fix(toolwalk): observe displaced submission outcomes

docs/logs/INDEX.md

@@ -22,6 +22,12 @@
 
 - 2026-08-03 — Issue #1124 deterministic retry-wait callback fixture evidence
   is recorded in the engineering, observational, and system logs.
+- 2026-08-03 — Issue #1136 records immutable submission timeout capability,
+  one-shot dispatch, and reset/load all-stream detachment separately from #1133.
+
+- 2026-08-03 — Issue #1133 corrects the prior displaced-result wording:
+  displacement revokes controls but does not end A outcome observation.
+
 - 2026-08-03 — Issue #1130 submission-local outcome ownership, deterministic
   barriers, and ToolWalk timeout ordering are recorded in all durable logs.
 

docs/logs/engineering-log.md

@@ -57,6 +57,38 @@
   normal/race passed in 13.200s/14.719s. Isolated foreground
   `./scripts/test-regression.sh` then passed normal/race plus 85.5% total
   coverage and zero uncovered functions in 2m26s.
+## 2026-08-03 (Issue #1136 immutable timeout authority)
+
+- Replaced the provisional mutable-pointer authorization with a private
+  `RunSubmission` owner-token/generation capability. It atomically dispatches
+  only once while A is started; terminal, failure, reset, and load revoke it.
+- `RunSession` now tracks every submission stream by handle. Reset/load cancels
+  both displaced A and selected C rather than only the most recent stream.
+- Deterministic gated evidence proves B -> C -> A emits exactly one A cancel,
+  zero B/C actions, and terminal/failure/reset have no dispatch. Full native
+  Swift passes 245 tests in 46 suites; repository regression awaits #1135.
+
+## 2026-08-03 (Issue #1133 passive displaced-submission outcome)
+
+- Corrected the #1130 wait-policy gap: displacement is now a permanent action
+  fence, not a terminal ToolWalk result. Runner waits for its immutable A
+  handle's terminal/failure through deadline and never auto-answers/approves a
+  mismatched or displaced selected B.
+- `cancelTimedOutSubmission` retains exact locally owned A transport authority
+  after B selection, but its displaced path is transport-only: it cannot alter
+  B selection, transcript, pending UI, or cancellation state.
+- Test-first evidence: four URLSession-gated `RunSession.submit()` + Runner
+  tests were red before the repair (terminal/EOF/timeout returned displaced;
+  delayed ACK returned without A identity). The resulting #1133 tests prove
+  passive terminal, EOF failure, delayed acknowledgement, and B-safe timeout
+  policy. The stronger B -> C authority and revocation proof is tracked in
+  the separate #1136 entry above.
+- Verification: final combined focused `PassiveSubmissionOutcomeIntegrationTests`
+  passes 10/10 (not the earlier intermediate 4/4 or 8/8 counts); strict format
+  (0/7 touched Swift files require formatting) and
+  full `swift test --package-path macapp` (244 tests / 46 suites) pass. Full
+  regression, independent review, and hosted checks remain.
+
 ## 2026-08-03 (Issue #1130 submission-local outcomes)
 
 - Split `RunSubmission` into independent A-local `Lifecycle` and displacement

docs/logs/long-term-thinking-log.md

@@ -38,6 +38,27 @@
   later same-run admission; normal/race/package/full gates are green.
 - Guardrails: no product source, API, SQLite schema, config, client, UI, or
   lifecycle change; no sleep/timeout increase or synthetic production defect.
+## 2026-08-03 (Issue #1136 immutable timeout authority)
+
+- Command intent: make a timed-out submitted A independently and exactly
+  cancellable after B/C selection without allowing the timeout path to affect
+  B or C.
+- Success: one A handle can consume its started-only capability once; terminal,
+  failure, reset, and load revoke it; reset/load physically stop every A/C
+  submission stream. Direct deterministic proof complements #1133 policy waits.
+- Non-goal: reintroducing run-ID lookup, changing server cancellation, or
+  mutating selected-run UI from timeout transport.
+
+## 2026-08-03 (Issue #1133 intent correction)
+
+- Command intent: a callback/cron continuation must visibly continue B while
+  the initiating tool walk truthfully observes its own submitted A outcome.
+- Success: B displacement is sticky for control authority; A terminal/failure
+  after B is a valid A verdict; an A deadline cancels only A and produces no B
+  action or visible-state mutation.
+- Non-goal: making B a hidden fallback, treating displacement as success, or
+  using shared `currentRunID` to judge/control A.
+
 ## 2026-08-03 (Issue #1130 submission-local outcomes)
 
