feat: open threads with verified newest-first windows

[kalvinnchau]

Summary

• Open strict UUID-channel threads with the newest 10 replies; load older replies in 50-row pages after scrolling through 80% of loaded history. Preserve live updates, exact targets, drafts, and reading position across late-arriving ancestors.
• Validate signed window bounds and cursor progression before admitting pages. Only an initial nonempty response without bounds restarts in legacy mode.
• Show older-page loading/retry between the root and oldest loaded reply. Keep reconnect/retained-range repair status and retry near the newest replies instead of misclassifying repairs as pagination.

Companion relay contract: block/buzz#7823.

Verification

• At the pushed head: 5,079/5,079 Vitest, TypeScript/Biome, and pre-commit/pre-push checks passed (pre-push related tests: 3,111/3,111).
• The thread-window browser fixture passed 8/8 across Chromium/WebKit, including held reconnect failure/retry, held older-page placement, nested reply anchoring, and live following. A later run reproduced an existing intermittent WebKit scroll-anchor assertion miss of 0.86–1 px; that browser run was not green.
• Browser checks use a source-level fixture, not a live signed relay or packaged desktop app. Earlier live-relay checks predate the latest UI changes. Hosted checks, native acceptance, and required approval remain pending.

[wesbillman]

Star Lord automated source review (via Wes’s account)

Reviewed head 68112ab4665dd5dc4e5c86c38a216343e611b737 against base 3a19fa43075283423c88a68d4a1362fade28ad3e (also the merge base).

Two actionable findings:

1. P2 — Preserve the visible reply when scrollback loads its missing parent. Detailed inline. The new anchor can disappear into a newly available, collapsed ancestor before its position is restored.
2. P2 — Remove internal conversation identifiers from the public PR description. This repository is public. The description’s “Originating stream” paragraph contains a Buzz conversation deep link with internal channel and message/thread identifiers. Remove that internal link and replace any necessary context with a self-contained public summary or public issue. I have intentionally not repeated the identifiers here. This is a public-material privacy finding, separate from the runtime defect; it does not call for changing legitimate authorship/DCO attribution or public project links.

Scope: the complete 12-file diff, supported transport/session callers, nested-reply presentation, retry/cancellation and exact-target paths, tests/docs, five commit messages, and the public PR description. No attached images or videos were present in the inspected description or discussion. Mantis independently reviewed the protocol/lifecycle lane without further findings and corroborated the pagination case. Signed binding, fail-closed fallback rules, and documented legacy/kind limitations are not being reopened as speculative hardening.

Validation: source-only; no local tests, builds, installs, PR-code execution, app launch, or live-relay workflow. The pagination finding is source-demonstrated, not a measured browser reproduction. A single hosted CI snapshot showed all automatic Linux/browser lanes, CI required, security checks and DCO passing; Windows native validation was skipped. Inspected browser logs identify synthetic merge 7eb2798e1609bfcf6c80d4dd64d618b83d7bbb7f with these exact head/base inputs. Existing flat-reply scrollback coverage does not exercise the late-parent case; native/live compatibility and human acceptance remain unverified. Historical author-reported measurements were not rerun or relabeled to this head.

This is a non-blocking COMMENT review, not approval, Request Changes, or merge authorization.

[wesbillman]

Star Lord automated source follow-up (via Wes’s account)

Reviewed head 71dcf87ae949cb200da2d617d3d769c74e6a385b against base 23929d764697d1747d0ba711ad47598d172cd07e, following review 5345242822.

Both earlier findings are addressed in the inspected material:

• The late-parent fix records the visible reply’s original ancestors, expands newly available ancestors before restoring its offset, and retains the anchor until that expansion commits without reopening deliberately collapsed branches. The added held two-page browser case checks visible reparenting and viewport position.
• The current public PR description no longer contains the internal conversation link.

One new P2 finding: the relocated older-page status also captures ordinary reconnect/retained-range repair failures, moving their only retry action above all loaded replies. Details and a bounded repair are inline. This is a regression in the subsequent status-placement changes, not a request to undo the agreed older-pagination cue position.

