fix(desktop): open top-level deep links in context - #6708

Verdict: REQUEST CHANGES

Reviewed: 30d2fc52f96138311f2006627ffc1a6d5ff1865b..bac1ca1225699c7f69e016d92fc9495903f8b749 (exact head bac1ca1225699c7f69e016d92fc9495903f8b749)

Risk: high — this changes top-level/reply routing and virtualized timeline scroll ownership across deep links, Inbox, search, notifications, and DMs.

Behavior/contracts traced: deep-link payload and target hydration; top-level vs explicit-thread routing; route-target clearing; virtualized centering/highlight lifecycle; shared E2E fixtures; narrow/focus/accessibility source paths. The intended source contract is coherent: bare top-level targets stay in the main timeline, while replies and explicit full-thread routes retain thread context. However, the required exact-head Desktop gate is red with PR-caused deterministic failures.

Blocking findings

1. The changed navigation test contains a false unrelated assertion. desktop/tests/e2e/navigation.spec.ts:792-794 now expects the existing channel-chip fragment to be r, while the runtime renders rando; smoke shard 3 failed this on all three attempts. This prevents the PR's own route journey from proving its intended behavior.

   • Author action: restore the established rando assertion, or intentionally change production truncation behavior and prove that separate contract.
   • Verification owner: author gets smoke shard 3 green; reviewer verifies the delta and exact-head retry evidence.

2. Dirty-edit retry coverage still asserts the old top-level thread-panel contract. desktop/tests/e2e/messaging.spec.ts:3671-3674 and 3831-3834 require a destination thread panel after navigating to top-level targets. At this head, both journeys leave the prior thread and then fail all retries because the new product contract correctly routes bare top-level targets to the main timeline. The tests therefore neither agree with the PR contract nor prove destination visibility/highlight; explicit-thread behavior also needs to remain covered separately.

   • Author action: reconcile these journeys with top-level vs explicit-thread semantics. For bare top-level destinations, assert destination channel plus target visibility/highlight and no manufactured thread panel; retain an explicit-thread case that proves the panel/root contract.
   • Verification owner: author gets smoke shard 3 green; reviewer verifies both route classes at the new exact head.

3. The global DM fixture expansion breaks an existing required journey. The PR adds 80 shared alice-tyler rows in desktop/src/testing/e2eBridge.ts (around the changed fixture block at line 4509), and desktop/tests/e2e/channels.spec.ts:2458-2460 then loses its expected day-divider/unread state on every smoke shard 1 attempt. This is PR-caused fixture fallout, not unavailable reviewer tooling.

   • Author action: isolate the deep-history DM data to the new scenario, or deliberately update and validate every affected shared-fixture contract.
   • Verification owner: author gets smoke shard 1 green; reviewer verifies fixture isolation and the existing unread/day-divider journey.

Validation

• GitHub Actions run 32786210061 at exact head:
  • PASS: Desktop Core; macOS build; Desktop E2E Relay; both integration shards; smoke shards 2/4; release candidate; DCO.
  • FAIL: smoke shard 1, smoke shard 3, and therefore aggregate Desktop.
  • One-off channel-browser and overscroll failures were not classified as PR defects.
• Independent exact-head lanes: Desktop unit suite passed 5,449/5,449; typecheck and check/lint passed. Source review found no additional author-actionable product/UI/accessibility defect.
• My local just desktop-ci attempt completed check and all 5,449 unit tests, then hit a reviewer-checkout/tooling failure during pnpm build (typescript@6.0.3 lib files disappeared when the disposable checkout was removed underneath the run). I do not attribute that failure to this PR; exact-head CI's Desktop Core and macOS build passed.

Manual/native evidence: no trustworthy native cold/warm deep-link, keyboard focus, narrow-layout, reduced-motion, or screen-reader run was completed. A local scoped Playwright attempt was invalidated by its web server repeatedly exiting with ERR_CONNECTION_REFUSED.

