fix(macapp): fence stale stop and steer actions

docs/logs/INDEX.md

@@ -22,6 +22,21 @@
 
 - 2026-08-03 — Issue #1124 deterministic retry-wait callback fixture evidence
   is recorded in the engineering, observational, and system logs.
+- 2026-08-03 — Issue #1136 records immutable submission timeout capability,
+  one-shot dispatch, and reset/load all-stream detachment separately from #1133.
+
+- 2026-08-03 — Issue #1133 corrects the prior displaced-result wording:
+  displacement revokes controls but does not end A outcome observation.
+
+- 2026-08-03 — Issue #1130 submission-local outcome ownership, deterministic
+  barriers, and ToolWalk timeout ordering are recorded in all durable logs.
+
+- 2026-08-03 — Issue #1128 native submitted-run ownership evidence is recorded
+  in the engineering, observational, system, and long-term logs.
+
+- 2026-08-03 — Issue #1125 native Stop/steer/ToolWalk ownership evidence is
+  recorded in the engineering, observational, system, and long-term logs.
+
 - 2026-08-03 — Issue #1122 native interactive-state ownership evidence is
   recorded in the engineering, observational, system, and long-term logs.
 

docs/logs/engineering-log.md

@@ -57,6 +57,96 @@
   normal/race passed in 13.200s/14.719s. Isolated foreground
   `./scripts/test-regression.sh` then passed normal/race plus 85.5% total
   coverage and zero uncovered functions in 2m26s.
+## 2026-08-03 (Issue #1136 immutable timeout authority)
+
+- Replaced the provisional public handle cancel with a package-visible opaque
+  `TimedOutSubmissionTicket`. Its initializer is fileprivate to `Runner`; the
+  only mint point is `waitForTerminal`'s final deadline-edge lifecycle check.
+  Ticket consumption retains the private `RunSubmission` owner-token/generation
+  recheck and is transport-only. Terminal, failure, reset, and load revoke it.
+- `RunSession` now tracks every submission stream by handle. Reset/load cancels
+  both displaced A and selected C rather than only the most recent stream.
+- TDD red: removing the old API produced nine expected focused compile errors
+  at former direct call sites. Gated proof now requires no ticket/action before
+  deadline, B -> C -> A exact-one dispatch, duplicate refusal, and post-ticket
+  terminal/failure/reset revocation. Remaining full-gate evidence is recorded
+  by this corrected PR rather than inherited from the superseded implementation.
+- Review correction: the first ticket implementation left a package-scoped raw
+  transport method callable before deadline. The ticket, constructor, and
+  transport closure now live in GoCodeUI; ToolWalk binds the immutable duration
+  at submission and `submissionTimeoutGate(for:)` alone verifies the derived
+  deadline and mints once. The #1146 CI-flake repair introduces an internal
+  `RunSession` monotonic-now seam shared by `RunSubmission.markStarted` and
+  `SubmissionTimeoutGate`; tests freeze/advance it at epsilon and exact
+  deadline instead of sleeping. `Runner.waitForTerminal` now accepts only its
+  poll interval so a caller cannot silently pass a conflicting timeout after
+  submission. A direct
+  gate regression plus a source-surface drift test prevents that bypass.
+
+## 2026-08-03 (Issue #1133 passive displaced-submission outcome)
+
+- Corrected the #1130 wait-policy gap: displacement is now a permanent action
+  fence, not a terminal ToolWalk result. Runner waits for its immutable A
+  handle's terminal/failure through deadline and never auto-answers/approves a
+  mismatched or displaced selected B.
+- `cancelTimedOutSubmission` retains exact locally owned A transport authority