 - Command intent: repair the #1128 review findings without weakening the

docs/logs/observational-log.md

@@ -31,6 +31,29 @@
 - The pre-deadline checkpoint includes retry state, exact due time, reserved
   run ID, attempt one, and empty token/lease; checking all of them prevents a
   no-call assertion from masking an accidental claim or fence leak.
+## 2026-08-03 (Issue #1136 timeout capability proof)
+
+- A real deadline is suitable for #1133 wait-policy coverage but is not an
+  authority proof. Direct synchronous capability consumption makes B -> C -> A
+  exact-one dispatch and terminal/failure/reset non-dispatch deterministic.
+- A single mutable stream task would leave displaced A running when C starts.
+  The handle-keyed task registry permits reset/load to stop both streams.
+
+## 2026-08-03 (Issue #1133 passive outcome observation)
+
+- The #1130 handle correctly retained A lifecycle after B selection, but the
+  consumer stopped polling it on `.displaced`; durable A evidence was therefore
+  present but unobserved. A control authority and outcome observation are
+  separate concerns.
+- Gated integration runs show B can precede A terminal, A stream EOF, A timeout,
+  or A start acknowledgement. Each retains B as the selected scheduled run;
+  only the deadline scenario emits an A cancel request.
+- B can itself terminal before A while a user submits C. This proved timeout
+  authorization must follow A's stream lifetime, not `activeSubmission` or the
+  one current local-stream pointer. The final contract uses an immutable A
+  handle owner token plus reset/load generation and cancels every live local
+  submission stream when detaching a session.
+
 ## 2026-08-03 (Issue #1130 submission-outcome observation)
 
 - The original single `State` made displacement overwrite terminal/failure

docs/logs/system-log.md

@@ -38,6 +38,28 @@
   complete tools normal/race (13.200s/14.719s) pass on the final source tree;
   isolated repository regression also passes normal/race, 85.5% coverage, and
   zero uncovered functions.
+## 2026-08-03 (Issue #1136 immutable timeout capability)
+
+- `RunSubmission` privately binds owner token, generation, lifecycle, and a
+  consumed bit. `RunSession` is the only authority that can consume it, and
+  `cancelTimedOutSubmission` dispatches a transport-only A cancel only on that
+  success. A handle-keyed task registry lets reset/load cancel all local streams.
+
+## 2026-08-03 (Issue #1133 passive A outcome after B selection)
+
+- Flow: ToolWalk captures `RunSubmission(A)` -> conversation stream selects B
+  and marks A displaced -> Runner disables all automatic controls yet continues
+  reading A-local lifecycle -> A terminal/failure is judged, or deadline sends
+  the existing A cancel endpoint through a local-ownership fence.
+- The selected-run reducer remains the only B UI authority. The displaced A
+  timeout path intentionally performs no shared-state transition, so it cannot
+  clear B pending controls, selection, transcript, or acknowledgement state.
+- `RunSubmission` carries a session-owner token and reset/load generation plus
+  a one-shot started-only timeout capability. It preserves A-only authority
+  through B -> C replacement without reconstructing it from an ID/set; terminal
+  or failure consume no capability, and reset/load cancels all live submission
+  tasks while invalidating old handles.
+
 ## 2026-08-03 (Issue #1130 submission-local outcome flow)
 