Residual risk: native Tauri cold/warm URL delivery and accessibility interaction remain a reviewer/runtime confidence gap, not an additional author blocker. Recheck those after the blocking smoke regressions are fixed. Any new head expires this verdict.

Verdict: REQUEST CHANGES

Reviewed: 30d2fc52f96138311f2006627ffc1a6d5ff1865b..1bbdb515e48f7632606891fbe4dbdc372bd2f396 (exact head 1bbdb515e48f7632606891fbe4dbdc372bd2f396)

Risk: high — this changes top-level/reply routing and virtualized timeline scroll ownership across deep links, Inbox, search, notifications, and DMs.

Behavior/contracts traced: old→new re-review delta; deep-link parser/payload; top-level versus explicit-thread routing; route hydration and target clearing; virtualized target visibility/highlight; dirty-edit retries; shared E2E fixture ownership; narrow/focus/accessibility source paths.

Blocking finding

The shared long-history DM fixture remains global and deterministically breaks an existing required journey. The new commit changes only the navigation and messaging specs; it leaves the unconditional 80-row alice-tyler seed at desktop/src/testing/e2eBridge.ts:4509-4518. That history exists to support the new long-history deep-link scenario, but it changes every test using the shared DM. Exact-head smoke shard 1 consequently fails desktop/tests/e2e/channels.spec.ts:2434 at :2460 on the initial run and both retries because the expected message-timeline-day-divider is absent. The failure artifact instead shows the added numbered history and unread region. This is PR-caused fixture-contract fallout, not a reviewer confidence gap.

• Author action: isolate the 80-message history behind a per-test configuration or dedicated fixture/channel (preferred), or deliberately repair every affected shared-fixture contract while preserving the DM intro/day-divider/unread journey. Get smoke shard 1 and aggregate Desktop green at the next exact head.
• Verification owner: author owns the new exact-head CI run; :bot: Jude’s code review agent owns delta review and confirmation that both the existing unread/day-divider journey and long-history deep-link journey pass.

Prior findings resolved

• The false inline-chip expectation is restored from r to runtime rando at desktop/tests/e2e/navigation.spec.ts:792-794; exact-head smoke shard 3 passes.
• Dirty-edit retry coverage now uses main-timeline semantics for top-level targets at desktop/tests/e2e/messaging.spec.ts:3668-3672 and 3827-3832, while separate explicit sent-from-thread coverage remains at 3746-3752; smoke shard 3 passes.
• No additional source-level product, UI, accessibility, parser, routing, hydration, or ownership defect was established by the integrated systems and adversarial review.

Validation

• Exact-head GitHub Actions run 32788621767: smoke shard 1 fails deterministically (job 97625731380, 312 passed / 1 failed / 2 skipped); smoke shards 2 and 3, macOS build, release candidate, relay, and both integration shards passed at review time. Core/shard 4 were still running and are not needed to establish the blocker.
• Independent exact-head validation: pnpm check passed (existing warnings/infos only), pnpm typecheck passed, and the full Desktop unit suite passed 5,449/5,449.
• Artifact inspection confirmed numbered alice-tyler rows and unread state but no required day divider in all repeated failure evidence.

Manual/native evidence: no native Tauri cold/warm URL-delivery run or real keyboard/screen-reader/narrow-window interaction was completed.

Residual risk: native URL delivery, actual focus/highlight, reduced-motion behavior, and narrow-window interaction remain reviewer/runtime confidence gaps, not additional author blockers. Author action: none unless that verification exposes a defect. Verification owner: authorized native-runtime reviewer or macOS gate.

Any new head expires this verdict.

Verdict: REQUEST CHANGES

Reviewed: 30d2fc52f96138311f2006627ffc1a6d5ff1865b..1bbdb515e48f7632606891fbe4dbdc372bd2f396 (exact head 1bbdb515e48f7632606891fbe4dbdc372bd2f396)

Risk: high — this changes top-level/reply routing and virtualized timeline scroll ownership across deep links, Inbox, search, notifications, and DMs.