+  after B selection, but its displaced path is transport-only: it cannot alter
+  B selection, transcript, pending UI, or cancellation state.
+- Test-first evidence: four URLSession-gated `RunSession.submit()` + Runner
+  tests were red before the repair (terminal/EOF/timeout returned displaced;
+  delayed ACK returned without A identity). The resulting #1133 tests prove
+  passive terminal, EOF failure, delayed acknowledgement, and B-safe timeout
+  policy. The stronger B -> C authority and revocation proof is tracked in
+  the separate #1136 entry above.
+- Verification: final combined focused `PassiveSubmissionOutcomeIntegrationTests`
+  passes 10/10 (not the earlier intermediate 4/4 or 8/8 counts); strict format
+  (0/7 touched Swift files require formatting) and
+  full `swift test --package-path macapp` (244 tests / 46 suites) pass. Full
+  regression, independent review, and hosted checks remain.
+
+## 2026-08-03 (Issue #1130 submission-local outcomes)
+
+- Split `RunSubmission` into independent A-local `Lifecycle` and displacement
+  facts. A terminal or failure therefore remains available to the initiating
+  caller after scheduled B selection instead of becoming a false timeout.
+- A delayed `startRun` acknowledgement now binds A's handle first, but only an
+  exact, undisplaced active handle may select/activate/account it. Stream EOF
+  and start/transport errors always settle A locally; they fail visible state
+  only while that same A still owns it. `finishRunIfCurrent` clears by object
+  identity rather than a reusable run-id lookup.
+- ToolWalk now uses typed wait outcomes. Terminal/failure precede displacement,
+  and only `.timedOut` reaches guarded A cancellation. New deterministic gate
+  tests cover late acknowledgement, late start/EOF failure, reset/load
+  detachment, and zero B mutation; outcome tests cover ordering and cancellation.
+- Verification: strict Swift formatting, focused submission/ToolWalk suites
+  (13 tests/2 suites), full `swift test` (238 tests/45 suites), and the
+  retained-pane `./scripts/test-regression.sh` pass (normal, race, 85.5% total
+  coverage, zero uncovered functions).
+
+## 2026-08-03 (Issue #1128 submitted-run ownership)
+
+- Added `RunSubmission`, returned by both native submit layers. It records A's
+  `startRun` identity, per-run transcript, terminal result, failure, and
+  displacement independently from the conversation's selected run.
+- ToolWalk now waits, auto-controls, times out, and judges the handle. A
+  selected B produces an explicit displaced result before any B endpoint call.
+  A local lifecycle timestamp is retained so later authoritative B selection
+  works without weakening provisional stale-replay protection.
+- Composer captures `.submit` or `.steer(A)` once; the pure execution seam
+  proves stale steering cannot fall through to a new submission.
+- Verification: strict Swift format; focused submission/external/ToolWalk
+  suite (37 tests/5 suites); full Swift package (230 tests/44 suites); exact
+  repository normal/race regression; coverage 85.5% with zero uncovered
+  functions.
+
+## 2026-08-03 (Issue #1125 native action-owner fence)
+
+- Added expected-run cancel/steer boundaries. Chat Stop, Composer, and ToolWalk
+  timeout carry their rendered/decision A identity; a B mismatch exits before
+  local mutation, Task creation, or HTTP.
+- Deterministic A-to-B tests prove stale Stop, steer, and timeout send zero B
+  endpoint requests while legitimate B actions still reach their endpoints.
+
 ## 2026-08-03 (Issue #1007 External Scheduled-Run Controls Rebase)
 
