Add exact-turn DGX message steering and receipt recovery; Mac scope pending

[witbrock]

Direct-message Steer reaches the exact active DGX coding task/attempt/thread/turn; Queue remains separate inbox work. The composer shares the chat submit preference, retains drafts when no target is available, pins ambiguous retries to their original target and key, and displays canonical delivery receipts without treating acknowledgement as model consumption.

The opt-in controller-owned app-server runs under the existing host lock and preserves model, effort and permission settings. Its current target is published by the authenticated owner and admitted only after canonical delegator, organisation, assignment and execution-attempt checks. Dispatch rechecks the source and target and reserves before sending. Unknown delivery is retained without replay or conversion to Queue. Receipt recovery uses the ordinary inbox reporter, with no task action authority.

Current main through 2d57ecd6 is integrated, preserving provisioning, Android, unread navigation and model-picker changes. The app-server path now records execution start when its owned child is spawned. The live probe exposed and fixed a retained-receipt context omission that had blocked subsequent Queue reporting.

Validation

Final candidate: 88bee67d42660296b8929bdd654ab6d4d52e337c.

• 245 targeted backend tests pass, including a real inbox-reporter regression for the observed recovery failure. Required CI passes.
• 73 steering/composer/model-picker frontend tests pass. The wider chat queue suite has 33 passes and two off-session tab-activity failures reproduced identically on pristine 2d57ecd6; those baseline failures do not widen this change.
• Actual modules/CSS in 390px touch and 1280px browser fixtures cover mode persistence, unavailable-draft retention, exact-target payload and explicit separate Queue. HTTP is synthetic.
• Existing isolated DGX canary task #V#task_agent_6aab4c77aed73b82161364326ea01fc2, Astra/high, used the shared host-capacity lock. The final task result contains a nonce supplied only by canonical Steer plus 17 + 26 = 43. Canonical Queue produced a separate reply containing its distinct nonce plus 9 + 8 = 17, in a different model thread. Target withdrawal and completed task state were read back.
• Provenance: active transport/admission consumption ran on fa6b3701; retained-receipt recovery and separate Queue ran on 88bee67d. The intervening patch restores empty task context for deterministic receipt reporting and adds its regression test; active transport, owner/admission service and worker code are unchanged. Guidance was not replayed. The first probe attempt honestly reported no input after an observer filename error; its audit and explicit retry are retained.

Private controller receipt: /home/mjw/.codex-von-worker/instance-canary-20260917/pr692-acceptance-receipt.json. Temporary canary is paused; no public activation occurred.

Remaining scope gate

Merge decision: not ready for the original both-route task. The DGX capability has bounded live evidence. The current Mac owner is stdio-only and has no supported external pinned-turn endpoint. Michael's choice between a DGX-Steer/Mac-Queue slice and a reviewed Mac runtime migration remains unanswered; neither Mac live steering nor original task completion is claimed. Default worker execution remains exec until explicitly activated.

Native source task: #V#task_agent_13dd283359c00c691c56d289dffd1e9a. Its original waiting attempt is preserved. No duplicate consumer, DGX conversation mirror or vendor patch was introduced.

[witbrock]

Quick integration review against main a607464: merge decision remains not ready. The retained candidate shares the saved chat Steer preference with Messages, but createMessageSubmitControls.activate returns without onSubmit for steer, and validate_direct_message_submit_mode rejects steer server-side. An existing chat-Steer preference therefore makes ordinary message submission stop working by default (the draft survives; explicit Queue is the workaround). Complete supported delivery and cover this existing-preference case before merge. There are also merge-tree conflicts in messagePanel.js, styles.css and messagePanelSendFailure.test.js against the newer shared composer/draft work. Preserve the merged draft scope, attachment/caption clearing, queue reconciliation and unread navigation fixes when resolving. This was source inspection plus a dry merge, not a browser acceptance pass.

[witbrock]

Operator-assisted continuation at 7ed18e7927bee20f548c37928aab0a1e98546888, following Michael's renewed “Get this finished, then merge and redeploy” instruction. The original waiting attempt remains preserved.

Merged current accepted main through ebe8a2e2. Fixed app-server execution-start timing, added canonical owner target publication and exact-target message admission, retained delivery receipts with recovery, and connected the composer and receipt UI. Ambiguous send retries retain their original target/key; Queue creates separate work. Missing canonical tasks resolve unavailable; infrastructure failures remain errors.

Validation: 233 focused backend tests including worker, transport, inbox, message routes, provisioning and Android; 54 frontend tests; actual composer browser fixture at 390px and 1280px with synthetic HTTP. Fixture evidence does not claim live model consumption. The existing private canary is being staged for a serialised live DGX probe under the host-capacity lock; no public switch.

Merge decision remains gated on real DGX active-Steer/separate-Queue evidence and the unresolved Mac scope choice. The current Mac stdio-only owner has no supported external pinned-turn endpoint. This candidate does not claim Mac live steering, and the original both-route task is not complete. The parent operator is deploying independently accepted changes while that choice is pending.