Runtime conversation consistency
The shared conversation Store owns Wework transcripts. Execution lifecycle, Goal continuation, and composer drafts are separate state. A pane must not keep another writable transcript or infer missing history from the presence of rendered messages.
Ordering contractβ
A history page can contain older turns and the live turn while omitting Goal continuations already observed locally. Turn and item merging share the same neighboring-identity insertion logic, placing missing turns between their observed neighbors instead of appending them after the live turn. Hydration uses that same merge entry point when supplying prerequisites for buffered deltas, so concatenation cannot become a false native-order anchor. Optimistic input without a native identity stays at the tail.
Diagnostic snapshots export explicitly allowed device identity, status, and routing fields; raw cloud-device and remote connection configuration is excluded.
The pinned Codex 0.163.0-alpha.5 supports thread/timeline/list. Entries carry their canonical rollout position; the initial request reads the newest window, and nextCursor pages backwards. Each native request returns at most 100 entries. Ordinary executor reads combine at most five pages; only explicit full-content requests traverse the remaining history. Native cursors remain opaque.
thread/items/list supplies ordered arrays, but its entries and live notifications do not share a persisted position or snapshot revision. Receive order, timestamps, tool completion times, and text equality cannot establish canonical history order.
The executor preserves native positions on normalized turns and items. Multiple display blocks derived from one source item retain its position and their stable identities. Pages and events update items by identity; confirmed positions determine ordering. Distinct native items with identical text remain distinct, including when only the cache retains their native positions and the incoming delta has none. Unpersisted live output may remain provisional without a position. Completed live-cache items outside a native page must not be appended to that page.
Positions belong to a native threadId. Replacing a thread invalidates the previous branch's cached ordering and supersedes its in-flight reads. Ordinary task navigation retains each task's shared conversation.
A turn can span multiple native pages. Only a page containing its user item or turn-start boundary owns a synthetic user presentation; turn metadata carried by a cursor cannot transfer that ownership to another page.
Persisted items use native positions; unpositioned runtime items retain their observed native neighbors. When a later source explicitly observes an item after its last native boundary, that trailing relation replaces an older leading anchor. A delta without any native boundary cannot erase an existing anchor. Adjacency comes from each original source sequence; inserting a newly discovered item into the union cannot make it a neighbor previously observed by live output. Absence from a history page is not deletion. The executor overlays unfinished current items onto native history before projecting turns and messages once, so both API views contain the same current content. Completed historical caches cannot enter this overlay. Separate runtimeTurns carry only running background commands and their output, anchored by neighboring identities from the current native page without replaying cached text. The frontend uses native history as its base and runtime state as its overlay. Explicit supersededTurnIds remove replaced turns and reject late events. Native users bind to host send identities only through a unique user and presentation in the same turn.
Turn lifecycle is independent of unpersisted items. Native turns/list can synthesize interruption while its runtime observation is catching up. When the executor still owns that exact active turn and the timeline has no turnCompleted boundary, projection keeps it running even if the live buffer is empty or all observed items have been persisted. An actual terminal boundary wins; its marker survives pagination cursors and cannot be reopened by the active buffer.
Turns and items share the same position and neighboring-identity ordering rules. Cached turns outside the newest history page that have no native position remain before their observed next native turn; appending all of them to the conversation tail would displace current Goal output and select an old reply as active. A new live turn without an observed native successor remains at the tail. Page merges must not invent adjacency for old cached turns from the merged array.
Answering an asynchronous question can preempt streamed text while Codex continues the same turn. The interrupted prefix may exist only as a live item without a persisted position. The executor must retain completed live-item identities as neighboring anchors when overlaying that prefix, placing it before the subsequent guidance input. Omitting completed bodies must not discard their ordering anchors or append the old prefix after newer progress. Existing native item order and positions remain authoritative. The streaming-content desktop checkpoint uses real Codex, an async question option click, and model stream preemption to cover live rendering, reload recovery, and completed history.
User messages must use their containing turn's canonical identity instead of retaining an earlier request alias. When editing or retrying replaces a turn, the executor records supersession for both the request alias and native ID using the persisted native mapping, so optimistic caches, native history, and reloaded history remove the same old turn.
Ownership and synchronizationβ
Goal notifications belong to the thread and can retain the previous request's turn identity while a continuation starts. They must not update the current execution's turn binding, lease, or running state. Current-turn response events advance execution lifecycle so an older turn snapshot cannot prematurely complete a new execution.
Native normalization produces turns/items and presentation messages in one pass. Native positions order items; explicit user boundaries group their presentation. The initial ordinary prompt owns the same reply as pre-prompt context compaction, while runtimeGuidance establishes another display segment. Guidance may split a turn into display segments, but turn-level artifacts aggregate across those segments rather than come only from the last segment. The native primary path does not reconstruct turns from rendered messages. Other runtimes and legacy history retain their explicit adapter boundaries.