 - Flow: local composer/ToolWalk A -> `RunSubmission.lifecycle` plus

docs/plans/2026-08-03-issue-1133-passive-outcome-impact-map.md

@@ -0,0 +1,77 @@
+# Cross-Surface Impact Map: Issue #1133
+
+## Task
+
+- Task / issue: #1133 passive observation of displaced A submission outcomes.
+- Plan link: `2026-08-03-issue-1133-passive-outcome-plan.md`.
+- Owner: native-client delivery lane.
+- Status: implemented locally, stacked on #1131 `63cf9fcd`.
+
+## Current Ownership, Callers, and Data Flow
+
+- Entry points: `ProjectSession.submit`/composer -> `RunSession.submit` ->
+  `RunSubmission`; `ToolWalk.Runner` waits, controls, and judges the handle.
+- Source of truth: `RunSubmission.lifecycle` is A outcome; `isDisplaced` and
+  `RunSession.currentRunID` are authority fences for shared UI/actions.
+- Search evidence: `rg -n "RunSubmission|waitForTerminal|cancelTimedOutSubmission|activeSubmission" macapp`.
+- Conclusion: submission-local result and shared selected-run authority are
+  intentionally separate; wait policy must observe the former while honoring
+  the latter.
+
+## Config, API, CLI, and Tools
+
+- Config/defaults/environment: none.
+- HTTP/schema/server: uses existing exact `/v1/runs/{A}/cancel`; no schema or
+  server change.
+- CLI/tools: ToolWalk wait policy only; command grammar/tool catalog unchanged.
+- Errors: A EOF/failure remains a truthful ToolWalk result, never B UI error.
+
+## Persistence and Compatibility
+
+- Schemas/migrations/caches: none.
+- Compatibility: no public wire change; `RunSubmission` keeps existing state
+  projection and sticky displacement semantics.
+- Mixed version: client-local behavior; no server compatibility concern.
+
+## Lifecycle, Security, and Reliability
+
+- Concurrency: A SSE, B conversation SSE, start ACK, and timeout race. A is
+  passive after displacement until terminal/failure/deadline. #1136 owns the
+  immutable B/C authority and revocation contract.
+- Authorization/trust: #1133 relies on the existing exact A-only path; #1136
+  hardens the capability boundary. No credentials change.
+- Failure/recovery: timeout sends A-only transport without touching B's
+  selection, pending UI, transcript, or cancel state.
+
+## Product and Integration Surfaces
+
+- Server/runtime and TUI: none.
+- macOS/ToolWalk: B stays visually selected; initiating ToolWalk receives the
+  actual A terminal/failure verdict.
+- Providers/catalog/automation: none; cron/callback B is the motivating normal
+  conversation continuation.
+- UX/accessibility: no new controls; avoids stale controls acting on B.
+
+## Deployment and Operations
+
+- Deployment/flags: standard native PR; no migration.
+- Diagnostics: the retained submission handle is the A-local evidence.
+- Rollback: revert PR if an A deadline can affect B; gated tests isolate this.
+
+## Regression Tests
+
+- Red: four initial actual gated URLSession tests failed pre-fix: A terminal/EOF
+  and timeout returned `.displaced`; delayed ACK returned before A had an
+  identity.
+- Acceptance: B-before-terminal, EOF, timeout, and delayed ACK use
+  `RunSession.submit()` plus `Runner`, assert B selection and zero B endpoint
+  actions. #1136 owns B -> C exact-one A dispatch and revocation coverage.
+- Full commands: strict format, focused native/ToolWalk tests, `swift test
+  --package-path macapp`, and `./scripts/test-regression.sh`.
+
+## Documentation and Handoff
+
+- Public docs: none.
+- Internal docs: plan/map, active plan, four durable logs, and both indexes.
+- PR handoff: `Closes #1133`, red/green commands, exact stacked base, review,
+  and hosted check evidence.

