[armstrongsam25]

Related to #48

Adds the shared read-only terminal list/monitor across web, Windows, Android and Apple clients, with bounded literal output, truncation and safe read-only lifecycle handling.

Final review found stale terminal display/replay across Apple disconnects and Windows chat transitions. Candidate 697e68efeabdcbe6384bc4203fb7d3a541b110e4 fixes all three findings, plus timer/refresh retirement and Apple conversation changes. Terminal requests use the closed current-connection transport, reject queuing/replay, clear private display/generations on disconnect/auth loss/timeouts and bind replies to the current conversation. Independent scoped review approves the nine-file repair; existing native transformation provenance is updated.

Repair evidence: Core330 passes; macOS app440 passes/1 skip; the final-tip hosted SurfaceView refresh→real timeout→late-frame→fresh-retry regression passes. Qt owning cohort178 passes. Changed-line diagnostics cover Python3/3 and Swift61/61. Fresh unsigned iOS/watch builds pass for unchanged runtime bytes in the final test-only descendant. All commands finished. The full local portable Qt run exited139 and remains failed/incomplete; narrow current/baseline checks do not replace it. Host Xcode27.1 cannot load the pinned26.6 formatter configuration; protected pinned/native workflows remain mandatory.

Previous f23 protected workflows and real composed web terminal acceptance passed, including small/large hostile output, truncation, narrow layout, owner isolation, stale sessions, disconnect and account switch. These remain source-bound historical receipts; fresh final-head protected qualification and current-pin composed web verification remain required before merge. Native live verification is explicitly waived by the owner; implementation and automated/protected gates are not waived. Draft with auto-merge disabled. No release/store/production deployment.

Final test/report-retention update b364f3452309e92724840715e4cdaae795686dd9 leaves runtime code unchanged. All three protected workflows passed on697, but their raw reports exposed unexecuted Android code-rendering lines and missing exported producer inputs. Four new owning Compose instrumentation scenarios cover literal multiline rendering, content precedence/fallback and actual platform selection/copy with no server action. Existing coverage producers now retain Python/Windows/C#/raw browser observations using the existing converter and pinned artifact action; gate commands, assertions, retries, permissions and timeouts remain unchanged.

Local owning checks: workflow114 passed/4 existing platform skips; protocol/provenance21 passed/1 existing immutable-source replay skip; converter12 passed. Exact final Android test compilation and ktlintCheck pass offline with one worker/512MiB; no emulator run occurred. Previous task-resolution/test-import failures are retained. Fresh instrumented execution, coverage matrix, independent final review and current-pin composed web acceptance remain pending. This update is draft with auto-merge disabled and makes no new coverage-threshold, merge or release claim.

[armstrongsam25]

Reviewed 049d941e929d646641577457b52179603f4c042e. Keep this contribution open as a draft: the shared renderer, sanitizer, correlation controls, fixture, and client coverage are useful, but it is not merge-ready.

1. The current Android run 39381347976 fails literal_output_is_sanitized_and_watch_handoff_is_content_free at TerminalMonitorTest.kt:115. The test reads native_frame, whose code is the normal $ printf ... hello ... done fixture, then compares it with expected_sanitized_text, which describes frames.malicious. Read the malicious frame for that assertion and preserve the separate ordinary-output check.
2. Both AstralCore lanes in 39381347942 fail at TerminalMonitorTests.swift:42. The code component is nested under the Output card's content; maliciousNodes.first { $0.type == "code" } searches only the top level. Walk the malicious tree using the helper already used for the normal frame.
3. After repair, require the full owning Python/web/Windows/Android/Apple checks and live terminal-monitor acceptance against the backend on every affected client, including stale/account/disconnect handling and content-free watch handoff. The PR description explicitly does not supply that live evidence; native compilation and fixture tests cannot substitute for it.

The two native failures are candidate-specific fixture/test defects, not a reason to discard the implementation. No merge or issue-completion claim yet.

[armstrongsam25]

Fixed both failing native terminal-monitor tests in f23eea4b91bc6d41c7fb41640dcb12de80f215ff (original history preserved).

• Android now checks the ordinary output literal separately, then decodes the malicious fixture for the existing exact sanitizer assertions.
• Apple uses the existing recursive walker to find the malicious output inside its card, and also checks the ordinary literal.
• Focused RED→GREEN reproduced both failures. Independent review approved the two-file test-only diff; no assertions, dependencies, contracts or gates were removed.
• Local qualification: Android wrapper gates and713tests; Swift328; portableQt2448passed/20platformskips; pinned browser426passed; clean locked Python3.11 Linux4538passed/6skips/33subtests, Ruff/regression/build/wheel imports passed. Unsigned iOS/macOS/watch builds passed on host Xcode27.1; exact pinned native/provider jobs remain required. Interrupted/setup-only attempts are retained separately and do not count as passes.

This PR stays draft while exact-head protected CI and real web terminal acceptance with Deep#439 complete. Native live journeys are waived by the maintainer; native implementation/contract parity and protected checks remain in scope. The existing Deep branch also needs the missing authenticated monitor binding; that repair is underway using this existing contract.

[armstrongsam25]

Final native lifecycle repair is pushed as 697e68e. All three whole-branch findings, timer/refresh retirement and Apple conversation retirement are addressed; independent scoped review approves. Core330, macOS app440/1skip, hosted actual timer1, Qt owning178 and unsigned iOS/watch checks pass; partial changed-line diagnostics are100%.

The full local portable Qt exit139 and unavailable host pinned formatter remain explicit limits. This draft requires fresh final-head protected native/web workflows and composed web verification before merge. Native live is owner-waived; automated gates are unchanged.

[armstrongsam25]

Pushed the next frozen review update, b364f3452309e92724840715e4cdaae795686dd9, without changing runtime code. It adds real owning Compose code-rendering/copy tests and retains the existing raw coverage producer outputs. All three697 protected workflows passed; fresh b364 workflows must now execute the instrumentation and supply the new reports.

Local checks: workflow114 pass/4 existing skips, protocol/provenance21 pass/1 existing skip, converter12 pass, exact offline Android test compilation and ktlintCheck pass. No device execution or fresh coverage measurement is claimed yet. Current-pin composed web acceptance and final review remain required. Native live verification is owner-waived; automated gates are retained. Draft and auto-merge disabled.