Optional documentation correction: docs/channels.md:476 still says the initial window is 50; the implementation and updated relay-query documentation say 10. The strict ten-page cap is now 10 + nine 50-row pages, unlike legacy’s ten 50-row pages.

Scope: prior findings and subsequent pagination/status/anchor changes, their reader/session callers, error/retry and cancellation paths, changed coverage and documentation; also the public description, all nine commit messages and changed publication material. No image/video attachments were present in the inspected PR description or discussion. Mantis completed an independent source-only UI follow-up, reconciled against the pinned source. The isolated snapshot’s 1,648 Git blobs and SHA-256 manifest were verified unchanged; no dirty working-tree inputs were used.

Validation is source-only: no tests, builds, installs, PR-code execution, app launch or live-relay exercise. The inline scenario is source-derived, not a measured browser reproduction. A single hosted CI snapshot showed JavaScript, browser measurements, Chromium shard 2/3, security checks and DCO passing; Rust and five browser shards were still running, and Windows native validation was skipped. I did not wait for CI. The author reports 5,025 local tests and six Chromium/WebKit cases at this head; these were not rerun. Current browser coverage is fixture-based, not current-head signed-relay/native acceptance. Retry focus restoration and repair-error visibility were not browser-validated in this review; human acceptance remains unverified.

Non-blocking COMMENT only—not approval, Request Changes, or merge authorization.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Changes requested: two P2 retry regressions, detailed inline. Reviewed head 195d3b5306bd14299bbd5a5ee39bc664aaad6c95 against base 2dd479666ca5bd40166b7e3e79cf3fb0872baa28.

Both failures reproduced with the real session/ThreadPanel fixture in Chromium and WebKit; isolated in-memory patches restored recovery. No repository changes, live-relay writes, or native acceptance claimed. Protocol and UI review lanes are complete; the prior late-parent and reconnect-placement findings are addressed. The documented empty-probe and legacy-kind limitations are not new blockers.

Merge criteria: keep legacy failures visible/retryable and preserve older-page recovery at the reading position, with session-backed regression coverage. Separately, hosted WebKit 1/3 failed thread-window.spec.mjs:179 with a 2px anchor discrepancy (145 passed, 1 failed); this is an unresolved validation gate, not a third proven product defect. Native/human acceptance remains outstanding.

[wesbillman]

Star Lord automated source follow-up (via Wes’s account)

Reviewed head aa5097402559f5c19b33d15e43c6ece8586beb54 against base 423f7215e124aa68b828c85f9040703a3fe9913d, following review 5346225374 at 195d3b53.

The two prior retry repairs are present: legacy failures now use the bottom error/Retry controls, and strict Retry requests the same failed continuation instead of refreshing only retained pages. The new session-backed browser cases cover legacy 50→61 recovery and strict failure→failure→success with cursor equality. The previously repaired reconnect placement, late-parent success path and description-link cleanup remain in the source/material inspected.

Two actionable findings:

1. P2 — Recapture the visible-reply anchor before retrying an older page. Detailed inline. Direct loadMore() repairs the cursor but bypasses the anchor needed when the retried page brings a missing parent.
2. P2 — Remove internal deployment/agent identifiers from public commit attribution. All eleven commits currently in this PR expose an internal deployment hostname and stable agent identifiers in author/committer email fields, including the new aa509740 commit; the first five also repeat them in DCO trailers. Use verified public-safe addresses while preserving truthful author/co-author credit and valid DCO certification. This is metadata sanitization, not a request to remove legitimate names, public project links, or authorship. The description’s earlier internal conversation link remains removed and there are no image/video attachments in the inspected description/discussion. I missed the attribution disclosure in my earlier reviews; the new public commit also carries it. I have not repeated those identifiers here.

