Add inline steering queue support

.2119/verdicts/REQ-003.4.1--fdc1dc54680b.json

@@ -0,0 +1,8 @@
+{
+  "reviewId": "REQ-003.4.1--fdc1dc54680b",
+  "requirementId": "REQ-003.4.1",
+  "hash": "fdc1dc54680b",
+  "verdict": "pass",
+  "summary": "testRunningChatDoesNotBlockSelectingAnotherChatOrNewChatSurface exercises the real select()/startNewChat() code path (no mocking of the gate) and asserts selectedSessionID actually changes while the first chat's isConversationRunning stays true, which would fail if a blocking guard (like the archive-flow's blockedNavigationAlert) were added to select().",
+  "timestamp": "2026-09-02T22:28:30.820Z"
+}

.2119/verdicts/REQ-003.4.2--bdf1ed3cc242.json

@@ -0,0 +1,8 @@
+{
+  "reviewId": "REQ-003.4.2--bdf1ed3cc242",
+  "requirementId": "REQ-003.4.2",
+  "hash": "bdf1ed3cc242",
+  "verdict": "pass",
+  "summary": "Test starts a running chat in project A, selects a chat in project B, and asserts the selection actually switches (selectedProjectID/selectedSessionID) while project A's conversation remains running — a real behavioral check since select(projectID:) has no running-state guard that could make this pass vacuously.",
+  "timestamp": "2026-09-02T22:28:30.392Z"
+}

.2119/verdicts/REQ-003.4.5--77bc109ed8ea.json

@@ -0,0 +1,8 @@
+{
+  "reviewId": "REQ-003.4.5--77bc109ed8ea",
+  "requirementId": "REQ-003.4.5",
+  "hash": "77bc109ed8ea",
+  "verdict": "pass",
+  "summary": "testRuntimeCallbacksRouteOutputToOwningChatAfterSelectionChanges routes a real event through AppModel/ConversationModel while a different chat is selected, asserts the delta appends only as the final item of the owning chat's cachedTranscript (order preserved via dropLast equality) and is absent from the other chat's transcript — genuine, non-mocked coverage of the append-only-to-owning-chat requirement.",
+  "timestamp": "2026-09-02T22:28:27.839Z"
+}

.2119/verdicts/REQ-003.4.7--ea2a4fa4eaf8.json

@@ -0,0 +1,8 @@
+{
+  "reviewId": "REQ-003.4.7--ea2a4fa4eaf8",
+  "requirementId": "REQ-003.4.7",
+  "hash": "ea2a4fa4eaf8",
+  "verdict": "pass",
+  "summary": "Test verifies selection actually switches to another chat (selectedSessionID/selectedProjectID change) while a queued-prompt chat and a pending-startup chat both remain in working state; covers both boundary terms (queued prompt, pending startup) with real AppModel state, not mocked-away.",
+  "timestamp": "2026-09-02T22:28:31.084Z"
+}

.2119/verdicts/REQ-003.4.8--e7eb0b484688.json

@@ -0,0 +1,8 @@
+{
+  "reviewId": "REQ-003.4.8--e7eb0b484688",
+  "requirementId": "REQ-003.4.8",
+  "hash": "e7eb0b484688",
+  "verdict": "pass",
+  "summary": "Test opens new-chat surface and creates+sends a new chat while another session is actively running (isConversationRunning true throughout), verifying via non-mocked AppModel state that neither startNewChat() nor sendNewChatPrompt() are blocked or altered by in-flight work; assertions would fail if a guard were added to gate these on running state.",
+  "timestamp": "2026-09-02T22:28:51.080Z"
+}

.2119/verdicts/REQ-003.5.2--014fb242ad97.json

@@ -0,0 +1,8 @@
+{
+  "reviewId": "REQ-003.5.2--014fb242ad97",
+  "requirementId": "REQ-003.5.2",
+  "hash": "014fb242ad97",
+  "verdict": "pass",
+  "summary": "Unit tests (mock delay + real fake-RPC subprocess) and UI test verify late text_delta/tool_execution_start events after Stop and after a later prompt starts do not append to transcript, while new-turn output still appends; negative-space (forbidden late output) and positive-space (allowed new output) both covered without over-mocking.",
+  "timestamp": "2026-09-08T22:20:16.554Z"
+}

.2119/verdicts/REQ-003.5.2--0419965f8453.json

@@ -0,0 +1,8 @@
+{
+  "reviewId": "REQ-003.5.2--0419965f8453",
+  "requirementId": "REQ-003.5.2",
+  "hash": "0419965f8453",
+  "verdict": "pass",
+  "summary": "Tests exercise real RPC race conditions (delayed late deltas/tool starts from stopped and superseded turns, incl. real subprocess) and assert absence of late output in transcript/UI; covers both stop-only and stop-then-new-turn boundary cases genuinely.",
+  "timestamp": "2026-09-02T22:23:05.454Z"
+}

