readonly instructions = checkpointInstructions;
+  readonly selected = signal<FixtureCheckpoint | undefined>(undefined);
+  readonly outcome = signal('');
+  readonly finished = signal(0);
+  readonly owner = signal('active');
+  readonly busy = signal(false);
+  reference(id: string) {
+    return this.snapshot().history?.find(
+      (entry) => entry.checkpoint.checkpoint_id === id
+    )?.checkpoint;
+  }
+  select(id: string) {
+    this.selected.set(this.reference(id));
+  }
+  async command(action: () => Promise<string | void>) {
+    this.busy.set(true);
+    this.outcome.set('running');
+    try {
+      this.outcome.set((await action()) ?? 'loaded');
+    } catch {
+      this.outcome.set('rejected');
+    } finally {
+      this.finished.update((count) => count + 1);
+      this.busy.set(false);
+    }
+  }
+  load() {
+    return this.command(() => session.load!());
+  }
+  fork() {
+    return this.command(() => session.fork(this.selected()!, 'Fork A'));
+  }
+  run(input: string) {
+    return this.command(() => session.submit(input));
+  }
+  reconnect() {
+    return this.command(() => session.reconnect());
+  }
+  async dispose() {
+    await session.dispose();
+    this.owner.set('disposed');
+  }
+  fields() {
+    const snapshot = this.snapshot();
+    const view = display(snapshot);
+    return [
+      [
+        'selected',
+        'Selected checkpoint reference',
+        this.selected()?.checkpoint_id ?? 'none',
+      ],
+      ['owner', 'Application owner', this.owner()],
+      ['status', 'Session status', snapshot.status],
+      ['outcome', 'Last command outcome', this.outcome()],
+      ['finished', 'Completed commands', String(this.finished())],
+      ['text', 'Observed transcript', view.transcript],
+      ['values', 'Observed values', view.values],
+      ['history', 'Last loaded history page', view.history],
+      ['reconnect', 'Reconnect run', snapshot.reconnect?.runId ?? ''],
+      ['handlers', 'Tool handler calls', String(handlerCalls)],
+    ];
+  }
+}
+
+void bootstrapApplication(CheckpointApp);
diff --git a/fixtures/react-parity/runtime/evidence.json b/fixtures/react-parity/runtime/evidence.json
@@ -360,5 +360,122 @@
     "generatorsRun": [],
     "reason": "Only contributor fixture guidance, tests and private review infrastructure changed; no public docs/API/context generator inputs changed."
   },
-  "verificationProvenance": "All listed commands ran in this increment. Runtime and native package production implementation/public exports remain unchanged. Historical foundation evidence remains unchanged. Parent audited spec, source, lifecycle, types, installed behavior and evidence. New independent subagent review was unavailable after earlier thread capacity exhaustion; hosted review must be inspected separately from job success."
+  "verificationProvenance": "All listed commands ran in this increment. Runtime and native package production implementation/public exports remain unchanged. Historical foundation evidence remains unchanged. Parent audited spec, source, lifecycle, types, installed behavior and evidence. New independent subagent review was unavailable after earlier thread capacity exhaustion; hosted review must be inspected separately from job success.",
+  "installedCheckpointReview": {
+    "recordScope": "This additive record covers only the September 24 installed checkpoint fixture milestone. The other top-level fields remain the historical September 22 thread-lifetime record, including its source fingerprint and manual browser claims.",
+    "observedOn": "2026-09-24",
+    "status": "local automated and manual verification passed; independent compliance and quality reviews approved; CI reported separately",
+    "verificationHead": "d3d8e018b31ca6ab71f238df38f8429e4c153765",
+    "integratedMain": "f4ccd582ccc0d36bcb3a6a0d51c0dfa8cb1ff33f",
+    "integrationEvidence": "PR #1156 required CI 36037710445 passed on verificationHead. Its main merge tree 51d158f52748566e8630bda74881ae9c66ecec0c is identical. Fixture changes were preserved byte-for-byte when moving onto that main commit.",
+    "workingTree": "Fixture-only changes on the reviewed production predecessor plus its recording-transport return-type follow-up; no production runtime, core, binding or dependency change in this milestone.",
+    "executed": [
+      {
+        "log": "/tmp/installed-checkpoint-build.log",
+        "logSha256": "d301e3126fa75071ede57c077da114657206c2b396d986ac6c4f98bd85f322c4",
+        "command": "NX_DAEMON=false NX_TUI=false npx nx run-many -t build -p core,content,react,angular --skip-nx-cache",
+        "exitCode": 0
+      },
+      {
+        "log": "/tmp/installed-checkpoint-node-final.log",
+        "logSha256": "f8f5893229b03f595345ab7ff29a7723fbf9b29710f56a1f8a4e5c89a9cb89e3",
+        "command": "node --test scripts/react-parity/*.spec.mjs",
+        "exitCode": 0,
+        "testsPassed": 329
+      },
+      {
+        "log": "/tmp/installed-checkpoint-react-restored.log",
+        "logSha256": "9c30fcfda00d425a46a19dbb16f35c8f2e0afb2cb4da434d2c936be12079149e",
+        "command": "node scripts/react-parity/verify-packages.mjs",
+        "exitCode": 0,
+        "browserScenarios": 27,
+        "checkpointScenarioGroups": 6,
+        "installedTypeProbes": true,
+        "productionBuild": true
+      },
+      {
+        "log": "/tmp/installed-checkpoint-angular.log",
+        "logSha256": "d444c583c5324e61e8dd2f1f01698baa456867fa10cde3a3eff212bb710b3a7d",
+        "command": "node scripts/react-parity/verify-angular-package.mjs",
+        "exitCode": 0,
+        "browserScenarios": 27,
+        "checkpointScenarioGroups": 6,
+        "installedTypeProbes": true,
+        "productionBuild": true
+      }
+    ],
+    "testFirstEvidence": [
+      {
+        "log": "/tmp/installed-checkpoint-types-red.log",
+        "logSha256": "9f52b6058e55809923f7f4e72a174cb58b45ee6fa89df963e9017e41f88653af",
+        "expectedFailure": "Readonly observed history checkpoint cannot call missing factory fork method."