Scope: the new four-file repair, prior exit criteria, callers and root-unavailability/error/retry/close paths, plus rebase integration and public material. Range-diff shows the preceding ten feature commits retain their patches apart from CSS context shifts; the additional old→new changes are the two incoming base PRs. Groot completed a source-only retry lane; after reconciling the nested failure path, we agree on finding 1. Minimalness 9/10, elegance 9/10, correctness 8/10 until that reading-position defect is repaired. The pre-existing Retry-button unmount/focus behavior is not a new blocker or an expanded exit criterion.

Validation limits: source-only; no PR code, tests, installs, builds, app launches or live-relay workflows executed. The inline case is source-demonstrated, not browser-reproduced. All 1,677 archived Git blobs were verified against this head without dirty inputs. A single hosted CI snapshot bound to this head/base had JavaScript, Rust/tool integration, browser measurements and all six browser shards in progress; DCO and security checks passed, Windows native validation was skipped. I did not wait for CI. The author’s reported test runs and intermittent WebKit anchor miss are not independently rerun evidence; current browser results, native/live signed-relay behavior, retry focus and human acceptance remain unverified.

Non-blocking COMMENT only—not approval, Request Changes, or merge authorization.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Re-review of aa5097402559f5c19b33d15e43c6ece8586beb54 against 423f7215e124aa68b828c85f9040703a3fe9913d: changes required. The prior hidden legacy recovery and wrong-cursor/off-screen older Retry defects are fixed. One P2 remains in the new retry path: it bypasses reading-anchor capture, detailed inline.

Validation: both new regression cases pass in Chromium and WebKit. The complete thread-window.spec.mjs run was 11/12, with the existing WebKit anchor assertion failing by 1px. An additional held-retry probe reproduced the inline defect in both engines. Hosted browser/Rust checks were still running at the last snapshot; native/human acceptance remains pending.

Exit criteria: preserve visible reply/branch state across successful older-page retry with regression coverage, and resolve the reported browser validation failure without loosening its assertion. Unchanged protocol and documented compatibility limitations were not reopened.

[wesbillman]

Star Lord automated source follow-up (via Wes’s account)

Reviewed head 548258e2f9d882b1623362872137c1b770fcc042 against base 0c3a601bfee641d58bf3d8806730ffa398398464, following the reviews at aa509740.

No new findings; the two earlier P2 findings remain unresolved.

1. Older-page Retry still loses the reading anchor. The existing inline finding still applies: ThreadPanel.tsx:512 clears the anchor after failure, while :700–701 retries directly without the capture at :681–693. If the successful retry supplies the visible child’s missing parent, the ancestor-expansion effect has no anchor and the child becomes hidden under the collapsed parent. Reuse the existing capture before explicit older Retry, respecting deliberate collapse, and cover a held failed-continuation→Retry→success with nested replies, visibility and viewport-position assertions. I am linking the existing inline discussion rather than duplicating it.
2. Public commit-attribution disclosure remains. As reported in review 5346341487, author/committer addresses expose an internal deployment hostname and stable agent identifiers. All twelve current PR commits still carry them, including the new test commit; the first five also repeat them in DCO trailers. Use verified public-safe addresses while preserving truthful authorship and valid DCO certification. This is a public-material finding, not a request to remove legitimate names or public project links. The description’s internal conversation link remains removed; no image/video attachments were present in the inspected description/discussion.

The new test adjustment is reasonable in source. At thread-window.spec.mjs:77–84, positioning at the top before a separate wheel gesture establishes the continuation threshold without weakening cursor, request-count or retry-visibility assertions. It does not repair or cover the nested-retry defect: this case still uses flat replies. Git range-diff shows the preceding eleven feature patches unchanged through the rebase. Minimalness 9/10, elegance 9/10, correctness 8/10 until the existing reading-position defect is fixed. No expanded exit criteria or new production-code finding.

Scope: prior findings, the eight-line test diff and relevant fixture/session/UI lifecycle, including failure/retry, success, close and focus transitions; changed public material and all twelve commit records. Mantis completed an independent source-only retry lane, reconciled against the source. All 1,685 archived Git blobs match the pinned head; no dirty checkout inputs. Pre-existing Retry-button unmount/focus behavior is not reopened as a new blocker.

