Keep timeline pagination scoped and recoverable during updates

Author: antropos17

DESIGN.md

@@ -223,6 +223,12 @@ with the current PR status. Polling uses saved records, not synthetic events.
 Pause and queued updates retain visible rows and focus; applying updates is
 explicit while reading below the feed heading. Offline keeps saved rows visible.
 
+The scenario Timeline scopes its head and pagination reads separately. Changing
+filters or accepting a newer head cancels the old cursor; late completion cannot
+release another scope's busy state. A successful head poll cannot clear a failed
+older-page read. Manual pagination keeps entry on the action while it exists, or
+on the recorded list after the final page; another chosen input keeps focus.
+
 The shared activity feed uses a narrow avatar rail and a flexible evidence column,
 not a graph canvas or decorative dashboard. Keep native filters, readable action
 sentences, source/PR links and explicit simulation provenance. Use recorded times

docs/CONTEXT.md

@@ -82,7 +82,7 @@ and external AI CLIs require a direct user request. Never merge old work implici
 - Existing Commons run 49092854-f9bd-4b7a-8d12-4ac5ea0e5f70 retains the approved,
   unmerged safe-timer change from job 811bdb98-bcbb-4b65-80b9-f19693aef6b4.
   Preserve it. 29 earlier lab experiments were verified before this release work.
-- Public source: antropos17/commit-zero at 21b8004; all three CI jobs passed with local c39b0e9's identical tree. Preserve separate histories.
+- Public source: antropos17/commit-zero at 9e6aa38; all three CI jobs passed with local ef8ea03's identical tree. Preserve separate histories.
   README GIF is a 15.8s condensed walkthrough of retained Sequence Kit work,
   not a continuous live recording. Static fallback included; desktop/mobile and all
   three CI jobs passed. Evidence: runtime/verification/github-readme-gif-2026-10-19.json.

docs/ECOSYSTEM-DECISIONS.md

@@ -5,6 +5,20 @@ below were checked or attempted on 2026-10-19; documentation does not establish
 capabilities or provider entitlement. The [mission log](MISSION-2026-10-19.md)
 records implementation and verification timestamps.
 
+## Keep pagination independent from head polling
+
+Actual Timeline fixtures exposed stale busy state across filters, terminal focus
+loss and a successful head read erasing an older-page failure. Decision: keep
+separate request/error lifecycles, abort old cursors on context replacement and
+restore manual entry only when another input has not been chosen. A further
+new-head fixture checks complete event IDs against the actual handler so a
+cursor from an old first page cannot create gaps. Expected benefit: readable,
+recoverable history under concurrent updates. Seven focused Chrome cases passed.
+The [Playwright clock reference](https://playwright.dev/docs/clock), accessed
+2026-10-19, supports installing timer control before page scripts. It is used
+only in explicit timer cases; HTTP handlers and scenario transactions still run.
+This avoids artificial wall-time waits without making a performance claim.
+
 ## Contain a failed page within the workspace
 
 The [React error-boundary reference](https://react.dev/reference/react/Component#catching-rendering-errors-with-an-error-boundary)

docs/FIRST-RUN.md

@@ -122,3 +122,13 @@ The [actual dark failure capture](media/lab-discovery-unavailable-2026-10-19.png
 uses one routed HTTP 503 in disposable services. Recovery reaches the real read
 handler without starting an experiment or writing history. A separate synthetic
 readiness fixture tests enabled/disabled controls and is not runtime evidence.
+
+In Timeline, **Load older activity** retries a failed page while preserving the
+events already loaded. Head polling and older-page errors are separate; paused
+updates say that resuming is required. Changing filters cancels old pagination.
+The [actual narrow failure capture](media/timeline-page-unavailable-2026-10-19.png)
+shows a routed HTTP 503 after reading two real records from disposable scenario
+data. The fixture changes only the GET page size to two and uses no invented
+rows; every action remains labeled simulated. A successful retry reaches the
+real handler. The separate update tests advance only the disposable scenario;
+they neither change retained user history nor call a model.

docs/HANDOFF-2026-10-19.md

@@ -8,17 +8,17 @@ tracks dated decisions and receipts; this file is the operational entry point.
 ## Repositories and state
 