Behavior/contracts traced: native deep-link payload validation through renderer navigation; target/channel/thread ownership; top-level versus explicit-thread routing; cold virtualized centering/highlight lifecycle; stale or missing targets; dirty-edit refusal/retry; shared E2E fixture isolation; narrow-layout and accessibility source paths.

Blocking finding

The prior shared-fixture blocker remains unresolved. desktop/src/testing/e2eBridge.ts:4509-4518 unconditionally seeds 80 alice-tyler rows to support the DM deep-link journey, altering every test that uses that shared DM. At this exact head, Desktop Smoke E2E shard 1 again fails desktop/tests/e2e/channels.spec.ts:2434-2460 on the initial attempt and both retries: after opening the unread DM, the required message-timeline-day-divider is absent. The job finishes 312 passed / 1 failed / 2 skipped. Its semantic and screenshot artifacts show the 80-row seed and unread region dominating the rendered DM without the expected divider. This is deterministic PR-caused fixture fallout and a required gate failure.

• Author action: isolate the 80-message history to the deep-link scenario, preferably with a dedicated channel or opt-in test configuration; alternatively, deliberately repair every affected shared-fixture contract. At the next exact head, make smoke shard 1 and aggregate Desktop green while preserving both the existing DM intro/day-divider/unread journey and the long-history DM deep-link journey.
• Verification owner: author supplies the new exact-head CI run; reviewer verifies the fixture delta and both journeys.

Prior-blocker disposition

1. The false channel-chip r expectation is resolved to runtime rando at desktop/tests/e2e/navigation.spec.ts:792-794; smoke shard 3 passes.
2. Dirty-edit retries now match top-level main-timeline semantics at desktop/tests/e2e/messaging.spec.ts:3668-3672,3827-3832; explicit sent-from-thread behavior remains covered separately at :3746-3752; smoke shard 3 passes.
3. Shared DM fixture isolation is not resolved, as above.

No additional source-level product, integration, UI, or accessibility defect was established. The selected message remains authoritative, invalid thread relationships are discarded before ancestor fetch/panel opening, replies retain their thread route, and route-target lifecycle tests cover stale/missing context.

Validation

• Independent local exact-head Desktop unit suite: PASS, 5,449/5,449 (pnpm test), with clean tree and HEAD=1bbdb515e48f7632606891fbe4dbdc372bd2f396 immediately before execution.
• Independent lanes also passed Desktop typecheck and check/lint (existing warnings only).
• Exact-head CI: smoke shard 1 FAIL as above; smoke shards 2 and 3, macOS build, release candidate, relay E2E, and both integration shards PASS at final review poll. Core and shard 4 were still running; neither can cure the deterministic blocking failure.

Manual/native evidence: no trustworthy native Tauri cold/warm URL-delivery, keyboard/screen-reader focus, reduced-motion, or narrow-window interaction run was completed.

Confidence gap: native delivery and actual focus/highlight remain unobserved. Author action: none unless runtime evidence exposes a defect. Verification owner: authorized native-runtime reviewer/macOS gate.

Any new head expires this review.

:bot: Jude’s code review agent

Verdict: REQUEST CHANGES
Reviewed: 30d2fc52f96138311f2006627ffc1a6d5ff1865b..cbbc6f8db407df86c97e0093df58bd738c212e6b (exact head cbbc6f8db407df86c97e0093df58bd738c212e6b)
Risk: medium — user-visible deep-link routing, virtualized history, and shared E2E fixture behavior.

Behavior/contracts traced: parser → renderer payload; channel ownership for cached/fetched events; top-level versus explicit-thread intent; ancestor hydration; final panel actuation; missing/stale targets; shared bridge initialization; ordinary DM intro/day-divider/layout coverage.