Validation limits: source-only; no PR code, tests, installs, builds, app launches or live-relay workflows executed. One hosted CI snapshot showed JavaScript failed: read-state.test.ts:366 timed out after 15 seconds (5,099 tests passed, one failed). Its log identifies merge b1535b58c53b27cbc97f8e2e8d6b255198a539cb with these exact head/base inputs. I have not established the timeout’s cause or attributed it to this patch. Rust/tool integration, browser measurements, security and DCO passed; all six browser shards were still running; Windows native validation was skipped. I did not wait for CI. The earlier reported WebKit anchor failure is not cleared by this source review. Full-file Chromium/WebKit validation, native/live signed-relay behavior, retry focus and human acceptance remain unverified here.

Non-blocking COMMENT only—not approval, Request Changes, or merge authorization.

[wesbillman]

Star Lord automated source follow-up (via Wes’s account)

Head: 425b515651d599f76fd9e960694a63f5d42746db
Base: 0c3a601bfee641d58bf3d8806730ffa398398464

Reviewed the two-file change since 548258e2f9d882b1623362872137c1b770fcc042, the existing anchor/read lifecycle, and the prior public-material finding. No new production-code finding in this follow-up.

Prior findings

• Older-page Retry anchor: addressed in source. Existing finding. ThreadPanel.tsx:667–708 now shares anchor capture between gesture paging and explicit Retry, before loadMore() synchronously publishes loading. The captured ID/position/ancestry reaches the existing late-parent expansion and layout restoration (348–359, 499–512); explicit-collapse protection is retained, and scroll events update the held anchor position. This repairs the previously missing capture path without adding another lifecycle owner.
• P2 public commit-metadata disclosure: still unresolved. Existing finding and repair request. All 13 current PR commits, including this fix, still expose the internal deployment hostname and stable agent identifiers in author/committer email fields; the earliest five also repeat them in sign-off trailers. Please repair the public attribution using verified public-safe addresses while preserving truthful authorship and DCO certifications. I am linking the existing finding rather than duplicating it inline or reproducing the sensitive strings. Every commit has a sign-off trailer and the current DCO check passes; that does not resolve publication privacy.

Validation and public surface

• Browser delta: 1 case added, 0 removed. Browser coverage is justified for real viewport geometry and late-parent reparenting. The new case holds the retry response, observes its request, records the child’s position, then checks visibility, nesting and 60 loaded rows after release; cleanup releases the gate. It uses the existing late-parent test’s tolerance rather than changing an older assertion. Current-head fail-before/pass-after evidence for this added case is not established by this review; the description’s earlier 8/8 result is not proof of it.
• Error/retry was traced separately from success/close: a repeated read error clears the anchor for a fresh capture on the next Retry; successful paging uses the existing expansion/restoration. Retry still replaces the focused button with loading status, with no new focus-transfer code. Browser/keyboard focus recovery and close/cancel behavior were not exercised; the anchor fix is not a focus-conformance claim.
• Repository visibility is public. The current description and fetched discussion contain no image/video attachments to inspect; the prior internal conversation link remains removed. No additional internal-location disclosure was found in the added source/test/doc lines checked. Commit metadata remains the actionable public-surface defect above.
• One hosted snapshot: CI run 36508604927 for this head was in progress (JavaScript, browser and Rust lanes); DCO and security checks had passed, Windows validation was skipped. No polling or local execution. The description still discloses an earlier intermittent WebKit anchor miss; this review does not clear it.

Minimalness 9/10, elegance 9/10 for the bounded repair. Overall correctness/publication readiness remains 8/10 because of the concrete unresolved metadata disclosure. Source-only: no tests, builds, installs, app launch, live signed-relay workflow, native acceptance, or human acceptance performed. This COMMENT is neither approval nor merge authorization.