 - Working repository: `X:\ai-github`, branch `codex/development-foundation`,
-  latest fully checked local commit `c39b0e9` at this checkpoint. The local data and model
+  latest fully checked local commit `ef8ea03` at this checkpoint. The local data and model
   installation are here. Recheck status before acting; this file can age.
 - Public repository: [antropos17/commit-zero](https://github.com/antropos17/commit-zero),
-  `main` at `21b80047fe5980791dfa1420eb73a2c6290c613b` after a normal push.
+  `main` at `9e6aa381d94e078eafc929fb3cca9a30bfb1b2d0` after a normal push.
   Its separate checkout is `.cache/publication`. The histories are unrelated;
-  the public tree matches local `c39b0e9` (`39d7a5226e9a1e2210c8d4d161b75b702e514210`).
-  Publication preparation is the next bounded unit.
+  the public tree matches local `ef8ea03` (`dfa3fb055881d4c97d51d7cc72310f1b8a2f87a2`).
+  Timeline pagination recovery is the next bounded unit.
   Do not merge histories, reset the local branch or force push. Recheck remote
   before publishing anything else.
-- Public CI [run 39246812329](https://github.com/antropos17/commit-zero/actions/runs/39246812329)
-  passed full gate, Chromium and runtime dependency audit for `21b8004`. Local
+- Public CI [run 39249644047](https://github.com/antropos17/commit-zero/actions/runs/39249644047)
+  passed full gate, Chromium and runtime dependency audit for `9e6aa38`. Local
   `evidence:status` confirmed equal trees and current full/browser receipts. The
   preceding retry-fixture failure at `5f9f88e` is preserved in the mission log.
 - This mission has not run local or hosted model inference, spawned product
@@ -187,17 +187,30 @@ only `--stage` applies, leaving both HEADs unchanged and proving an exact staged
 tree. Eight Git fixtures cover binary/mode/add/delete transfer, CRLF working text,
 dirty/stale/mismatched states, redirects, private input and primitive rejection.
 Actual dirty-source CLI refusal left both real Git index bytes unchanged.
-Current frozen full/browser gates, committed-source dry run and actual staging
-are still required for this unit. [Procedure and recovery](RELEASE.md#maintainer-publication-preparation).
+Its frozen full/browser gates, actual committed-source dry run and explicit
+staging passed. The 61,026-byte patch had SHA-256 `404b684b`; its staged tree
+matched source while both HEADs remained unchanged. A separate ordinary commit
+and push completed publication, then exact public CI passed. Immutable
+`publication-preparation-{ready,staged,evidence}-2026-10-19.json` receipts are
+under `runtime/verification`. [Procedure and recovery](RELEASE.md#maintainer-publication-preparation).
 Shared Git reads disable inherited overrides, optional writes and lazy fetch;
 the Windows platform ownership exception is supplied per exact root on each
 command, without changing global configuration. An initial ownership failure and
 two caught-error lint diagnostics were corrected before the later fast/22-test pass.
 
-- Latest local frozen full gate at `c39b0e9`: 94/94 Node tests, compiled DOM/axe
+The current Timeline unit separates head and older-page errors, cancels replaced
+cursors and restores manual keyboard entry while preserving another chosen
+input. Seven focused Chrome cases passed, including late responses after filter
+changes, reading anchors, explicit held updates and complete event IDs after a
+newer head. Five cases only read; two each advance the disposable scenario once.
+No retained data or model is involved. [Actual failure view](media/timeline-page-unavailable-2026-10-19.png)
+has SHA-256 `4251435693ab62331e36a165f92345ef00dfb9a5b40ce457ea4df6b4f7704abc`.
+Full 47-case Chrome and frozen full gates remain required before commit.
+
+- Latest local frozen full gate at `ef8ea03`: 102/102 Node tests, compiled DOM/axe
   2/2, build and static serving passed. Stable source hash
-  `9da92394800661fdfe8498eeaed5508c401c2d624c9f8a0ee335a806a8cae6ac`;
-  receipts `runtime/verification/lab-recovery-{full,browser}-2026-10-19.json`
+  `09efffa5615e3f874bb4cbcbb7043ca0c8c336ac9aab9f32484f3059697e3678`;
+  receipts `runtime/verification/publication-preparation-{full,browser}-2026-10-19.json`
   (ignored by Git).
 - Installed Chrome browser suite passed 40/40 at desktop and 390px. Real captures
   are `runtime/verification/commons-first-run-{desktop,narrow}-2026-10-19.png`,
@@ -268,9 +281,9 @@ two caught-error lint diagnostics were corrected before the later fast/22-test p
 