Source-position registration visits only identities not yet registered in the current display segment, without constructing or copying their body JSON. Each identity is registered at most once; the first positioned event also supplies positions for preceding unpositioned items, and duplicate identities retain their first position. Emitting a segment clears registration progress. Full runtimeItems are materialized only when emitting the segment, avoiding quadratic reconstruction of accumulated history in long turns. A unit regression covers 4,000 positioned events with 2 KiB bodies and a generous debug-build time budget.
Edit/retry supersession markers filter native turns before normalization so both projections agree. Metadata reads reuse the existing startup retry only for explicit not-ready protocol errors; permanent errors still propagate to the caller.
When an outcome-only Runtime snapshot completes a backend execution, the terminal transaction retains reconciliation eligibility for its bound turn. Delayed final text can fill that activity only when execution, project, task, and turn match, the execution root remains completed, and the event sequence advances. Filling text must not replay business workflow transitions. An activity with an execution binding whose execution record is missing must reject the update.
Task navigation, reconnection, and lifecycle reconciliation use synchronizeRuntimeConversation: identical requests coalesce, competing writes within a conversation serialize, and other conversations proceed independently. Archival invalidates outstanding writes. Navigation metadata reads do not mutate transcript content.
Live updates continue publishing during a history read. Their observed state is retained for the commit. Append-only tool deltas are materialized against that state before reconciliation, avoiding duplicate appends when native history already contains them. Text reconciliation uses stable item identity and preserves complete prefixes already included in native history. This contract does not claim that the upstream protocol exposes an atomic revision or watermark.
Child-thread views are read-only projections: they neither adopt the child as the parent task thread nor update parent context usage. The cache applies updates immediately; React subscriptions coalesce view notifications per animation frame without holding another message state.
Skill catalog readers for sent messages bind to the actual workspace directory. Unrelated task snapshots must not change the reader callback identity and clear an already loaded catalog; workspace changes and plugin catalog updates still invalidate the corresponding read.
History snapshots, live block creation and block updates share one block reconciliation entry. Late blocks cannot replace observed command output with a shorter prefix or remove observed children of the same subthread. Append-only deltas are materialized before that reconciliation.
Each live action is published once on arrival. Completing or aborting hydration only notifies subscribers of the snapshot change; replaying actions would repeat their side effects.
Live timing measures the locally observed lifecycle interval. It retains the displayed start and freezes the end and duration using the same local wall clock when a terminal event or recovery snapshot first confirms completion. Duplicate completion notifications and subsequent native snapshots preserve that frozen interval. History first observed after completion retains its native duration. Codex supplies start/end timestamps in seconds and duration in milliseconds: adding that duration to a rounded start cannot reconstruct a precise endpoint, and running and completed labels must use the same timing source.
Send acknowledgement binds the optimistic turn to its native identity while retaining the start observed during the pending phase. Task titles are independent metadata: manual and generated names share one persistence and title-event publisher, so subscribed workbenches receive both kinds of changes.
A delayed running snapshot of a settled turn cannot confirm an unaccepted send; rejection must allow the task to return to idle. Only an accepted send allows a running snapshot whose turn ID has not advanced to clear asynchronous waiting. A snapshot identifying a genuinely new turn may arrive before the send acknowledgement and preserves that confirmed execution.
Paging and conversation-cache lifecycle own loaded native history. The provisional-output block limit cannot silently discard confirmed history. Goals project execution state; explicit transport gaps and recovery events belong to the synchronization layer.
Viewport restorationβ
Bottom-follow snapshots retain follow intent. Historical reading snapshots retain message/item identity, available text offsets, and viewport position. Initial virtual positioning establishes the approximate viewport; the scroll controller then restores the same content, retaining pending restoration while layout mounts it. React keys and expansion state use item identity rather than array indices.
Verificationβ
A real pinned binary was exercised in an isolated Codex Home with 510 synthetic items across six native pages, confirming unique identities, monotonic positions, and the 100-entry page limit. Synthetic database seeding is test setup only; production reads use public RPC methods rather than Codex database access.
Focused regressions cover corrupted order repair, overlapping-page permutations, duplicate reads, identical text with distinct identities, snapshot/delta races, live updates after loading over 500 items, archival, native-thread replacement, and immediate task snapshot switching.
The streaming-conversation-switching desktop checkpoint is registered in the shared runner and CI suite. It mocks only model responses, uses the real executor to produce more than 500 items, continues streaming across task navigation, and checks stable identity/order without duplicated content. Repository policy requires an explicit request before running desktop E2E or ai:verify; registered coverage is not evidence of an executed run.