fix(commons): preserve saved author identity during read recovery

Author: antropos17

DESIGN.md

@@ -245,6 +245,12 @@ scrolling to fresh events is an explicit reader action.
 
 ## Compact working surfaces
 
+Saved-author discovery preserves the selected ID while loading or unavailable.
+It never silently substitutes Workspace Builder. Explicit read recovery retains
+the task draft, qualifies last-available configurations and restores keyboard
+entry without overriding another chosen input. Unknown configurations cannot
+be submitted as the selected author.
+
 Mobile navigation retains every labeled destination in three parallel groups.
 Tabs wrap rather than placing sections outside the visible strip. Primary preview,
 experiment launch and refresh controls belong in the page heading; PR status

docs/CONTEXT.md

@@ -27,7 +27,7 @@ and external AI CLIs require a direct user request. Never merge old work implici
   and previous PRs. Merging closes a linked issue transactionally. PRs support
   discussion, close/reopen and revision tasks; duplicate retained code is rejected.
 - Saved local agents can author proposals through owner-checked profile lookup.
-  Configuration/version/instructions are frozen per task. Project scope, local
+  Read-only discovery preserves selected IDs and offers explicit retry. Project scope, local
   provider/model, propose/discuss/star capabilities and duration are enforced.
   Reviewer is host-controlled; merge remains explicit. Instructions are not secrets.
 - Source changes modify or add one bounded JavaScript file; parser checks never

docs/ECOSYSTEM-DECISIONS.md

@@ -189,3 +189,18 @@ without automatic write retry, and pause with/without another focus choice.
 | Browser startup and temporary files | Reuse installed Playwright 1.64.1, apply workspace temporary variables before import/spawn, and inspect/remove a fresh Chrome profile in a separate readiness probe. [Primary launch reference, baseline and actual receipt](WORKFLOW-MEASUREMENTS.md#browser-temporary-paths-and-readiness). No new dependency or sandbox is introduced. |
 | Source-bound release evidence | Use the existing Playwright JSON reporter and Git tree comparison to correlate full local/browser receipts without merging histories. [Primary reporter reference, observed manual friction and rejection fixtures](WORKFLOW-MEASUREMENTS.md#earlier-feedback-measurements). The preflight never publishes or claims provider/sandbox qualification. |
 | Open-source distribution | Prepare real captures and channel-specific material, respect channel restrictions, and publish only source/docs. [Rules, drafts and assets](DISTRIBUTION.md). |
+
+### Saved-author recovery (accessed 2026-10-19)
+
+The existing [React effect cleanup guidance](https://react.dev/reference/react/useEffect#fetching-data-with-effects)
+also applies to owner-scoped configuration reads. An actual Chrome baseline
+showed a false sign-in instruction and a native select visually falling back to
+Workspace Builder after HTTP 503. Decision: keep owner-scoped read state, validate
+rendered fields and IDs, cancel replaced reads, retain the intended selection
+with an unavailable option, and offer explicit read-only refresh. Last-available
+choices stay qualified and cannot authorize a submission until refreshed.
+Expected benefit: a failed discovery read cannot silently change task attribution.
+Four browser cases exercise actual disposable account/configuration endpoints,
+failed and malformed reads, recovery, missing selection, focus and narrow axe.
+Configuration creation is explicitly non-executable; no job is submitted and no
+model or catalog role is activated. No dependency or third-party code is added.

docs/FIRST-RUN.md

@@ -141,3 +141,12 @@ uses malformed read-only metadata in disposable services; the subsequent retry
 reaches the real handler. Run agents is never pressed in those fixtures.
 A successful health check alone does not qualify inference, tool access, model
 quality or any of the disabled Proposed roles.
+
+For a saved task author, **Refresh saved agents** retries the signed-in account's
+configuration list. A failed read preserves the selected ID and task draft;
+it does not silently choose Workspace Builder or ask an already signed-in owner
+to sign in again. Last-available configurations remain visible but cannot be
+used until refreshed successfully. A confirmed missing author requires an
+explicit author choice. [Actual narrow failure capture](media/commons-saved-agents-unavailable-2026-10-19.png)
+uses a configuration-only fixture and a routed HTTP 503. Recovery reads the
+actual owner endpoint; no task, agent or model is started.