.2119/verdicts/REQ-003.5.2--06c255642356.json

@@ -0,0 +1,8 @@
+{
+  "reviewId": "REQ-003.5.2--06c255642356",
+  "requirementId": "REQ-003.5.2",
+  "hash": "06c255642356",
+  "verdict": "pass",
+  "summary": "Genuine coverage: unit tests use real timing races and a real fake-RPC subprocess to confirm late/stopped-turn output never appends while distinct later-turn output does append; UI test confirms no assistant transcript node after Stop before new send.",
+  "timestamp": "2026-09-08T21:25:03.765Z"
+}

.2119/verdicts/REQ-003.5.2--09c4e4ebdbbc.json

@@ -0,0 +1,8 @@
+{
+  "reviewId": "REQ-003.5.2--09c4e4ebdbbc",
+  "requirementId": "REQ-003.5.2",
+  "hash": "09c4e4ebdbbc",
+  "verdict": "pass",
+  "summary": "Genuine coverage: mocked and real-RPC-process tests confirm late/delayed turn output after Stop (and after a subsequent new turn starts) never appends to transcript, both at model and UI level.",
+  "timestamp": "2026-09-08T20:42:56.451Z"
+}

.2119/verdicts/REQ-003.5.2--177331f1f38e.json

@@ -0,0 +1,8 @@
+{
+  "reviewId": "REQ-003.5.2--177331f1f38e",
+  "requirementId": "REQ-003.5.2",
+  "hash": "177331f1f38e",
+  "verdict": "pass",
+  "summary": "Tests genuinely assert stale output from a stopped turn is excluded from transcript items after stop, both immediately and after a later turn starts, using mocked and real (non-mocked) RPC subprocess paths; negative assertions would fail under the violation.",
+  "timestamp": "2026-09-08T22:04:05.193Z"
+}

.2119/verdicts/REQ-003.5.2--54bbe4b5b1ee.json

@@ -0,0 +1,8 @@
+{
+  "reviewId": "REQ-003.5.2--54bbe4b5b1ee",
+  "requirementId": "REQ-003.5.2",
+  "hash": "54bbe4b5b1ee",
+  "verdict": "pass",
+  "summary": "Unit tests use real RPC subprocesses to distinguish stale vs fresh turn output by process identity and assert the stale text never appears in the transcript while fresh output does; UI test waits after Stop to confirm no assistant message renders from delayed late output. Genuine negative-space coverage, not tautological.",
+  "timestamp": "2026-09-08T21:46:08.378Z"
+}

.2119/verdicts/REQ-003.5.4--badf24bf0711.json

@@ -0,0 +1,8 @@
+{
+  "reviewId": "REQ-003.5.4--badf24bf0711",
+  "requirementId": "REQ-003.5.4",
+  "hash": "badf24bf0711",
+  "verdict": "pass",
+  "summary": "testTwoChatsCanRunIndependentlyAndStopOnlySelectedChat exercises real stopActiveTurn()/isConversationRunning on two concurrently-running conversations and asserts the non-active chat stays running while only the active one stops — a genuine counterexample check, not mocked or tautological.",
+  "timestamp": "2026-09-02T22:28:54.157Z"
+}

.2119/verdicts/REQ-003.6.4--1fded447f0b8.json

@@ -0,0 +1,8 @@
+{
+  "reviewId": "REQ-003.6.4--1fded447f0b8",
+  "requirementId": "REQ-003.6.4",
+  "hash": "1fded447f0b8",
+  "verdict": "pass",
+  "summary": "Test switches activeConversationModel across quick/project/second-quick sessions via real select() navigation and asserts each retains its own draft (quick-only, project-only, second-quick-only) with explicit non-equality checks — genuinely fails if draft state leaked between sessions.",
+  "timestamp": "2026-09-02T22:28:20.538Z"
+}

.2119/verdicts/REQ-003.6.5--f6605f670dbe.json

@@ -0,0 +1,8 @@
+{
+  "reviewId": "REQ-003.6.5--f6605f670dbe",
+  "requirementId": "REQ-003.6.5",
+  "hash": "f6605f670dbe",
+  "verdict": "pass",
+  "summary": "Test starts Quick Chat running (agent_start), then selects and sends a real prompt in a project chat, asserting selection succeeds, project work actually starts (pendingPrompt/isRunning/isLoadingSession + transcript item), and Quick Chat remains running—directly verifying both conjuncts (selecting and starting work) aren't blocked.",
+  "timestamp": "2026-09-02T22:28:25.893Z"
+}