 ## Next work, in order
 
-1. Complete publication preparation: run grouped Chrome and `npm run check` on frozen source,
-   commit it, copy the unpublished local commit into the separate public
-   checkout, compare Git trees, push without force and inspect public CI.
+1. Complete Timeline recovery: run grouped Chrome and `npm run check` on frozen source,
+   commit it, use `publication:prepare` dry run/explicit staging in the separate
+   checkout, compare Git trees, commit/push without force and inspect public CI.
    Record exact SHA and receipt.
 2. Continue another bounded user journey under the remaining mission time.
    Prioritize an observed defect over a new feature; check desktop/narrow

docs/MISSION-2026-10-19.md

@@ -12,7 +12,7 @@ Start: 03:46:17 UTC. Deadline: 15:46:17 UTC. Final integration reserve begins 14
 
 ## Current action
 
-Complete publication preparation after eight Git fixtures and focused tooling 34/34 passed. Freeze source for the 40-test Chrome suite and 102-test full Node gate. Commit, verify the post-commit hash, fetch public main separately, exercise dry run and explicit staging on the verified source, then commit/push normally and inspect exact CI. Keep all new profiles disabled. The final integration reserve still begins at 14:16:17 UTC.
+Complete Timeline pagination recovery after seven focused Chrome cases passed. Run focused UI feedback, then freeze source for the 47-test Chrome suite and 102-test full Node gate. Commit, verify the post-commit hash, fetch public main separately, use the qualified preparation dry run/explicit staging, then commit/push normally and inspect exact CI. Keep all new profiles disabled. The final integration reserve still begins at 14:16:17 UTC.
 
 ## Decisions and limits
 
@@ -122,4 +122,10 @@ Complete publication preparation after eight Git fixtures and focused tooling 34
 - Initial iteration stopped before gates when stripping platform Git ownership configuration, then lint caught two missing error causes. The process-local Git environment now disables inherited redirects/traces, replacement refs, optional index writes and lazy fetch; each checked root gets only a command-scoped ownership exception. No global Git configuration changed. A CRLF test first exposed a fixture's stale index metadata; staging the unchanged normalized fixture tree before measuring proved clean Git state and exact later transfer. No production file needed normalization and no published source was changed by those probes.
 - A normal checkpoint message was provided to the coordinating parent on request. Implementation is active in the same single Windows worker; there has been no new execution interruption. The final 14:16-15:46 UTC window still owns final source/check/CI correlation, fresh capability/disk checks and handoff integration. No new release/tag, promotional post, model call or agent was created.
 