docs/plans/2026-08-03-issue-1133-passive-outcome-plan.md

@@ -0,0 +1,62 @@
+# Plan: Issue #1133 passive displaced-submission outcomes
+
+## Context
+
+- Governing GitHub issue: #1133.
+- Problem: after B replaces visible submitted A, ToolWalk returned `.displaced`
+  immediately. A terminal/failure therefore could never be judged even though
+  `RunSubmission` still retained the correct A-only evidence.
+- User impact: scheduled callbacks/crons can continue the visible conversation
+  without causing the initiating tool walk to falsely fail or control B.
+- Constraints: stack on #1131 `63cf9fcd`; no harness, TUI, persistence, or wire
+  contract change; B selection permanently revokes A automatic controls.
+
+## Scope
+
+- In scope: retain passive A observation through terminal/failure/deadline and
+  prove the timeout policy sends A-only transport without a B action, using
+  gated `RunSession.submit()` plus `Runner` integration coverage. #1136 owns
+  the immutable capability implementation and its stronger authority proof.
+- Out of scope: changing selected-run UI ownership, server scheduling, ToolWalk
+  grammar, retry behavior, or live #1010 acceptance.
+
+## Documentation Contract
+
+- Feature status: implemented locally, pending review and hosted gates.
+- Public docs affected: none; this is an internal native/ToolWalk ownership
+  policy.
+- Implementation notes: durable logs and indexes record the corrected contract.
+
+## Test Plan (TDD)
+
+- First failing test: B is selected before A terminal/EOF/timeout/delayed ACK;
+  old Runner returns `.displaced`, so it neither observes A nor cancels timed-out
+  A.
+- Acceptance tests: actual URLSession-gated `RunSession.submit()` +
+  `Runner.waitFor…` tests prove A terminal, A EOF failure, A-only timeout POST,
+  and delayed A acknowledgement, each with zero B action endpoints. #1136
+  owns the B -> C immutable authority, revocation, and all-stream proof.
+- Regression tests: existing action-owner, delayed-ACK, submission-handle, and
+  ToolWalk outcome suites; full Swift and repository regression gates.
+
+## Implementation Checklist
+
+- [x] Verify #1133 and stacked #1131 base.
+- [x] Write and capture the gated integration red.
+- [x] Keep displacement sticky while observing terminal/failure passively.
+- [x] Make timeout transport-only for exact locally owned displaced A.
+- [x] Update plans/logs/indexes, including the stale displaced-result wording.
+- [x] Run strict format and focused/full Swift; final combined focused
+  `PassiveSubmissionOutcomeIntegrationTests` evidence is 10/10 (not the
+  intermediate #1133-only 4/4 count).
+- [ ] Run full regression after the independent #1135 baseline fixture repair.
+- [ ] Publish stacked draft `Closes #1133`; obtain independent cheap review.
+
+## Risks and Mitigations
+
+- Risk: passive waiting accidentally sends an A prompt/approval to selected B.
+  Mitigation: explicit `isDisplaced || currentRunID != A` control fence and
+  per-test zero-B endpoint assertions.
+- Risk: A timeout does nothing because B is selected, or mutates B state.
+  Mitigation: narrow local-submission ownership predicate with an A-only
+  transport POST that does not change shared selected/transcript state.

docs/plans/2026-08-03-issue-1136-timeout-authority-impact-map.md

@@ -0,0 +1,28 @@
+# Cross-Surface Impact Map: Issue #1136
+
+## Task and ownership
+
+- Issue: #1136 immutable submitted-run timeout authority.
+- Source of truth: a `RunSubmission` created by its owning `RunSession`.
+- Search evidence: `RunSubmission`, `consumeTimeoutCancellation`,
+  `cancelTimedOutSubmission`, and `submissionStreamTasks` under `macapp/`.
+
+## Surfaces
+
+- Native model: private owner UUID plus reset/load generation and lifecycle
+  form an unforgeable, one-shot A cancellation capability.
+- ToolWalk: invokes only the handle API. Its timeout is transport-only; it
+  cannot alter B/C selection, transcript, controls, or cancellation state.
+- HTTP/API: unchanged existing `POST /v1/runs/{A}/cancel` endpoint only.
+- Persistence, harness, TUI, schema, CLI, providers: none; search found no
+  changed contract or stored state.
+
+## Reliability, test, and rollback
+
+- Concurrent A SSE, B/C conversation events, delayed ACK, timeout, and reset
+  are scoped by immutable handle. Terminal/failure/reset/load make later A
+  dispatch impossible; displacement deliberately does not.
+- Gated URLProtocol integration uses actual `RunSession.submit()` and proves
+  B -> C -> A sends exactly one A cancel, zero B/C actions, and reset stops
+  both concurrent A/C event streams.
+- Rollback is the stacked native PR; no data migration or server rollback.