.2119/verdicts/REQ-003.6.6--679ab21c5b32.json

@@ -0,0 +1,8 @@
+{
+  "reviewId": "REQ-003.6.6--679ab21c5b32",
+  "requirementId": "REQ-003.6.6",
+  "hash": "679ab21c5b32",
+  "verdict": "pass",
+  "summary": "Tests verify quick chat output appends only to its own transcript with real event handling, rejecting leakage into a sibling quick chat and into a project chat, plus persistence across navigation via a real RPC fixture.",
+  "timestamp": "2026-09-02T22:43:52.626Z"
+}

.2119/verdicts/REQ-003.7.1--df912400610a.json

@@ -0,0 +1,8 @@
+{
+  "reviewId": "REQ-003.7.1--df912400610a",
+  "requirementId": "REQ-003.7.1",
+  "hash": "df912400610a",
+  "verdict": "pass",
+  "summary": "testActiveTurnSubmissionCreatesPendingSteeringInsteadOfUserHistory genuinely drives an active turn via a real agent_start event and real sendDraft(), asserting pendingSteering is created/accepted and excluded from items; empty-content negative case is covered elsewhere (REQ-003.7.8) in the same file.",
+  "timestamp": "2026-09-02T22:22:53.260Z"
+}

.2119/verdicts/REQ-003.7.10--4e9e9e3106db.json

@@ -0,0 +1,8 @@
+{
+  "reviewId": "REQ-003.7.10--4e9e9e3106db",
+  "requirementId": "REQ-003.7.10",
+  "hash": "4e9e9e3106db",
+  "verdict": "pass",
+  "summary": "Tests assert pendingSteering non-empty before and empty only after the matching user-message event arrives, and reject premature clearing by an unrelated user event (original prompt) — genuine, non-tautological coverage of the leave-pending requirement.",
+  "timestamp": "2026-09-02T22:22:35.786Z"
+}

.2119/verdicts/REQ-003.7.11--e9ec1d0d542e.json

@@ -0,0 +1,8 @@
+{
+  "reviewId": "REQ-003.7.11--e9ec1d0d542e",
+  "requirementId": "REQ-003.7.11",
+  "hash": "e9ec1d0d542e",
+  "verdict": "pass",
+  "summary": "Tests fire duplicate/replayed delivery events through the real event-handling path and assert exactly one resulting user-history entry per accepted steering, rejecting both zero- and duplicate-delivery counterexamples.",
+  "timestamp": "2026-09-02T22:22:49.505Z"
+}

.2119/verdicts/REQ-003.7.12--bfda0832f23b.json

@@ -0,0 +1,8 @@
+{
+  "reviewId": "REQ-003.7.12--bfda0832f23b",
+  "requirementId": "REQ-003.7.12",
+  "hash": "bfda0832f23b",
+  "verdict": "pass",
+  "summary": "Test triggers a genuine RPC rejection (client-nil steer failure hits production rejectSteering catch path) and asserts draft is restored into the originating model's composer while a sibling chat's draft is untouched, satisfying the requirement's conjuncts.",
+  "timestamp": "2026-09-02T22:23:00.445Z"
+}

.2119/verdicts/REQ-003.7.13--2c7e79895795.json

@@ -0,0 +1,8 @@
+{
+  "reviewId": "REQ-003.7.13--2c7e79895795",
+  "requirementId": "REQ-003.7.13",
+  "hash": "2c7e79895795",
+  "verdict": "pass",
+  "summary": "testRejectedSteeringRestoresAttachments exercises real rejection path (client.steer throws processNotRunning) and asserts attachments cleared by sendDraft are restored to the originating chat's draftAttachments while an unrelated chat's attachments remain untouched, satisfying scoping and restoration criteria.",
+  "timestamp": "2026-09-02T22:23:09.222Z"
+}

.2119/verdicts/REQ-003.7.14--17175c1f16e5.json

@@ -0,0 +1,8 @@
+{
+  "reviewId": "REQ-003.7.14--17175c1f16e5",
+  "requirementId": "REQ-003.7.14",
+  "hash": "17175c1f16e5",
+  "verdict": "pass",
+  "summary": "Test exercises real steering-rejection error path (no client running) and asserts exact merged draft ordering (rejected + newer), correctly rejecting an overwrite counterexample; isolation from otherModel also checked.",
+  "timestamp": "2026-09-02T22:29:02.649Z"
+}