 - System/component: `RunSession` control-owner reducer, accounting fence,

docs/logs/long-term-thinking-log.md

@@ -38,6 +38,60 @@
   later same-run admission; normal/race/package/full gates are green.
 - Guardrails: no product source, API, SQLite schema, config, client, UI, or
   lifecycle change; no sleep/timeout increase or synthetic production defect.
+## 2026-08-03 (Issue #1136 immutable timeout authority)
+
+- Command intent: make a timed-out submitted A independently and exactly
+  cancellable after B/C selection without allowing the timeout path to affect
+  B or C.
+- Success: only a Runner deadline-minted opaque ticket can consume A's
+  started-only capability once; terminal, failure, reset, and load revoke it;
+  reset/load physically stop every A/C submission stream. Direct deterministic
+  proof complements #1133 policy waits.
+- Non-goal: reintroducing run-ID lookup, changing server cancellation, or
+  mutating selected-run UI from timeout transport.
+
+## 2026-08-03 (Issue #1133 intent correction)
+
+- Command intent: a callback/cron continuation must visibly continue B while
+  the initiating tool walk truthfully observes its own submitted A outcome.
+- Success: B displacement is sticky for control authority; A terminal/failure
+  after B is a valid A verdict; an A deadline cancels only A and produces no B
+  action or visible-state mutation.
+- Non-goal: making B a hidden fallback, treating displacement as success, or
+  using shared `currentRunID` to judge/control A.
+
+## 2026-08-03 (Issue #1130 submission-local outcomes)
+
+- Command intent: repair the #1128 review findings without weakening the
+  native external-run ownership fences.
+- User intent: an initiating A turn must receive its real terminal/failure
+  outcome, while a visible callback/cron B remains correct and controllable.
+- Success: barrier-proven A terminal/failure survives B selection; late A work
+  cannot change B; ToolWalk cancels only a genuine A timeout; reset/load/EOF
+  are deterministic ownership boundaries.
+- Guardrails: stacked native/ToolWalk-only change; preserve #1122/#1125
+  expected-run guards and #1128 A-only transcript/displacement behavior.
+
+## 2026-08-03 (Issue #1128 submitted-run ownership)
+
+- Command intent: close the remaining native composer/ToolWalk A-to-B ownership
+  gaps identified by Sol review after #1125.
+- User intent: an agent-walk or user click must continue/control the submitted
+  conversation turn, never a later cron/callback continuation that happens to
+  be visually selected.
+- Success: immutable composer action selection plus an A-only handle whose
+  identity comes only from `startRun`, with deterministic zero-B-action proof,
+  retained A terminal verdict, and safe failure/reset behavior.
+
+## 2026-08-03 (Issue #1125 native action-owner fence)
+
+- Command intent: repair the remaining stale native action paths identified in
+  Sol review of #1123 as a single stacked slice.
+- User intent: no scheduled continuation receives Stop, steer, or timeout cancel
+  meant for an earlier rendered run.
+- Success: expected-run guards and captured client identities with deterministic
+  zero-B-endpoint proof, while #994 and #1122 semantics remain intact.
+
 ## 2026-08-03 (Issue #1122 Native Interactive-State Ownership)
 
 - Command intent: prevent a stale approval, plan, or input affordance from

docs/logs/observational-log.md

@@ -31,6 +31,59 @@
 - The pre-deadline checkpoint includes retry state, exact due time, reserved
   run ID, attempt one, and empty token/lease; checking all of them prevents a
   no-call assertion from masking an accidental claim or fence leak.
+## 2026-08-03 (Issue #1136 timeout capability proof)
+
+- A real deadline is suitable for #1133 wait-policy coverage but is not enough
+  if any caller can turn a submission handle into authority. The opaque ticket
+  is absent before deadline and can be constructed only at Runner's deadline
+  boundary; deterministic consumption makes B -> C -> A exact-one dispatch
+  and terminal/failure/reset non-dispatch observable.
+- A single mutable stream task would leave displaced A running when C starts.
+  The handle-keyed task registry permits reset/load to stop both streams.
+
+## 2026-08-03 (Issue #1133 passive outcome observation)
+
+- The #1130 handle correctly retained A lifecycle after B selection, but the
+  consumer stopped polling it on `.displaced`; durable A evidence was therefore
+  present but unobserved. A control authority and outcome observation are
+  separate concerns.
+- Gated integration runs show B can precede A terminal, A stream EOF, A timeout,
+  or A start acknowledgement. Each retains B as the selected scheduled run;
+  only the deadline scenario emits an A cancel request.
+- B can itself terminal before A while a user submits C. This proved timeout
+  authorization must follow A's stream lifetime, not `activeSubmission` or the
+  one current local-stream pointer. The final contract uses an immutable A
+  handle owner token plus reset/load generation and cancels every live local
+  submission stream when detaching a session.
+
+## 2026-08-03 (Issue #1130 submission-outcome observation)
+
+- The original single `State` made displacement overwrite terminal/failure
+  evidence. ToolWalk then saw only a nonterminal displaced handle and could
+  report an A timeout even when A had completed.
+- A late `startRun` response is not a stale response to discard: its run ID is
+  needed for A-local diagnostics and outcome handling. It is stale only for
+  shared selection, accounting, streams, and visible error state.
+- EOF is an ownership-sensitive failure: the visible A must stop spinning, but
+  the same EOF after B selection must not make B look failed.
+
+## 2026-08-03 (Issue #1128 submission observation)
+
+- A rendered run ID is insufficient when the action type is re-derived at
+  click time. Both the mode and owner must be captured together. Likewise,
+  shared session state is a presentation authority, not proof of which run a
+  ToolWalk submission started.
+- The red regression additionally showed that a local run must record its own
+  first timestamped lifecycle frame. Otherwise it remains permanently
+  provisional and a genuinely newer scheduled continuation cannot become the
+  selected owner.
+
+## 2026-08-03 (Issue #1125 action-owner observation)
+
+- Stop and steer are authority-bearing UI actions: retaining a SwiftUI closure
+  across A-to-B selection means a fresh current-ID lookup changes the user's
+  target. The identity must be captured and checked before draft/cancel state.
+
 ## 2026-08-03 (Issue #1007 Rebase Observation)
 