docs/plans/2026-08-03-issue-1136-timeout-authority-plan.md

@@ -0,0 +1,38 @@
+# Plan: Issue #1136 immutable timeout authority
+
+## Context and scope
+
+- Governing issue: #1136, stacked after #1133 on the #1131 native ownership
+  line.
+- Problem: a mutable session pointer cannot prove that an A timeout remains
+  owned by A after B terminals and C starts.
+- In scope: private A-handle capability authority, reset/load invalidation,
+  one-shot transport dispatch, and deterministic native proof.
+- Out of scope: harness endpoints, selected-run reducer behavior, tool grammar,
+  and production scheduling semantics.
+
+## TDD and implementation
+
+- Red: B -> C -> A timeout lost authority when only mutable session pointers
+  were consulted.
+- Repair: each `RunSubmission` captures a private owner token and session
+  generation. `RunSession` atomically consumes a started-only capability once;
+  terminal, failure, reset, and load revoke it. Reset/load cancel every live
+  submission stream by immutable handle, including displaced A plus selected C.
+- Deterministic proof: direct capability dispatch proves exactly one A cancel
+  after B -> C, zero B/C actions, no cancel after terminal/failure/reset, and
+  physical A+C stream detachment. #1133 continues to prove ToolWalk timeout
+  policy and passive terminal/failure observation.
+
+## Status and gates
+
+- [x] Write red and repair the authority model.
+- [x] Add deterministic capability/revocation/detachment tests.
+- [x] Re-run strict format (0/7 touched Swift files) and full Swift (245 tests
+  / 46 suites) after the final proof update.
+- [x] Focused `PassiveSubmissionOutcomeIntegrationTests`: 10/10 cases on the
+  final stacked head (the earlier 4/4 and 8/8 counts were intermediate slices).
+- [x] Run `./scripts/test-regression.sh` after the #1135 baseline repair:
+  normal, race, and coverage passed (85.5% total; zero uncovered production
+  functions).
+- [x] Publish the separate stacked draft PR with `Closes #1136`.

docs/plans/INDEX.md

@@ -30,6 +30,16 @@
   deterministic callback retry-wait recovery fixture plan.
 - `2026-08-03-issue-1124-retry-wait-fixture-impact-map.md` — Cross-surface
   impact map for the Issue #1124 test-only repair.
+- `2026-08-03-issue-1136-timeout-authority-plan.md` — Issue #1136 immutable
+  A-handle timeout cancellation authority across B/C selection.
+- `2026-08-03-issue-1136-timeout-authority-impact-map.md` — Cross-surface map
+  for #1136 owner-token/generation capability and stream detachment.
+
+- `2026-08-03-issue-1133-passive-outcome-plan.md` — Issue #1133 passive
+  A-outcome observation after scheduled B displacement.
+- `2026-08-03-issue-1133-passive-outcome-impact-map.md` — Cross-surface map
+  for #1133 submission-local outcome versus selected-run authority.
+
 - `2026-08-03-issue-1130-submission-outcomes-plan.md` — Issue #1130
   submission-local lifecycle and ToolWalk outcome repair.
 - `2026-08-03-issue-1130-submission-outcomes-impact-map.md` — Cross-surface

docs/plans/active-plan.md

@@ -30,6 +30,18 @@ must reuse the reserved run identity exactly once. Callback manager, SQLite,
 API/task visibility, TUI, and native GUI behaviour remain unchanged. Final
 focused/package/full validation, review, hosted checks, and promotion remain.
 Current status: Issue #1130 is implemented locally on #1128 `654b7da`. It
+Current status: Issue #1133 is implemented locally on #1131 `63cf9fcd`. It
+corrects the residual #1130 wait-policy defect: B displacement revokes A
+controls but not A outcome observation. ToolWalk now passively waits for A
+terminal/failure through its deadline, while a displaced timeout can POST only
+the exact locally owned A without mutating selected B. Eight URLSession-gated
+`RunSession.submit()` + `Runner` tests cover B-before-A terminal, EOF, timeout,
+B -> C -> A timeout authority, one-shot/terminal/failure/reset revocation,
+and delayed acknowledgement with zero B/C actions. Strict formatting and full
+Swift pass; full repository regression awaits the independent #1135 baseline
+fixture repair, followed by review, hosted checks, and stacked PR promotion.
+
+Historical status: Issue #1130 was implemented locally on #1128 `654b7da`. It
 separates A's submission lifecycle from displacement, makes late
 acknowledgement/EOF/failure identity-safe, and gives ToolWalk typed
 terminal/failure/displaced/timeout outcomes so only timeout cancels A. Strict