.2119/verdicts/REQ-003.7.15--5001c836bccc.json

@@ -0,0 +1,8 @@
+{
+  "reviewId": "REQ-003.7.15--5001c836bccc",
+  "requirementId": "REQ-003.7.15",
+  "hash": "5001c836bccc",
+  "verdict": "pass",
+  "summary": "testStopReplaysFirstSteeringAndRetainsRemainingOrder verifies Stop while steering pending sets isRunning=false and triggers exactly one abort RPC call, with genuine non-tautological assertions against mock RPC call counters.",
+  "timestamp": "2026-09-02T22:23:21.778Z"
+}

.2119/verdicts/REQ-003.7.16--14b2201ffe75.json

@@ -0,0 +1,8 @@
+{
+  "reviewId": "REQ-003.7.16--14b2201ffe75",
+  "requirementId": "REQ-003.7.16",
+  "hash": "14b2201ffe75",
+  "verdict": "pass",
+  "summary": "Tests verify ordering (stop-completed before replay-submitted), replay as new prompt RPC producing a .user item with matching text, first-in-first-out ordering across multiple pending steering messages, exclusion of already-delivered steering (negative-space boundary), and a real-process (non-mocked) variant confirming replay occurs as a new turn while running.",
+  "timestamp": "2026-09-08T22:20:32.109Z"
+}

.2119/verdicts/REQ-003.7.16--4120f452f81e.json

@@ -0,0 +1,8 @@
+{
+  "reviewId": "REQ-003.7.16--4120f452f81e",
+  "requirementId": "REQ-003.7.16",
+  "hash": "4120f452f81e",
+  "verdict": "pass",
+  "summary": "Tests verify ordering (stop-completed precedes replay-submitted), positive replay-as-new-user-turn, and the undelivered-vs-already-delivered boundary via real and mock RPC fixtures; genuine, non-tautological coverage.",
+  "timestamp": "2026-09-02T22:28:52.659Z"
+}

.2119/verdicts/REQ-003.7.17--0214d6f3ddb3.json

@@ -0,0 +1,8 @@
+{
+  "reviewId": "REQ-003.7.17--0214d6f3ddb3",
+  "requirementId": "REQ-003.7.17",
+  "hash": "0214d6f3ddb3",
+  "verdict": "pass",
+  "summary": "testStopReplaysFirstSteeringAndRetainsRemainingOrder asserts exact replay order (prompt:first, steer:second) via real RPC callback recording, which would fail if resubmission reordered the originally-submitted messages; genuine coverage of the ordering requirement.",
+  "timestamp": "2026-09-02T22:23:01.035Z"
+}

.2119/verdicts/REQ-003.7.18--3caa48621001.json

@@ -0,0 +1,8 @@
+{
+  "reviewId": "REQ-003.7.18--3caa48621001",
+  "requirementId": "REQ-003.7.18",
+  "hash": "3caa48621001",
+  "verdict": "pass",
+  "summary": "Test asserts pendingSteering remains populated immediately after Stop (pre-delivery) and only clears once replayed exactly once, with a late duplicate event not re-adding the message — genuinely covers the MUST-remain-until-delivered/retried requirement.",
+  "timestamp": "2026-09-02T22:22:40.150Z"
+}

.2119/verdicts/REQ-003.7.19--5a0e7c672c12.json

@@ -0,0 +1,8 @@
+{
+  "reviewId": "REQ-003.7.19--5a0e7c672c12",
+  "requirementId": "REQ-003.7.19",
+  "hash": "5a0e7c672c12",
+  "verdict": "pass",
+  "summary": "Tests in SteeringDeliveryDeduplicationTests.testLateAcknowledgementsCannotCreateAnyDuplicateSubmissionOrDelivery and StopButtonTests.testStopKeepsUnacknowledgedSteeringUntilExactlyOnceReplayDisposition genuinely exercise late post-Stop acknowledgement events and assert single (not duplicated) submission counts and delivered user items, covering the MUST NOT negative space.",
+  "timestamp": "2026-09-02T22:22:43.139Z"
+}

.2119/verdicts/REQ-003.7.2--0b1b5de4319b.json

@@ -0,0 +1,8 @@
+{
+  "reviewId": "REQ-003.7.2--0b1b5de4319b",
+  "requirementId": "REQ-003.7.2",
+  "hash": "0b1b5de4319b",
+  "verdict": "pass",
+  "summary": "testActiveTurnSubmissionCreatesPendingSteeringInsteadOfUserHistory asserts model.isRunning stays true after sendDraft() creates pending steering while agent_start already set it true, genuinely rejecting an implementation that would end the turn.",
+  "timestamp": "2026-09-02T22:23:01.207Z"
+}

