[shabhui]

Summary

Repair long-session transcript work and make Stop actually cancel and settle
Grep/Glob searches before releasing the turn for follow-up work.

• Cache timing once per immutable turn snapshot instead of rescanning the full
  turn for each process chunk; avoid argument-spread limits on large activity.
• Suspend clocks, formatting, delegation projection, smoothing and scroll
  observers/frames in hidden retained panes without unmounting them. Preserve
  output, nested reading positions and manual disclosures; catch up on reveal.
• Deduplicate Stop, await backend settlement before optional history/draft
  recovery, and prevent late recovery from overwriting a newer turn. Avoid
  leaving a duplicate-abort marker with no turn to clear it.
• Propagate cancellation through search traversal, giant-line reads and hashline
  tagging; terminate and reap owned rg processes, including quiet children.
  Keep remote search completion routable until the worker settles or the existing
  transport deadline fails explicitly. Cancellation is never a fallback search.

This preserves upstream Stop/side-effect protections. Read keeps its existing
local-abandon policy; Bash/GenerateImages keep their abort grace; mutations, MCP
and plugin calls retain settlement ownership. No abort timeout was enlarged. No
persisted format, public wire shape or default changes. Runtime/UX specs, the
existing Stop ADR, E2E scenarios and unreleased notes are updated together.

Published history and integration candidate

• Tested/published head: 7a87807e9701e07e3fe78a551504bca2bc20049d.
• Incorporated main: 1ddfd7203fe58cd970fc6f929218253369706de7 (beta.7).
• GitHub PR merge candidate: b97c944bffb28a952d24554481f2847f8ba4e227.
• Head and merge candidate have the same complete Git tree:
  c2c5ddf75b9c87392b2c0b0e107d3c55c319aa89.
  The fetched merge ref has the stated base/head as parents; the tree comparison
  and git diff --exit-code both pass. The task worktree is clean.

Later main updates were merged into this already-public branch without rewriting
published history. Upstream turn headers, usage capsules, project breadcrumb/title
changes, and beta.7 metadata/catalog are preserved. Initial PR CI exposed six
stale source-shape assertions in five task-related files. Their local red was
64/70, followed by 70/70 after assertions were updated to verify current
visibility gates, reveal catch-up and createSessionStop wiring. Production
behavior was not changed to satisfy regexes.

Current-head CI: all six checks successful

• JS build / typecheck / lint / architecture / tests.
• Rust host-core format / lint / tests.
• Rust host-core Windows / transcript-cache E2E.
• Trusted extensions Electron E2E, including successful provider client-certificate,
  browser capture/resize, transcript rendering/disclosure, and extension steps.
• Docs checks.
• Head contains latest base.

Runs: CI,
Docs,
PR base.
These runs identify the current head above, not the initial PR revision.
Previously observed client-certificate CI failures are not current blockers; no
unrelated certificate/transport fix is claimed.

Local current-candidate verification

Check	Result
Desktop repair/source-contract and affected chat/adapter/catalog tests (30 files)	395/395
Agent runtime src/runtime.test.ts	340/340
Rust search cancellation	14/14
Rust remote search settlement	2/2
Rust tools excluding RPC	107/107
Rust state tests	3/3
pnpm build:js; desktop typecheck; lint; architecture guard	PASS
Pi dependency/patch guards; agent-policy sync; PR-base; diff check	PASS
cargo fmt --check; all-target Clippy	PASS; one warning in unchanged transcripts.rs
Isolated Electron hidden-pane fixture	PASS

Counts overlap. Local validation uses frozen pnpm 12.8.1 dependencies, Pi 1.3.0,
Electron 42.0.1 and a scratch GNU Rust/LLVM toolchain on Windows. Rust tests use the
explicit task manifest and dedicated rust-target-pr-head, not the older
baseline target. Electron fixtures use production React/hooks with synthetic
data and isolated profiles, not product main or a real conversation profile.

The hidden-pane fixture reports 7 visible clocks -> 0 hidden clocks, 0 hidden
frames, retained mounted output/answer/delegation, nested reading positions and
manual disclosures, plus reveal catch-up and resumption. These are synthetic
work-count measurements, not live CPU/temperature claims.

Regression tests first exposed repeated full-turn timestamp reads, recurring
hidden clocks, reveal rewinds, early/mid-search abort failures and remote
completion returning NOT_FOUND after Stop. Search tests cover both signal
cancellation and direct runtime.abort() when the tool signal does not fire.
Process fixtures use local socket handshakes, not arbitrary sleeps.

Local failed/incomplete checks and historical evidence

• Full local transcript Electron fixture: the last full local run at
  73384e343 and an untouched official-main archive at d281f4031 both fail
  each disclosure header owns its content hit target. The archive uses main's
  actual React/hook sources and a built stylesheet with identical source. The
  final beta.7 local run covers hidden panes only. In contrast, the current-head
  CI transcript rendering/disclosure step succeeds; these environments/results
  are not conflated.
• Full Windows desktop suite, at 72915f00e plus the assertion corrections:
  4168 passed / 96 failed / 11 skipped. Failures include POSIX executable,
  symlink/permission, path and catalog assumptions. Not every failure was
  independently baselined; this local suite is not reported green. No unrelated
  production or test expectations were weakened.
• Local serial Rust RPC: 98/98 at a51b6d763; a later aggregate wrapper reached
  the RPC batch but timed out without a complete result. The final selected
  search/relay/tools/state suites pass as listed above; a worktree lifecycle
  aggregate also remains incomplete. No product deadline changed.
• Earlier local remote aggregate: candidate 9 passed / 2 failed; untouched
  main 9f313c8f8 7 passed / the same 2 failed. Existing tests
  remote_read_dispatch_is_local_approval_then_relay_never_local_runner and
  denied_remote_write_and_cancelled_read_never_run_locally receive
  permissions.request where tools.remoteExecute is expected. Both new relay
  settlement tests pass. These are historical local results, not current CI
  failures.
• The separate local release-doc gate fails on beta.7 multilingual changelog and
  expected-version-list omissions in unchanged shared files. It is distinct from
  the successful CI Docs checks. A broader local native-session suite previously
  hit two Windows symlink EPERM failures.
• One optional independent review could not start because its service credential
  was inactive. Critical paths were inspected directly; no external approval is
  claimed.

No running Desktop instance, real conversation database/profile, or paid provider
was used. No application install, release, PR merge, force-push, or global network,
Git or toolchain configuration changes were performed.

[vastsa]

Thanks for the detailed investigation and the focused regression evidence. I can't land this as one fix PR because the diff combines independent behavior changes with different root causes and acceptance paths: hidden retained transcript rendering, Stop/turn settlement and draft recovery, and local/remote Grep/Glob cancellation plus process ownership. These can be reviewed, validated, and reverted independently; the shared long-session theme does not make them one smallest coherent fix. Please split the work into focused fix PRs and keep the relevant tests with each part. Also refresh each candidate against current main, which has advanced through #1840 and #1841 since the base recorded here. Thanks for the substantial work.