refactor(remote): put the phone on the desktop's rendering seams

[Juliusolsson05]

Problem

The phone companion mounted the desktop's Feed, but it got there through copies of desktop code instead of sharing it, and the copies had drifted. Fixes landed in one copy at a time, which is why the phone kept looking broken. The drift showed up as real rendering bugs on the phone:

• History out of order. Initial history was prepended blindly instead of placed by the OpenCode Terminal: deferred medium/low findings from the round-2 verification #910 rule. A live burst that landed before the backfill put newer turns above older ones, permanently.
• Collapsed-running rule never fired. The ledger got lastJsonlEntryAt: 0.
• No ordering barriers in main. Main's remote tap had no semantic coalescer and none of its barriers, so a cumulative preview could land after the committed row that replaced it.
• Missing condition state. The phone drew the raw condition snapshot, so during a Claude compaction with no screen snapshot it showed nothing where the desktop showed the compaction state.
• Older history unreachable. A view whose rows arrived live first had no pagination cursor.
• Two channels missing. transcript-diagnostic and provider-session-changed never reached the phone. Both are relayed now. The store consumes the diagnostic; the phone follows a provider-session switch through transcript-roll detection and the history-boundary reset, as before.
• Duplicate sub-agent watcher. A second watcher polled the same directories as the first.

Beyond the phone, the rendering code had modularity debt:

• Per-provider policy was hard-coded in the shared decide layer.
• Provider code imported desktop workspace internals.
• 'claude' was a silent fallback for unknown providers.
• Grok and Pi were invisible to the render-shape evidence loop.

This is also groundwork for the planned screenshot viewer, which needs exactly these seams.

What changed

Each concern now has one implementation, with the transport or host injected.

1. One main-side session feed tap (src/main/sessions/sessionFeedTap.ts). It owns every ordering, coalescing and sub-agent decision once, then fans out to sinks:
   • The desktop forwarder is the window sink.
   • SessionFeedSource is the remote sink.
   • Raw PTY channels are opt-in per sink.
2. History on the SessionFeed contract. loadHistory covers both the initial page and older pages, on both transports.
3. One ingest core (src/renderer/src/session-runtime/ingest/). It holds the committed-record admission rules, the OpenCode Terminal: deferred medium/low findings from the round-2 verification #910 placement, the history tool reindex and the live semantic step. The desktop's live burst and history actions, the phone store and the replay harness all call it.
4. A typed RendererHost in place of the phone's six Vite aliases and stubs. It covers the Monaco loader, link and file opening, the debug switch and the recording bridge. Toasts get one shared context.
5. One useAgentFeedModel + AgentFeed, mounted by both TileLeaf and the phone, together with the same ProviderConditionOutlet.
6. Provider-declared ledgerPolicy reached through the registry. The pure model receives LedgerInput.policy and never names a provider.
7. Provider code never imports @renderer/workspace/**.
   • The dead per-provider TileLeaf registry is deleted.
   • A reverse rule is added to the existing import-boundary test.
8. Docs. ARCHITECTURE.md, the conditions and rendering docs, spec status notes, and the plan with implementation notes.

Design decisions and tradeoffs

• Remote isolation doctrine, partly reversed. The capability wall stays: the phone's command surface still cannot spawn, kill, write raw input or switch provider, and raw PTY never reaches the remote sink. What's dropped is the rule that remote re-implements code instead of sharing it, because the duplication is where the bugs were.
• An ingest core, not one store. The shared core is a set of per-record steps. The desktop's queue, optimistic, worktree and ghost planes stay layered on top in its hub, so the phone never carries state it can't fill.
• One deliberate desktop behavior change. History batches now rebuild the tool-pairing index in window order after merging. The result is identical when tool ids are unique; when they repeat, the newest block wins.
• No features/feed/public barrel, a change from the plan. Provider rows importing MarkerRow, the feed contexts and nested rows is legitimate composition. A barrel would only change module evaluation order inside the existing registry ↔ rows cycle. The real violations were the workspace imports, and those are gone.
• The inert default host is intentional. No bundle that mounts a row pulls in desktop code unless the app root mounts that desktop code on purpose.
• Merge with main. feat(composer): lock the composer and show the prompt as Sending in the feed #1183's deliver-prompt flush moved from the deleted module-global coalescer onto SessionFeedTap.flushCommitted, and it now has a test.