.2119/verdicts/REQ-003.7.20--7b064ad2add9.json

@@ -0,0 +1,8 @@
+{
+  "reviewId": "REQ-003.7.20--7b064ad2add9",
+  "requirementId": "REQ-003.7.20",
+  "hash": "7b064ad2add9",
+  "verdict": "pass",
+  "summary": "testSteeringQueuesRemainIsolatedPerConversation sends steering draft on 'first' model and asserts 'second' model's pendingSteering stays empty (and vice versa unaffected), a genuine counterexample check for cross-chat leakage.",
+  "timestamp": "2026-09-02T22:22:54.882Z"
+}

.2119/verdicts/REQ-003.7.21--292318bccfe6.json

@@ -0,0 +1,8 @@
+{
+  "reviewId": "REQ-003.7.21--292318bccfe6",
+  "requirementId": "REQ-003.7.21",
+  "hash": "292318bccfe6",
+  "verdict": "pass",
+  "summary": "Both evidence tests use two independent PiConversationModel instances with identical steering text and assert the untouched instance's items/pendingSteering are unchanged after delivery to the other — genuinely rejects content-keyed cross-chat leakage, not tautological or mocked.",
+  "timestamp": "2026-09-02T22:44:02.253Z"
+}

.2119/verdicts/REQ-003.7.7--715c2d1d7041.json

@@ -0,0 +1,8 @@
+{
+  "reviewId": "REQ-003.7.7--715c2d1d7041",
+  "requirementId": "REQ-003.7.7",
+  "hash": "715c2d1d7041",
+  "verdict": "pass",
+  "summary": "testAttachmentOnlySteeringPreservesDisplayMetadataAndRPCPayload submits with an empty draft plus only an image attachment during an active turn and asserts via XCTUnwrap that a pendingSteering entry is created with the attachment preserved, genuinely falsifying the requirement if no pending steering message were created.",
+  "timestamp": "2026-09-02T22:23:06.136Z"
+}

.2119/verdicts/REQ-003.7.8--30562e26467c.json

@@ -0,0 +1,8 @@
+{
+  "reviewId": "REQ-003.7.8--30562e26467c",
+  "requirementId": "REQ-003.7.8",
+  "hash": "30562e26467c",
+  "verdict": "pass",
+  "summary": "Test exercises real sendDraft()/PromptAttachmentAssembler.prepare path with whitespace-only draft and no attachments, genuinely asserting no pending steering is created; adjacent attachment-only test confirms the 'without attachments' boundary is honored.",
+  "timestamp": "2026-09-02T22:23:26.185Z"
+}

.2119/verdicts/REQ-003.7.9--61211757be53.json

@@ -0,0 +1,8 @@
+{
+  "reviewId": "REQ-003.7.9--61211757be53",
+  "requirementId": "REQ-003.7.9",
+  "hash": "61211757be53",
+  "verdict": "pass",
+  "summary": "testAcceptedSteeringAppearsInConversationHistoryInUserOrder submits two steering messages then delivers their acks out of order with distinct unmatched text, confirming items[] preserves submission order (FIFO) independent of ack arrival order — a genuine, non-tautological behavioral check.",
+  "timestamp": "2026-09-02T22:28:31.304Z"
+}

CHANGELOG.md

@@ -2,14 +2,28 @@
 
 ## 2026-09-08
 
-
 ### Added
 
 - Added private vulnerability-reporting guidance, project-specific contribution instructions, weekly GitHub Actions dependency updates, and public-repository hygiene guidance.
 
+### Changed
+
+- Isolated real-process Stop lifecycle tests from process-wide mock, stall, and failure settings used by concurrently running tests.
+- Made Stop/restart lifecycle validation event-driven, removing polling and fixed-delay assumptions from real Pi process tests.
+
+### Fixed
+
+- Made real-process steering and Stop lifecycle tests shut down their RPC subprocesses deterministically, preventing leaked readers from starving later tests on constrained CI runners.
+- Held prompts until replacement Pi sessions finish loading after Stop, preventing prompts from being sent before session initialization and making restart ordering reliable on slower systems.
+- Made steering recovery after Stop deterministic by clearing queued server input before abort, waiting for the old Pi process to terminate before restart, and safely falling back to termination when `clear_queue` is unavailable.
+
 ## 2026-09-02
 
 
+### Added
+
+- Added inline steering for active conversations, including ordered per-chat pending messages, attachment support, rejection recovery, and retryable replay after Stop without duplicate delivery.
+
 ### Changed
 
 - Scoped official release credentials to a dedicated GitHub environment and replaced the stored temporary-keychain password with a fresh per-run value.