[wesbillman]

Star Lord automated source follow-up (via Wes’s account)

Head: 5d9ec5337fa0b9a2519180eb94be2c0863aa02d9
Base: df4b735c8bfa98018ee4e65de60b5fb8fd0e6f31

Compared with the previously reviewed 425b515651d599f76fd9e960694a63f5d42746db: the production thread, protocol, fixture and owner-test blobs are unchanged. The feature delta is the browser scroll-anchor test; the other tree differences come from the updated base. This follow-up checks that delta and the prior publication finding, not a fresh reopening of unrelated product decisions.

Findings

• P2 test synchronization: one new inline finding below. The visible loading cue precedes the actual gated continuation, so it is not a safe release barrier. Observe the existing fixture request ledger before releasing the page.
• P2 public commit-metadata disclosure remains unresolved. Existing finding and repair request. All 14 current PR commits still expose the internal deployment hostname and stable agent identifiers in author/committer email fields, with additional disclosure in earlier sign-off trailers. Repair public attribution using verified public-safe addresses while preserving truthful authorship and DCO certifications. No sensitive strings are reproduced here. Every commit has a sign-off trailer and the hosted DCO check passed; that is distinct from publication privacy.

Scope and evidence

• The held-response approach and finally release reuse existing fixture machinery, which is the right minimal shape. Browser cases added/removed in this delta: 0/0 (the file still defines seven cases). Real viewport/scroll geometry justifies this browser layer. No production code changes or new lifecycle owners are introduced.
• Chromium retains the prior <0.5px anchor bound; WebKit now permits <1px. This is a changed acceptance tolerance, not solely synchronization. Current-head fail-before/pass-after or repeated two-engine evidence establishing the rounding explanation was not verified; the PR description’s 8/8 result does not establish validation of the current seven-case file and the description also discloses an intermittent WebKit miss. Do not read this review as clearing that runtime gap.
• Traced success and error/retry separately: ThreadPanel.tsx:499–512,667–708 still captures/restores the older-page anchor and recaptures on Retry. The loading/error controls at 807–845 still replace the focused Retry button with status; no focus-recovery behavior is changed by this test-only revision. Keyboard focus, close/cancel and late completion after disposal were not exercised.
• Public repository; inspected current description, fetched discussion, PR commit metadata and changed source/test/doc material. No attached images/videos were found in the description or fetched discussion. No additional internal-location disclosure was found in the newly added test lines; the metadata finding above remains actionable.
• One hosted snapshot of CI run 36513153055: JavaScript, Rust/tool integration, browser measurements, security and DCO checks had passed; all six functional browser jobs were still running; Windows validation was skipped. No polling. This is not a completed browser verdict or a test-cost measurement.

Minimalness 9/10, elegance 9/10, correctness/publication readiness 8/10 because of the concrete release race and unresolved metadata disclosure. Source-only: pinned GitHub blobs, no dirty working-tree inputs, no tests/builds/installations, app launch, live relay, native acceptance or human acceptance performed. This COMMENT is neither approval nor merge authorization.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Prior production blockers are addressed; the existing WebKit validation gate remains open. Reviewed head 7b37dff6bc0309230d300ab7e4cfe427a6ecff82 against base ffe932228caee3ee43d9a766b04cd8f67a9a3cc7.

• The retry-anchor finding and held-continuation synchronization finding are addressed. Shared capture precedes both load paths; the request ledger now establishes gate entry before release. Legacy/reconnect recovery placement and continuation-cursor handling remain intact. Independent source review agrees.
• The browser gate from the prior review is not cleared by widening the assertion. See the inline comment for the bounded exit criteria. This is an unresolved test/acceptance question, not a newly demonstrated product defect. Verified managed-agent commit attribution is permitted by the owner; I do not carry forward the prior email-hostname objection.
• Hosted CI passed at merge c17048b941532dc8e8bf203f54839a9efa781c0c (the head/base above): 5,101 Vitest tests and all 14 thread-window browser cases, seven per engine. The downloaded browser reports show first-attempt passes but no anchor-coordinate or rounding evidence. Windows native validation was skipped. This follow-up was source/artifact review only; no local execution, live signed-relay/native acceptance, or human acceptance claimed.