Review round

One Claude and one Codex reviewer reviewed the branch read-only. I verified every finding against the code before acting on it, and all of them held.

• Risk: a failing tap sink exited the app. The tap re-raised a sink's error on a microtask, and main's crash hooks treat that as fatal. It now re-raises synchronously after delivering to every sink, so the error surfaces where a throwing listener's always did. (Claude)
• Bug: the phone never consumed transcript-diagnostic. A recovered Pi bridge or late OpenCode Terminal server kept its failure on the phone forever. The desktop's recovery rule is now shared in session-runtime/liveChannelRecovery.ts, and both clients apply it. (Codex)
• Risk: the ledger cache ignored the new policy input. It now compares it. (Codex)
• Weak test: the parity test only compared committed rows through shared helpers. It now also replays the recordings (semantic and committed events interleaved) through both stores and compares the ledger rows they produce. It fails if the phone's semantic subscription is dropped. (both)
• Nit: an exited session could seed a phone with a stale sub-agent fleet. The tap now drops the seed on exit. (Claude)
• Nit: the tsconfigs still listed the deleted registry.renderer.ts. Removed. (Codex)
• Nit: docs claimed the phone consumes provider-session-changed. The claim is corrected: the channel is relayed but not consumed. (both)

Main was merged in three times, bringing in #1176, #1105, #1179, #1183, #1184 and #1185. #1183's deliver-prompt flush now goes through the tap, with a new test.

Issues

Fixes #1177

Verification

• npm run check passes on Node 24 after merging origin/main: test contract, fixture checks, keybindings, tsc -b, the live-resume probe, the full vitest suite (830 files, 6524 tests) and the package build.
• After the review fixes and a second merge of main (feat(goal): let agents complete their goal and bulk-close completed agents #1184), tsc -b is clean and the full vitest suite passes 6558 of 6559. The one failure is the extension Electron system test, which is intermittent and outside this branch's code; details under Known limitations.
• npm run client:build passes. The phone bundle has no Monaco, app store, Global Editor opener, browser-pocket code or desktop toast provider; I checked the module graph of the real build.
• New tests, each confirmed to fail against the old behavior:
  • the tap delivers one barrier-ordered sequence to every sink;
  • a throwing sink doesn't cost another sink its delivery;
  • loadHistory parity across both transports;
  • phone-store vs desktop-fold parity on real Claude and Codex transcripts;
  • the OpenCode Terminal: deferred medium/low findings from the round-2 verification #910 placement on the phone;
  • the admission-mode asymmetry and the history reindex;
  • normalized conditions and the askUserQuestion sentinel on the shared model;
  • the Monaco host veto;
  • the reverse import rule;
  • the feat(composer): lock the composer and show the prompt as Sending in the feed #1181 deliver-prompt barrier through the real tap.
• Not verified live. Per standing instruction the app was not launched, so this is verified from source and tests only. A live phone check (Claude, Codex, OpenCode sessions over LAN) is the remaining manual step.

Known limitations and follow-ups

• Intermittent extension system-test failure, filed as bug(extensions): runtime-api request intermittently rejected for an unrecognized extensionId key #1187. In one full run, electron.system.test.ts failed on a strict-schema ZodError ("Unrecognized key: extensionId") in the extensions:runtime-api handler. The same file passed on its own right afterwards, and in the earlier full run. This branch doesn't touch that code path.

• Phone chrome and CSS are unchanged. This fixes what the phone renders; the layout pass is next, ideally with the planned screenshot viewer.

• SessionPreviewPane still reads history via window.api. It previews a picked conversation with no pane session behind it.

• Pre-existing, intermittent local timeouts, not from this branch. store.test.ts and ProviderEnablementRow time out on some local runs, and they do the same on an untouched main checkout. They passed in the final full run.

🤖 Generated with Claude Code