 - The original #1007 action fixture attempted approve, deny, answer, steer,

docs/logs/system-log.md

@@ -38,6 +38,68 @@
   complete tools normal/race (13.200s/14.719s) pass on the final source tree;
   isolated repository regression also passes normal/race, 85.5% coverage, and
   zero uncovered functions.
+## 2026-08-03 (Issue #1136 immutable timeout capability)
+
+- `RunSubmission` privately binds owner token, generation, lifecycle, and a
+  consumed bit. ToolWalk alone binds its configured duration at submission,
+  `markStarted` derives the absolute deadline, and `Runner.waitForTerminal`
+  mints a package-visible ticket with a fileprivate constructor only through
+  `RunSession.submissionTimeoutGate(for:)` after its exact deadline check. The
+  ticket captures a fileprivate transport closure;
+  no raw package or public `RunSubmission` handle-cancel API remains. A
+  handle-keyed task registry lets reset/load cancel all local streams.
+- Deterministic native timing: production uses `ContinuousClock.now`; the
+  internal-only RunSession initializer injects the same monotonic closure into
+  `markStarted` deadline creation and gate expiry checks, so tests advance
+  epsilon/exact-deadline state without scheduler-dependent sleeps.
+- Wait API boundary: `Runner.waitForTerminal` accepts only a polling interval.
+  The timeout is immutable submission configuration, not a second wait-phase
+  parameter that can conflict with the stored deadline.
+
+## 2026-08-03 (Issue #1133 passive A outcome after B selection)
+
+- Flow: ToolWalk captures `RunSubmission(A)` -> conversation stream selects B
+  and marks A displaced -> Runner disables all automatic controls yet continues
+  reading A-local lifecycle -> A terminal/failure is judged, or deadline sends
+  the existing A cancel endpoint through a local-ownership fence.
+- The selected-run reducer remains the only B UI authority. The displaced A
+  timeout path intentionally performs no shared-state transition, so it cannot
+  clear B pending controls, selection, transcript, or acknowledgement state.
+- `RunSubmission` carries a session-owner token and reset/load generation plus
+  a one-shot started-only timeout capability. It preserves A-only authority
+  through B -> C replacement without reconstructing it from an ID/set; terminal
+  or failure consume no capability, and reset/load cancels all live submission
+  tasks while invalidating old handles.
+
+## 2026-08-03 (Issue #1130 submission-local outcome flow)
+
+- Flow: local composer/ToolWalk A -> `RunSubmission.lifecycle` plus
+  `isDisplaced`; conversation SSE can select scheduled B without rewriting A.
+  A start/stream tasks settle the handle, while `RunSession` shared transcript,
+  accounting, and controls require exact active-handle identity and selected A.
+- ToolWalk order is terminal -> failure -> displaced -> timeout. The first two
+  are judged from A's transcript, displacement performs no automatic control,
+  and only timeout calls existing expected-run cancellation for A.
+- Reset/load synchronously displace and detach active A. A late response cannot
+  select the replacement conversation; a cancelled detached task is not
+  reported as a transport failure.
+
+## 2026-08-03 (Issue #1128 submission lifecycle)
+
+- Flow: Composer/ToolWalk -> `ProjectSession.submit` -> `RunSession.submit` ->
+  `RunSubmission` -> `startRun` response assigns A -> A-only per-run SSE
+  reduces the handle -> terminal/failure/displacement is observed by ToolWalk.
+- A selected B synchronously marks a started A handle displaced. ToolWalk then
+  performs no automatic input/approval/timeout action against B. Reset/load
+  displaces unresolved submissions; a late server response exits before it can
+  reactivate the reset session.
+
+## 2026-08-03 (Issue #1125 native action owner)
+
+- Ownership path: rendered Stop/Composer or ToolWalk timeout -> expected run ID
+  -> RunSession guard -> existing run-specific HarnessClient cancel/steer endpoint.
+  Mismatch returns before local force-stop, draft clear, Task, or network.
+
 ## 2026-08-03 (Issue #1007 Native External-Run Reducer)
 