-Freeze source for the 40-test browser suite and full 102-test Node gate; commit, exercise actual preparation, publish and inspect exact CI. Preserve the final 90-minute reserve from 14:16:17 UTC.
+- 12:07 UTC: publication preparation committed locally as `ef8ea03848a10e896b7061bacca5ab6870466116` after full 102/102 Node, 2/2 DOM and Chrome 40/40 gates on frozen hash `09efffa5615e3f874bb4cbcbb7043ca0c8c336ac9aab9f32484f3059697e3678`, unchanged after commit. After a separate fresh fetch, actual dry run returned ready with unchanged indexes, and explicit staging returned exact tree `dfa3fb055881d4c97d51d7cc72310f1b8a2f87a2` with unchanged HEADs. Its 61,026-byte patch SHA-256 is `404b684be46ad05e38cdb77872d5ba79d126bbd42d1e7e0fba7d38562e800b27`. Separate ordinary commit/push produced `9e6aa381d94e078eafc929fb3cca9a30bfb1b2d0`. CI39249644047 passed all three jobs. Immutable `publication-preparation-{full,browser,ready,staged,evidence}-2026-10-19.json` receipts are under `runtime/verification`.
+- Timeline baselines in `runtime/verification/timeline-pagination-baseline-2026-10-19` confirmed terminal focus loss and a head poll clearing an older-page error. Its first filter case was inconclusive because of a selector; the corrected case in `timeline-filter-baseline-2026-10-19` proved a pending old page kept the new filter's pager disabled. The component now scopes snapshots/errors by query, aborts replaced cursors, protects a new request's busy state from a late old completion, keeps head/page errors separate and restores manual focus without stealing another input. A newly applied head invalidates its old cursor; an explicit held-update action retains keyboard entry. Narrow actions reach 44px.
+- Seven focused Timeline cases passed twice, including the final focus refinement. The read-size fixture requests real handler rows with limit two, not authored events. Five cases remain read-only; two each perform exactly one deterministic expected-run/revision transaction in disposable storage. They check held reading anchors and compare all loaded IDs with the actual full handler result. Explicit Playwright-clock cases test pause/resume and new heads; the error/poll case uses the real three-second interval. The inspected dark capture `docs/media/timeline-page-unavailable-2026-10-19.png` has SHA-256 `42514356`. No retained history or model was touched.
+
+- The first UI gate stopped at the prior DOM assertion requiring `aria-pressed` on the changing-label Pause/Resume action. The assertion now checks the actual Resume action, absence of inappropriate toggle state, and the existing paused-status text; the new Chrome case independently checks timer stop/resume. Failed receipt: `runtime/verification/timeline-ui-failure-2026-10-19.json`. Corrected UI gate passed both DOM/axe cases, build and serving; JSON/log are `timeline-ui-corrected-2026-10-19`. No polling or acceptance check was removed.
+
+Freeze source for the 47-test browser suite and full 102-test Node gate. Commit, prepare/publish and inspect exact CI. Preserve the final 90-minute reserve from 14:16:17 UTC.

docs/SIMULATIONS.md

@@ -44,3 +44,17 @@ read the preserved Commons run and its inference receipts separately.
 
 Future coverage: tool denial and interrupted artifact capture. These require
 explicit fixtures; they must not be inferred from the current command.
+
+## Browser pagination and timer fixtures
+
+`tests/browser/timeline-recovery.spec.mjs` routes reads to the actual Timeline
+handler with `limit=2`. The records, totals and cursors come from its disposable
+scenario, not an authored JSON feed. Five cases perform only reads and verify an
+unchanged scenario revision. Two cases each advance that disposable scenario
+once through the normal expected-run/revision API to verify held updates and
+cursor replacement. They do not change a retained store or initiate inference.
+
+The pause/resume and new-head cases install Playwright's clock before loading
+the page and explicitly advance timers. Other failure/poll checks use the real
+three-second interval. These are reproducible browser interaction fixtures, not
+model activity, production traffic, timing benchmarks or sandbox qualification.

docs/WORKFLOW-MEASUREMENTS.md

@@ -28,8 +28,12 @@ An actual CLI dry run against the dirty maintainer source returned `blocked`
 without attempting staging; independent before/after hashes confirmed both real
 Git index files unchanged. Receipts:
 `runtime/verification/publication-preparation-dirty{,-indexes}-2026-10-19.json`.
-The intended full frozen gate, current-source dry run and explicit real staging
-remain required before this unit is considered published. See the
+The full frozen gate, current-source dry run and explicit real staging then
+passed on local `ef8ea03`: 61,026 patch bytes, exact staged tree and unchanged
+HEADs. A separate normal commit/push produced public `9e6aa38`; exact CI passed.
+`publication-preparation-{ready,staged,evidence}-2026-10-19.json` receipts retain
+the real operation timestamps and hashes. These are single observations, not
+a comparable before/after timing batch. See the
 [maintainer contract](RELEASE.md#maintainer-publication-preparation).
 
 ### Source-index coverage and measured cost

docs/media/timeline-page-unavailable-2026-10-19.png

@@ -1197,6 +1197,10 @@ textarea::placeholder {
     min-height: 44px;
     font-size: 16px;
   }
+  .timeline-feed > .btn,
+  .timeline-status .btn {
+    min-height: 44px;
+  }
   .timeline-event {
     grid-template-columns: 44px minmax(0, 1fr);
     gap: 12px;