1. Mismatched explicit reply roots still open the actual thread

desktop/src/app/routes/ChannelRouteScreen.tsx:99-106 rejects ancestor hydration when a reply’s supplied threadRootId differs from its derived root, but retains the already-fetched reply. That reply is merged through ChannelRouteScreen.tsx:231-239 and ordinary channel history. With the actual root already loaded, desktop/src/features/channels/ui/useChannelRouteTarget.ts:168-181 calls getRouteTargetPanelAction; its reply branch at :87-102 ignores targetThreadRootId, derives the actual root, and opens that panel.

An exact-head pure-function probe with reply + actual root preloaded returned the same open-thread(actual-root, scrollTarget=reply) action for no explicit root, the matching root, and wrong-explicit-root. The new test in ChannelRouteScreen.test.mjs:29-40 proves only fetch-layer validation; there is no loaded-reply panel-action mismatch regression.

Consequence: a stale or malformed URL can actuate a thread the explicit route did not validly request, presenting misleading navigation state despite the new intent validator.

Author action: enforce explicit reply-root agreement at the final panel-action boundary (or pass normalized validated intent instead of the raw route root). Add a causal regression with reply + actual root preloaded and a wrong explicit root, asserting no thread opens; mutation-prove removing the guard fails it. Preserve implicit-root and matching-explicit-root cases.

Verification owner: author for the corrected exact-head tests/full Desktop CI; :bot: Jude’s code review agent for the caller path and mutation verification.

2. The long-history fixture opt-in relies on undefined init-script ordering

desktop/tests/e2e/navigation.spec.ts:11-20 installs the default mock bridge in one beforeEach, then installs the 80-row option through a second beforeEach for one title. Each call registers a page.addInitScript, and desktop/tests/helpers/bridge.ts:916-927 assigns __BUZZ_E2E__.mock = mock. Playwright does not define evaluation order among multiple init scripts; if the default script runs last, it overwrites the opt-in and removes the target history.

Author action: install the bridge exactly once per test, selecting options in one conditional hook or dedicated fixture/describe. Add a positive setup assertion that the opted-in history/target exists before evaluating navigation.

Verification owner: author for repeated exact-head smoke evidence; :bot: Jude’s code review agent for deterministic single-install configuration and positive-control review.

Resolved prior blocker and additional review

The prior shared-fixture/layout blocker is substantively repaired: aliceTylerHistoryMessageCount defaults to zero and all ordinary DM day-divider/inset/spacing assertions are restored. The new channel-ownership filter rejects wrong-channel cached/fetched events across the searched cache, fetch, root, and ancestor paths. No additional source-level product/UI/accessibility or systems defect was established.

Validation at matching exact head: independent clean-tree pnpm test passed 5,450/5,450; pnpm typecheck passed; pnpm check exited 0 with only pre-existing warnings/infos; pnpm build:e2e passed. DCO and Desktop Release Candidate were green at final poll; full exact-head Desktop CI had not yet published checks. Ten scoped Playwright attempts stopped at browser launch because the pinned Chromium executable was absent, a reviewer-tooling confidence gap rather than an author defect.

Manual/native evidence: none independently produced at this head.

Residual risk: full exact-head CI/smoke remained outstanding; native Tauri cold/warm delivery, keyboard/screen-reader focus, narrow-window interaction, and reduced-motion highlight were not witnessed. Author action: none for these confidence gaps unless their named gates expose another defect. Verification owner: CI and authorized native/macOS reviewer respectively.

Verdict: REQUEST CHANGES

Reviewed: 30d2fc52f96138311f2006627ffc1a6d5ff1865b..cbbc6f8db407df86c97e0093df58bd738c212e6b (exact live head cbbc6f8db407df86c97e0093df58bd738c212e6b; remote/local equal and tree clean immediately before submission)

Risk: high — this changes deep-link ownership, explicit thread intent, and virtualized route hydration across channels and DMs.

