[pascalandr]

Main bounded-inventory UI adoption following #1246, #1249 and #1250. The live panel now uses createMissionPanelInventory → fetchMissionPanel; public fetchMissions fan-out is removed.

Contract and UI

• Independently verifiable 50-row directory/field windows: echoed {order,offset,end,total}, window content digest, collection-order continuation fence.
• Inventory summaries carry actor counts. A selected header excludes whole actor/receipt/task collections; those are separately paged. Native-scheduler document, cleanup documentPending and history requestID survive.
• Initial durable finishHighWater is captured before discovery and seeds once: later-discovered old completions stay seen; new completions above the fixed baseline stay unseen, including deletion/purge counter gaps.
• Explicit Show more/Retry for summaries, cleanup, fields, marks and actors; loaded-only search. Selected/reader identities work outside the first inventory page and do not wait for stalled discovery.
• Last-good display, owner/generation/page-revision fencing, failed-middle Retry, no automatic changed-cursor restart. Separate actor observations never become atomic whole-mission absence or recovery authority.
• Exact cleanup retry/lost-ACK identity preserved. Snapshot/admission/internal/mutation authority stays full. No mass snapshot fallback.
• All ten help locales updated.

Every response stays within 64 KiB, request within 16 KiB; logical reconstruction has explicit budgets/deadlines before allocation and publication. Native per-Location lists and producer-sized enumeration/hash costs remain disclosed.

Measurements

• 50/120 summary rows: 11,915 bytes, one transfer, zero warm range/map reads.
• Valid 601-actor selected header: 3,226 bytes.
• Explicit actor continuation: 160 root observations, largest measured body 61,471 bytes.
• All 2,101 pending cleanups reachable; initial finish baseline remains fixed during new completions.
• Notes-only revision: one wanted header, no task transfer or expanded-task reread.

Qualification fixes included

• Directory-only project Location omitted workspaceID:undefined, which strict document CAS rejects; adapter now omits only an absent optional field. Regression verifies directory-only and supplied-workspace placement without weakening validation.
• Missing edit still returns mission-not-found/404.
• Native document-cleanup receipts/replay are checked exactly; safe help-fixture link teardown and a data favicon fix remain test-only.

Validation and recovery disclosure

Implementation recovered after another session's dependency-junction cleanup deleted the original worktree. Tracked changes came from saved Git state; nine new sources were reconstructed from 137 archived successful operations and nine read checkpoints. All sources were checkpointed, then qualified in a new independently installed worktree. Original/evidence/recovery checkpoint remain untouched.

Passing: typechecks, real UI build, 1,322 UI tests, 1,381 server tests plus one optional skip, 615 latest-complete serial browser cases, 31 help checks, plugin rebuild and 21 isolated OpenCode 2.2.3 gates. Twelve negative controls caught/restored. This is not a claim that the initial browser sweep was entirely green: one extension-fixture activation failure passed two fresh full-file reruns unchanged. Test manifests are explicit/nonempty; no borrowed dependencies or implicit Node discovery.

Qualification report/provenance retained by the coordinator. Current-passage compaction (slice 5) remains the next separate work; scheduler #1259 is already merged.

[pascalandr]

Gatekeeper review

Round 1 (508f5ba0e): request changes — P2 3, P3 1.

• Completion seeding lost existing folder-scoped unseen state and positive exceptions after changing the live scope key.
• Passive first-window refresh could erase a failed middle-window Retry after an unrelated order change.
• Lifecycle receipt/pending lanes used the wrong owning descriptor and could stay stale.
• Fixed unavailability causes lost their localized guidance.
• Navigation qualification also remained non-green on retired schedule point-read network assertions.

Round 2 (b1a325998): request changes — P2 1, P3 1.
The original direct findings were resolved. Expanded probes found a late first-read/Retry response could erase newer field invalidations, and conversion of an ambiguous legacy positive hash could consume another mission's evidence. Navigation cancellation provenance and its same-URL negative controls passed.

Round 3 (f129b1a5f): approve — P0 0 · P1 0 · P2 0 · P3 0 · P4 0.

• Field publication and every failure-retirement path now check admitted source/failure identity, including pending first reads and post-hash races. Eight original overlap cases and eleven additional queue/ABA/late-failure/unchanged-descriptor cases pass.
• Existing bounded legacy positives survive partial discovery and collisions; exact reload/exhaustion checks preserve the unopened boundary without increasing their budget.
• No automatic rereads, control replay or CAS promotion were introduced.

Qualification across the reviews includes typechecks, actual UI production build, full UI/server suites, help in ten locales, fresh plugin rebuild and 21 isolated OpenCode 2.2.3 native gates. Broad independent browser coverage reached 620/620 latest per-file results; first fixture failures and bounded reruns are retained in the reports. Final two-UI-fix qualification was scoped: 485 units, 132 serial browser cases, typecheck/build and independent adversarial probes, all passing. Prior server/native results were not relabeled as rerun.

The live panel now uses bounded inventory discovery and wanted headers rather than the old global map fan-out. Full internal/admission/mutation authority and exact reconciliation remain intact. Producer-wide enumeration, serialization and repeated observation remain disclosed source costs; current-passage compaction is still the separate next slice.

Implementation recovery provenance, test manifests and cleanup audits are preserved. Review checkouts use their own dependencies; no shared daemon, user OpenCode data or borrowed dependency trees were used. No review-owned jobs remain.