Native harness audit: accepted reliability and instruction fixes

[itsdestin]

Review only — do not merge yet

Destin requested commits, a branch push and a PR for a separate final review. This draft must not be merged or released automatically. Updated 2026-09-28 with the review follow-ups below.

Summary

Implements the accepted native harness audit scope:

• Recover from permission callback failures without dangling tool calls or broken subsequent turns.
• Drain queued input reliably and deliver ordinary busy messages inside the running turn (after the current batch of actions — see follow-ups; a Send now control was added at Destin's request).
• Retract abandoned automatic retry output consistently across display, effective saved replay and accepted history.
• Capture the full ancestor instruction-file chain; show accurate multi-file startup facts; inherit owner-relative project rules and correct matching/deduplication.
• Defer the first governed Write/Edit until a fresh model request sees new guidance (guidance that cannot fit is shown shortened once — see follow-ups).
• Align specialist Bash companion tools with their permission caps; settle failed background handoffs accurately.
• Use generation-owned MCP connections, covering config/credential changes and overlapping teardown.
• Bound DNS waits by caller cancellation and the existing total deadline; verify Read bytes before repeat notices.
• Keep duplicate-worded native questions independent while preserving legacy Claude Code behavior.

Includes desired-behavior regressions and dev-only fixtures. Remaining defect-observation probes are not included in the app test commit; their historical copies are in the companion workspace record.

Approved exclusions

• C2 / R17 is explicitly deferred and not fixed: stronger process-group shutdown needs a broader ownership/supervisor design. Existing cleanup is best-effort; this PR makes no stronger descendant-termination claim.
• Q10 / F07 denied: no stale credential-bearing Claude Code MCP projection cleanup.
• Q22 native-only: Claude Code duplicate-question wording remains limited by its legacy answer format. No new disabled-Submit warning ships.
• Other unapproved audit findings are outside scope.

Verification and acceptance

• Fresh bash scripts/verify.sh --full <app-worktree> before commit: all desktop gates passed — full tests, source/test types, knip, lint, design lint, invariants, screens and journeys.
• Independent contract grading: 17 pass, R17 deferred/not passed. Destin submitted acceptance on 2026-09-28.
• Per-task red/green tests and independent reviews are retained in the companion workspace PR.
• Common credential/private-key pattern scan over staged text found no matches; this is not an exhaustive security certification.
• Not verified: Android, marketplace Worker, native Windows/macOS execution, real-provider/paid-model behavior. Test typecheck retains the project's existing exclusions.

Integration status (updated 2026-09-28)

Current master has been merged in (merge commit 9b8d4bdaf); conflicts in native-session-host.ts, tools/bash.ts and shell-registry.test.ts were resolved (Bash keeps master's admin-password onCallExit bookkeeping plus this branch's failed-hand-off handling). GitHub reports the PR mergeable. bash scripts/verify.sh --full passes on the final commit (types, full tests, knip, lint, design lint, ast-grep, screens, journeys). Android not built here.

Follow-up changes from Destin's PR review (2026-09-28)

Decisions recorded in the workspace PR (native-harness.pr-review.questions.answers.json, native-harness.send-now*.review.answers.json).

• Mid-task messages are read after the assistant's current batch of actions finishes, instead of cancelling unstarted calls; a message that joins the turn resets the "keep going?" step count (Q-1, Q-2).
• Instruction files: the session folder's own file gets first claim on the budget; broader ancestors get the rest and are still named if squeezed out (Q-4). The context panel shows plain-words notes, folder labels, a named "Shortened" summary, and "CLAUDE.md here not used" when AGENTS.md wins in the same folder.
• Small-model rule fit: rules that cannot fit are shown shortened once and the model re-plans; the silent refusal is removed (Q-5; reverses the earlier accepted "refuse when guidance cannot fit").
• Rule path patterns: {a,b} alternatives and [abc] classes now match; a leading / or ./ anchors at the rule owner; unreadable patterns are logged.
• MCP: an excluded server's real error is logged again with every credential value it was given redacted.
• Read: an unchanged repeat is verified by a piecewise fingerprint before loading the file (longest main-process stall at 50 MB: ~140 ms → ~1 ms); changed files are read as before.
• Send now on a waiting message (new native:queue-send-now on every surface; Android replies not-implemented like queue-remove): stops the current task like Stop and sends that message next. UI: accent send-style button with an up arrow that reveals "Interrupt and Send Now" on hover, trash icon (matches doc-comments), plain pencil via a new shared EditPencilButton (QuickChips reuses it, unchanged look).
• Tests: fixed two load-sensitive tests (LocalModelsSection late read, markdown streaming sweeps given a measured budget); removed item-list-authority.test.ts, whose only exemption no longer exists. Line budgets raised for the Send now plumbing; design-lint ratchet lowered 542 → 537.

Companion workspace PR: itsdestin/youcoded-dev#221.

Review entry point: audit, decisions and evidence.