Blocking findings

1. A mismatched explicit root for a reply is rejected during hydration but still opens the reply's actual thread when that root is already loaded. desktop/src/app/routes/ChannelRouteScreen.tsx:99-106 detects the mismatch and stops ancestor hydration, but retains the fetched target reply and merges it at :231-239. The final consumer, desktop/src/features/channels/ui/useChannelRouteTarget.ts:168-181, calls getRouteTargetPanelAction; its reply branch at :87-102 ignores targetThreadRootId, derives the actual root, and opens that panel whenever ordinary channel history already contains it. An exact-head pure-function probe with the root and reply preloaded returned the same open-thread(actual-root, scrollTarget=reply) action for null, the correct root, and a wrong explicit root. The new validator unit test proves only the fetch-layer predicate, not the user-visible no-panel contract.

   • User impact: a stale or malformed URL can actuate a thread that its explicit context did not validly request. Channel ownership remains scoped, so this is not classified as a cross-channel disclosure, but it violates the selected-message/optional-root validation contract and presents misleading navigation state.
   • Author action: enforce explicit reply-root agreement at the final panel-action boundary, or pass normalized validated intent instead of the raw route value. Add an integration-shaped regression with reply + actual root already loaded and a wrong explicit root; assert no thread opens or wrong target highlights and no unrelated root/ancestor is fetched. Retain valid implicit-root and matching-explicit-root cases; mutation-check the guard.
   • Verification owner: author supplies corrected exact-head unit/full Desktop CI; reviewer verifies the caller path and causal regression.

2. The isolated DM history fixture is installed through two competing init scripts whose evaluation order is undefined. desktop/tests/e2e/navigation.spec.ts:11-20 calls installMockBridge in two separate beforeEach hooks for the long-history case. Each registration installs a page.addInitScript, and the bridge assigns __BUZZ_E2E__.mock = mock at desktop/tests/helpers/bridge.ts:916-927. If the default script executes last, it overwrites aliceTylerHistoryMessageCount with undefined, so the target history does not exist and the regression evidence becomes nondeterministic by contract.

   • Author action: install the bridge once per test, selecting the mock options in one conditional setup (or a dedicated describe/fixture), and add a positive setup assertion that the opted-in target/history exists before testing navigation.
   • Verification owner: author repeats the affected exact-head smoke journey; reviewer verifies one deterministic bridge configuration and its positive control.

Prior-blocker disposition

• The global alice-tyler fixture collision is substantively repaired: the 80-row history now defaults off and is intended to be enabled only for the DM deep-link scenario (desktop/src/testing/e2eBridge.ts:4509-4530).
• The pre-existing ordinary-DM day-divider, left-inset, and intro-spacing assertions are restored at desktop/tests/e2e/channels.spec.ts:2453-2466.
• Wrong-channel cached/fetched events are now rejected across the searched cache seed, cache merge, initial fetch, root fetch, and ancestor walk paths. No additional source defect was established there.

Exact-head validation

• Local full Desktop unit suite: PASS, 5,450/5,450 (pnpm test).
• pnpm typecheck: PASS.
• pnpm check: PASS exit 0; only two pre-existing warnings and two infos remain.
• DCO and Desktop Release Candidate: PASS. Full exact-head Desktop CI/smoke had not published at submission time; that is outstanding evidence, not a separate author defect.

Confidence gaps: native Tauri cold/warm URL delivery, actual keyboard/screen-reader focus, narrow-window interaction, and reduced-motion highlight remain unobserved. Author action: none unless those checks expose a defect. Verification owner: authorized native-runtime reviewer/macOS gate.

Any new head expires this review.

:bot: Jude’s code review agent — REQUEST CHANGES at exact head 0fa6b6b5650b2fc5892f44a54d56be332e18cce6.

The prior explicit reply-root actuation defect is resolved. The final guard in desktop/src/hooks/useChannelRouteTarget.ts:87-90 rejects a non-null explicit root that differs from the reply's derived root before panel actuation. The focused exact-head suite passes 9/9; removing only that guard makes the mismatched-loaded-root regression fail with open-thread instead of none, and restoring it returns the tree clean.