+      },
+      {
+        "log": "/tmp/installed-checkpoint-oracle-red.log",
+        "logSha256": "192e8c826cb661b95f2c16b328f82d991c333acf665fd3146683076afe15f246",
+        "expectedFailure": "Checkpoint-thread HTTP routes are not implemented."
+      },
+      {
+        "log": "/tmp/installed-checkpoint-browser-red.log",
+        "logSha256": "26977eeae155251e4f3bdfc771d4dc3af84931e1a4a09c7db9243d9e29f41fc4",
+        "expectedFailure": "Installed checkpoint view does not exist."
+      },
+      {
+        "log": "/tmp/installed-checkpoint-review-evidence-red.log",
+        "logSha256": "a6339c88470a344fad5bb48e8341bdb83578337bb8a0a19da2ed189716b0603c",
+        "expectedFailure": "Review provenance has no input hashes."
+      },
+      {
+        "log": "/tmp/installed-checkpoint-review-evidence-green.log",
+        "logSha256": "8f1891e83b6bdeba32a4cb15539f46a116e90460dd7ab1f191db99f0f20f0d93",
+        "exitCode": 0
+      }
+    ],
+    "semanticNegativeControl": {
+      "log": "/tmp/installed-checkpoint-negative-control.log",
+      "logSha256": "158ea6ee10872775772a06e74c5d2fb67b33748a175bcc326598acb45ddb56ef",
+      "mutation": "Temporarily change actual create-session stream routing from A1 to original A (ID and root map) for continuation.",
+      "expectedFailure": "Continue branch: wire oracle errors; exact branch creation routing, input, catalog and modes",
+      "restoration": "Original production file bytes restored in finally, empty production diff checked; restored React installed verifier passed."
+    },
+    "checkpointProtocol": {
+      "thread": "checkpoint-thread",
+      "globalLatest": "B",
+      "historyPosts": 1,
+      "exactCheckpointReadPosts": 6,
+      "creationPosts": 3,
+      "physicalStatusGets": 4,
+      "cursorJoinGets": 1,
+      "fullSequenceAsserted": true,
+      "selectionImplicitIO": false,
+      "postDisposalIO": false,
+      "handlerCalls": 0,
+      "joinModesEncoding": "One JSON array query parameter, matching the installed SDK BaseClient."
+    },
+    "declarations": "Readonly native-observer history reference passes directly to fork; outcome is Promise<CompleteOutcome>; malformed input and reserved config routing fail type probes; emitted declaration rejects SDK/private-source references.",
+    "cleanup": "Both package verifiers close page contexts, browsers, HTTP connections and temporary installed consumers in finally. No persistent manual servers were started by implementation.",
+    "manualBrowserReview": {
+      "performedBy": "Parent using Chrome DevTools MCP for React and Codex in-app browser for Angular, on fresh loopback review servers.",
+      "observedOn": "2026-09-24",
+      "reactUrl": "http://127.0.0.1:55315/?checkpoints",
+      "angularUrl": "http://127.0.0.1:55316/?checkpoints",
+      "sequence": "Load; Select A/B/A; Fork selected; Select B; Continue branch; Load; Select P; Fork selected; Drop branch; Reconnect branch; Dispose; Continue branch; Fork selected.",
+      "observations": "Both views retained branch A1/A2 despite selected B, rejected pending P without replacing A2, recovered run-A3 into A3, and returned aborted for both commands after disposal. Final selected P, owner disposed, session idle, completed commands 9, handlers 0; history remained B/A/P.",
+      "consoleWarnings": 0,
+      "consoleErrors": 0,
+      "reactNetwork": "Chrome recorded exactly 15 HTTP requests: one history POST, six checkpoint reads, three run creations, four status GETs and one run-A3 cursor join GET; all returned 200.",
+      "limits": "Angular network sequence is asserted by the installed automated oracle; its manual review claims visible state and console observations only. No live deployment, SSR or performance-budget claim.",
+      "runnerLog": "/tmp/installed-checkpoint-manual-runner.log",
+      "cleanup": "Owned review tabs closed and loopback ports 55315/55316 confirmed closed; user-owned manual sessions preserved."
+    },
+    "independentReview": "Fresh compliance and quality reviewers independently approved the fixture diff; each ran 28 focused Node tests. Parent additionally ran all 329 parity-script tests, 829 runtime tests plus runtime/public type targets, inventory, source boundaries and version consistency. A whole-workspace emitted-boundary scan was not completed in this fixture worktree because the unchanged ag-ui built artifact was absent; installed declaration checks passed for both exercised consumers.",
+    "documentation": {
+      "generatorsRun": [],
+      "reason": "Only contributor fixtures and review infrastructure changed; no public API/docs/context generator inputs."
+    },
+    "limits": [
+      "Strict deterministic HTTP evidence complements separate real-server tests; it does not certify general LangGraph compatibility or cross-client atomicity.",
+      "No new public API, branch UI library, dependency update, package-root migration or release."
+    ]
+  }
 }