 - `RunSession` now has separate in-memory active/control ownership from

docs/plans/2026-08-03-issue-1125-action-owner-impact-map.md

@@ -0,0 +1,26 @@
+# Cross-Surface Impact Map: Issue #1125
+
+## Ownership and Data Flow
+
+- Chat captures `currentRunID` for Stop/Composer; ToolWalk snapshots the timeout
+  owner; `RunSession` validates it before local mutation, Task creation, or HTTP.
+- Search evidence: `rg -n "run.cancel|run.steer|currentRunID|ToolWalk" macapp
+  -g '*.swift'` located exactly the three stale action paths.
+
+## API, Persistence, Compatibility
+
+- No API/wire/schema/persistence change. Existing run-specific endpoints remain.
+- Legacy dynamic APIs remain for programmatic compatibility; visible clients use
+  expected-run overloads. Mixed client rollout is safe.
+
+## Lifecycle, Clients, and Operations
+
+- Stale actions cannot clear B's draft, local-force-stop B, or send B traffic.
+- #994 delayed ACK and external-run isolation remain in the same RunSession path.
+- Only macOS and ToolWalk change; TUI, harness, providers, deployment, and public
+  docs are unaffected by source search. Rollback is a native-only revert.
+
+## Tests
+
+- A-to-B stale Stop, steer, and ToolWalk timeout assert zero B endpoints;
+  legitimate B cancel/steer retains positive endpoint evidence.

docs/plans/2026-08-03-issue-1125-action-owner-plan.md

@@ -0,0 +1,31 @@
+# Plan: Issue #1125 native run-action ownership
+
+## Context and Scope
+
+- Governing issue: #1125, stacked on #1122 head `d1931ae2`.
+- Stop, Composer steer, and ToolWalk timeout previously resolved `currentRunID`
+  at action time, so stale A UI could target newly selected B.
+- In scope: expected-run cancel/steer APIs, captured identities in native UI and
+  ToolWalk, deterministic A-to-B tests, and inherited strict-format repair.
+- Out of scope: harness API, callback dispatch, TUI, selection policy, and
+  #1122 approval/plan/input fences.
+
+## TDD and Verification
+
+- Expected red: a captured A action can issue B cancel/steer after selection.
+- Green: stale A yields zero B endpoint calls; B remains selected and draft is
+  preserved; legitimate B actions, #994 delayed ACK/force-stop, and external
+  isolation remain covered.
+- Gates: strict Swift format, focused native/ToolWalk tests, full Swift package,
+  repository regression, then hosted checks and independent review.
+
+## Impact Map
+
+- `2026-08-03-issue-1125-action-owner-impact-map.md`.
+
+## Checklist
+
+- [x] Verify issue and exact #1122 stack base.
+- [x] Add expected-run fences, visible captures, and deterministic regressions.
+- [x] Repair strict Swift formatting.
+- [ ] Run complete gates, push draft `Closes #1125`, and obtain cheap review.