One author-actionable defect remains:

• desktop/tests/e2e/navigation.spec.ts:11-21 installs the mock bridge in two independent beforeEach hooks: once with defaults and once with { aliceTylerHistoryMessageCount: 80 }. Each installMockBridge registration adds an init script that assigns __BUZZ_E2E__.mock (desktop/tests/helpers/bridge.ts:916-927). Evaluation order between separately registered init scripts is not guaranteed, so the default registration can overwrite the configured long-history mock. The intended 80-row DM target can therefore disappear nondeterministically, while the journey has no positive fixture assertion to distinguish that failure from a routing regression.

Author action: choose the mock options first and call installMockBridge exactly once per test, or isolate this journey under one configured fixture/describe. Add a positive control proving the 80-row history/target exists before asserting navigation, then rerun the affected smoke journey at the corrected head.

Verification owner: the author supplies corrected exact-head E2E/full Desktop CI evidence; :bot: Jude’s code review agent verifies one deterministic bridge registration and the positive control.

Exact-head evidence integrated across the assigned review lanes:

• Focused route-action suite: PASS 9/9; causal guard mutation: FAIL 1/9 as intended.
• pnpm typecheck: PASS.
• pnpm check: PASS, with only the existing two warnings and two infos.
• DCO and Desktop Release Candidate: green at final pre-review poll.
• Wrong-channel fetched/cached ownership filters and ordinary DM fixture/layout assertions remain sound in the reviewed paths.

Confidence gaps, not additional defects: full exact-head Desktop CI/smoke had not completed; native Tauri cold/warm URL handling, actual keyboard/screen-reader focus, narrow-window interaction, and reduced-motion behavior were not directly observed. Author action: none beyond the bridge defect unless a gate exposes another failure. Verification owner: exact-head CI and an authorized native/macOS reviewer.

Any head movement expires this verdict.

:bot: Jude’s code review agent

Verdict: REQUEST CHANGES
Reviewed: 30d2fc52f96138311f2006627ffc1a6d5ff1865b..f82cd9d0cf57878b716fcd32491801b62041477e (exact head f82cd9d0cf57878b716fcd32491801b62041477e)
Risk: medium — user-visible deep-link/search routing through virtualized timelines and dirty-edit retry state.

Behavior/contracts traced: top-level versus explicit-thread intent; route-target lifecycle and settlement; dirty-edit refusal/cancel/retry; target centering/highlight; single mock-bridge initialization; fixture positive controls; ordinary DM layout/unread invariants; narrow viewport.

Blocking: post-cancel top-level search retry intermittently omits the target highlight

Exact-head Desktop Smoke E2E shard 3 fails the affected journey at desktop/tests/e2e/messaging.spec.ts:3755-3832: after a dirty thread edit refuses search navigation, the user cancels and retries. The destination root becomes visible in the main timeline and the thread panel closes, but the row never receives route-target-highlight-fade during the 5-second assertion window. The initial run and retry 1 show the same route failure; retry 2 fails earlier on separate editor duplication. Job: https://github.com/block/buzz/actions/runs/32793261320/job/97639317489

Independent repeated exact-head execution reproduced the route failure 3/10 times; seven runs passed. The assertion was added by this PR and represents its stated centered/highlighted top-level target contract. In a busy timeline, merely exposing a row without identifying the selected message is materially ambiguous.

Author action: fix the route-target settlement/retry race so the successful post-cancel top-level search retry deterministically applies the highlight after the destination row settles while preserving dirty-edit bytes. Add or strengthen a deterministic regression for the failing interleaving, mutation-prove it, and get smoke shard 3 plus aggregate Desktop green.

Verification owner: author for the corrected exact-head regression and CI; :bot: Jude’s code review agent for causal mutation, repeated affected-test execution, and target-state inspection.

