[schlessera]

Closes #1764

What changed

Interactive shares now bind their original Queue item to a server-owned filing session. Authoritative content applications return durable filing receipts; complete_share verifies document hashes, source association and every original's disposition before committing done once. Lost replies replay existing effects and completion. Partial, cancelled or uncertain filing preserves originals, bounded claim recovery and the existing approval boundaries. Autonomous dispatch cannot refile bound work.

The device keeps its confirmed review until correlated host session admission. A repeated authenticated intake exposes its persisted filing session only to its original principal; recovery opens that session without sending another filing prompt. The host rechecks an existing binding when a stale upload response races admission. This reconciles main's newer durable-review flow with the issue's lost-response requirements.

Why this shape

Implements the maintainer's bound-completion ruling using the existing Queue claims, finite attempts, kernel lifetime protection, exact approvals and compensated cleanup. Retention verifies identical ordinary assets linked by the filed document; discard requires exact approval. No dispatcher enablement, binary promotion or additional write authority is introduced. Additive contracts, API reports, skill instructions, decision record and a minor changeset cover the same behavior.

Validation

Qualified head 1a792a698c80001e66345f7b39b769f7527141b2. Run 38837870363, attempt 1, passes all 14 selected jobs and aggregate. All 14 actual checkout logs agree on 586a3e0f8c9462bf60a6e048f875d41f26fca6b6, parents main 4e4a663f98054d86f2dc90154b42ffbe8f8b7692 / that head, tree 0f98f999a1701bb518d3daf423f22d9d355b6c73. API and Git parents/tree agree. No category is retained from an earlier run; every selected job executes fresh.

Unit shards pass 3290 / 2876 / 3484 / 3756 cases with the existing paid-live and sqlite-vec conditional exclusions. Browser shards pass 4580 / 4228 with their existing four / six exclusions; layout shards pass 517 / 579. The corrected track-review test, full share matrix, native runtime, strict verification, packaging and captures pass. Main's #1776 website changes and #2002 layout-fixture repair are included in this actual combined checkout.

• Refreshed app/WS, concrete backend executor, snapshot and citation controls: 180 pass / 2385 assertions / eight files. Final share admission and ui-react: late reconnect history removes a delivered queued reply #1917 history controls: 26 pass / 150 assertions / two files. Installed CLI: 1 pass / 23 assertions, 14 eager bridge tools including complete_share; core tools remain deferred.
• Offline pinned real-browser review file: 17 pass, including all 14 existing review cases plus delayed admission, refused sends and lost-ack reload. Native IndexedDB, locks and original File bytes remain real; the fixture controls transport send/ack through the root's existing frame handler.
• Failing-first browser control: before retaining reviews through admission, delayed admission and refused-send cases both fail because the durable original count is zero rather than one; the other 14 cases pass. Restored browser proof passes all 17.
• Lost-admission mutation: remove the server's existing-binding recovery guard; the real app/WS case fails LOST_ADMISSION_NEVER_DISPATCHES_TWICE (expected false, received true). Restored guard passes. Live-turn recovery, completed/partial binding recovery, cross-principal non-disclosure and explicit session continuation are covered.
• Original ownership, application replay, fresh-claim/no-effect recovery and terminal replay mutation receipts remain recorded on ui-server: interactive share filing leaves its durable inbox item ready for triage #1764 with their original source identities. Existing PDF/security, permission, dispatcher and cleanup assertions are retained.
• Strict TypeScript, API report regeneration and minor-only pending lockstep changeset validation pass. Preflight passes 852 tests / 5464 assertions; complete fresh selected hosted proof passes as recorded above.

One local CLI attempt from a temporary checkout failed before assertions because the native sandbox hid that checkout's executable path. Moving this session's isolated checkout outside the hidden temporary mount restores the unchanged probe. That setup failure is not a semantic failing-first receipt.

The first complete fresh run 38835409311, attempt 1, tested head facf5da2aff9a3c633e62f3de9659a5be56630cf through actual checkout c73fe1cbd25bbe8195cbc4f34b0d3460edc0664a, parents main 665bf5e4e7dca4fcaba5e9cf6b341fbef95c9f4c / that head, tree 234e51abcd441e5873d137a29c41d5733e8b2d1c. All 14 actual job logs are verified. Twelve jobs pass; layout (2) and the aggregate fail solely because the existing track-review fixture expects removal after upload without acknowledging the new bound session. All four unit shards, both browser shards, native runtime, strict verification, packaging, captures and layout (1) pass. No heavy job is cancelled or retried unchanged.

The candidate changes only that fixture: retain all canonical file evidence, assert the review still exists, deliver the existing correlated session_info through the real client handler, then require removal. Both share-review files pass 19 tests in the pinned offline browser. Fresh preflight passes 852 tests / 5464 assertions. The changed source now passes the complete fresh selected run above; the earlier passing jobs retain their original identity. Separately found preexisting draft correlation is tracked in #2003 and does not change the bound-completion contract.

Checklist

• Complete selected current-head hosted proof and actual checkout evidence.
• Bound completion, receipt validation, recovery, replay and cleanup behavior.
• Runtime proof and restored semantic mutations.
• Additive contracts/API reports and six-package minor changeset.
• PR and issue retain milestone 0.44.0; read back again before merge.

Delivery verification

Merged as 603a754b9e229f9b96c1aaf2b18917374b6483b0, parent 4e4a663f98054d86f2dc90154b42ffbe8f8b7692, exact qualified tree 0f98f999a1701bb518d3daf423f22d9d355b6c73. API/Git, fetched-main ancestry, #1764 closure and retained PR/issue milestone 0.44.0 are verified. Automatic main-push run 38840253744, attempt 1, passes all 14 fresh jobs and aggregate; all actual checkout logs agree on the squash. Its receipt remains distinct from PR run 38837870363.

Anything left open

No #1764 acceptance or verification criterion remains. Separately filed #2003 records a preexisting draft-announcement correlation gap and does not defer Queue completion work. Historical failed/cancelled receipts remain attributed in #1764.