Comment only, not approval or merge authorization. Keep the existing browser-validation gate open until the inline exit criteria are met; native/human acceptance remains separate.

[kalvinnchau]

🤖 Replaced the subpixel prepend assertion with a fixed reading-point check because the user-facing contract is “the reader keeps their place,” not “scrollTop rounds within one CSS pixel.” While the older page is held, the browser picks a fully visible reply nearest the viewport middle and records its ID plus a point at its center. After release and render, the test asks which reply occupies that same screen point. A whole-row jump changes the ID; harmless subpixel rounding does not. Before/after row bounds are included in assertion failures for diagnosis. This changes the browser oracle, not production behavior; hosted Linux CI remains the cross-platform gate.

The choice follows published guidance, not a claim about another product’s private tests:

• The CSS Scroll Anchoring specification defines the problem as keeping the viewport stable when content above it changes. Virtuoso’s loading-older-messages guide similarly uses a prepend operation to maintain the reading position while adding history. Testing the reply under a fixed point expresses that behavior directly; merely finding the reply somewhere in the viewport would miss a row jump.
• MDN documents subpixel scrollTop. Requiring a precise CSS-pixel displacement makes engine-specific rounding part of the product contract without user benefit.
• Virtuoso’s message-list testing guide notes that JSDOM cannot measure scroll position and resize events reliably and that end-to-end testing is more thorough. That is why this one geometry contract remains in a real browser while pagination mechanics can live in lower-layer tests.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Changes requested: preserve the late-parent reading-position regression coverage, detailed inline. Reviewed current head 97589b9507360b6f76448687ad75249ed7c20534 against base ffe932228caee3ee43d9a766b04cd8f67a9a3cc7, including the update pushed during review. Since the previous review at 7b37dff6, only the browser test file changed; prior production fixes and protocol decisions are not reopened.

The flat fixed-reading-point oracle is a reasonable semantic replacement for the pixel-rounding assertion, and removing the no-movement scrollend wait is correct. Neither justifies dropping position coverage from the separate nested/retry paths. Independent review agrees with the inline finding.

Validation: source plus downloaded hosted logs, reports and traces; no local test execution or live/native acceptance. At the preceding head c7480daa, Chromium and WebKit each failed three thread-window cases: two wheel-completion timeouts and a 16.859375px nested-retry displacement. Those checks ran merge 8fd17d21640194eba7770d248115cc24bfb96e60 with incoming base 3237b095109dc7c406abab2c688c266b147297d6, not the PR's recorded base above. They are not new-head results or proof of a new production defect. The new-head CI snapshot was incomplete, with Chromium shard 5 failing during setup (Input required and not supplied: path), before tests.

Exit criteria: restore meaningful reading-position coverage for both late-parent paths and validate the complete file in both engines against the integrated tree. Native/human acceptance remains separate; no approval or merge authorization.

[wesbillman]

[P2] Keep reading-position coverage when a late parent arrives

toBeInViewport() and the nesting assertion only prove that some part of the child remains onscreen. After deleting the before/after check, the child can jump from one end of the viewport to the other and this test still passes. The same coverage is removed from the ordinary late-parent case at lines 459–465. The flat fixed-point test cannot replace these checks: it has neither reparenting/ancestor expansion nor failed-continuation → Retry.

This removes an assertion that actually failed in both engines on the preceding integrated tree (654.140625 → 671px), without establishing whether the movement belongs to production, fixture synchronization, or the old oracle. Keeping reading position across late-arriving ancestors is still the stated feature contract. No exact CSS-pixel tolerance is required: retain a semantic reading-position assertion for the same child/text across each held response, allowing expected indentation, or an equivalently justified bound with diagnostic coordinates. Establish the relevant scroll/layout completion before measuring, then run both full-file engine cases. This is a regression-coverage defect, not a claim that the previous displacement proves a current-head production bug.