Prior blocker disposition and additional review

The duplicate-bridge blocker is resolved. desktop/tests/e2e/navigation.spec.ts:14-21 now selects options before exactly one installMockBridge call, and :942-953 independently proves the opted-in event before testing navigation. The long-history DM journey passed locally, in exact-head CI, and 10/10 repeated product runs; removing the 80-row option fails at the positive control as intended.

No additional systems, product/UI, or accessibility defect was established. A 500×700 probe kept target #40 centered within 2 px, highlighted, without a thread panel or horizontal overflow. Ordinary DM layout remained intact.

Validation at matching head: pnpm check and pnpm typecheck passed; full Desktop unit package passed 5,452/5,452; pnpm build:e2e passed. CI smoke 1/2, macOS build, relay E2E, both integration shards, release candidate, and DCO passed at final poll; smoke 3 failed as above, with Core/smoke 4 still pending.

Manual/native evidence: browser narrow-layout and visual target evidence only; no independent native artifact.

Residual risk: native Tauri cold/warm URL delivery, macOS AX/screen-reader behavior, keyboard-only discovery, and reduced-motion runtime remain unobserved. Author action: none for these confidence gaps unless a named gate exposes a defect. Verification owner: authorized native/macOS reviewer.

:bot: Jude’s code review agent — REQUEST CHANGES at exact head f82cd9d0cf57878b716fcd32491801b62041477e.

The previous duplicate-bridge blocker is resolved: desktop/tests/e2e/navigation.spec.ts:14-21 now selects options before one installMockBridge call, and the long-history DM journey has an independent get_event positive control at :942-953. It passed locally and in exact-head CI; removing the 80-row option fails causally at that control.

One PR-caused required-gate defect remains:

• The dirty-edit search retry can expose the top-level destination without applying its route highlight. Exact-head Desktop Smoke E2E (3), job 97639317489, failed the changed assertion at desktop/tests/e2e/messaging.spec.ts:3832: after search navigation is refused, the edit is cancelled, and navigation is retried, the destination root is visible in the main timeline and the thread panel is closed, but the row never receives route-target-highlight-fade during the assertion window. The initial run and retry 1 reach this same failure; an independent exact-head local repeat reproduced it 3/10 times. This assertion was added by the PR and directly exercises the stated top-level centering/highlight contract. A visible row without transient identification is not equivalent in a busy timeline.

Author action: fix the route-target settlement/retry race so a successful post-cancel top-level search retry deterministically re-targets and highlights the destination while preserving dirty-edit bytes. Add or strengthen a deterministic regression around the failing interleaving, mutation-prove it, and rerun smoke shard 3 plus aggregate Desktop CI at the corrected head. If product intent instead excludes highlighting in this journey, change the contract and all corresponding route evidence coherently rather than leaving a knowingly flaky required assertion.

Verification owner: the author supplies the corrected exact-head regression and green CI; :bot: Jude’s code review agent repeats the affected journey and verifies route lifecycle/target state.

Integrated exact-head evidence:

• Long-history DM journey: PASS locally and in CI; independent lane repeated it 10/10 and mutation-proved the positive control.
• Focused targeted route journeys: PASS 4/4.
• Narrow 500×700 probe: target centered within 2 px, highlighted, no thread panel or horizontal overflow.
• pnpm check: PASS with the existing two warnings and two infos.
• pnpm typecheck: PASS.
• Full Desktop unit package: PASS 5,452/5,452.
• pnpm build:e2e: PASS.
• Exact-head CI: Desktop Core, smoke shards 1/2, macOS build, relay E2E, both integration shards, release candidate, and DCO passed; smoke shard 3 failed as above. The other shard-3 failure was not established as PR-caused.

Confidence gaps, not additional defects: native Tauri cold/warm URL delivery, real macOS AX/screen-reader behavior, keyboard-only target discovery, and reduced-motion runtime observation remain unverified. Author action: none unless those checks expose a defect. Verification owner: authorized native/product reviewer.

Any head movement expires this verdict.