docs/HANDOFF-2026-10-19.md

@@ -8,17 +8,17 @@ tracks dated decisions and receipts; this file is the operational entry point.
 ## Repositories and state
 
 - Working repository: `X:\ai-github`, branch `codex/development-foundation`,
-  latest fully checked local commit `4d236f3` at this checkpoint. The local data and model
+  latest fully checked local commit `7ed1ea0` at this checkpoint. The local data and model
   installation are here. Recheck status before acting; this file can age.
 - Public repository: [antropos17/commit-zero](https://github.com/antropos17/commit-zero),
-  `main` at `38c63799d41af4f4265870d5afb7801721acc33a` after a normal push.
+  `main` at `9a8dde0de8cf7076f3f46b1e539e68ee9cfc0e9f` after a normal push.
   Its separate checkout is `.cache/publication`. The histories are unrelated;
-  the public tree matches local `4d236f3` (`19906b17ac7eabb737a2c4b154da2d9637ef7c61`).
-  Commons readiness recovery is the next bounded unit.
+  the public tree matches local `7ed1ea0` (`5b4fdf3ef9a4233552c2a97b8b550894acaf7863`).
+  Saved-author read recovery is the next bounded unit.
   Do not merge histories, reset the local branch or force push. Recheck remote
   before publishing anything else.
-- Public CI [run 39252943247](https://github.com/antropos17/commit-zero/actions/runs/39252943247)
-  passed full gate, Chromium and runtime dependency audit for `38c6379`. Local
+- Public CI [run 39255670021](https://github.com/antropos17/commit-zero/actions/runs/39255670021)
+  passed all three jobs for `9a8dde0`. Local
   `evidence:status` confirmed equal trees and current full/browser receipts. The
   preceding retry-fixture failure at `5f9f88e` is preserved in the mission log.
 - This mission has not run local or hosted model inference, spawned product
@@ -216,12 +216,24 @@ task submissions. [Actual unknown-readiness capture](media/commons-readiness-unk
 has SHA-256 `46437ce7afba4bede8e5014d1aa3636d6bb07560808a9862be2ad394bd3a6d3d`.
 It uses deliberately malformed fixture metadata; health checks do not establish
 actual inference or qualify a catalog role. Full 51-case Chrome and frozen full
-gates remain required for this unit.
+gates passed for the published unit.
 
-- Latest local frozen full gate at `4d236f3`: 102/102 Node tests, compiled DOM/axe
+Saved-author discovery now lives in `prototype/app/pages/commons-agents.mjs`.
+It validates the list, scopes it by account, cancels replaced reads, preserves
+the selected ID and exposes read-only refresh with pending/error/last-available
+states. Missing or stale configurations cannot submit as an author; selecting
+Workspace Builder must be explicit. Five focused Chrome cases passed using
+actual disposable configuration-only account records, without task submission.
+The inspected [failure capture](media/commons-saved-agents-unavailable-2026-10-19.png)
+has SHA-256 `6da3987dac09f4723413bb50bb721dc90a39ce0251df34eaa7a5621180a79811`.
+The anonymous-session regression caught by the first full run is fixed; the
+signed-out selected-author case now passes in the isolated five-case group.
+Full 56-case Chrome and frozen full gates remain required for this new unit.
+
+- Latest local frozen full gate at `7ed1ea0`: 102/102 Node tests, compiled DOM/axe
   2/2, build and static serving passed. Stable source hash
-  `b5d53159f6c587d68f881f480f1f4ade365b9a78618e06b9ad24ec54241ed552`;
-  receipts `runtime/verification/timeline-recovery-{full,browser}-2026-10-19.json`
+  `fee9f65a04891d506c54db9a953cabeeb4d018ee1cf1dcc1a5745c9a979fc95a`;
+  receipts `runtime/verification/commons-readiness-{full,browser}-2026-10-19.json`
   (ignored by Git).
 - Installed Chrome browser suite passed 47/47 at desktop and 390px. Real captures
   are `runtime/verification/commons-first-run-{desktop,narrow}-2026-10-19.png`,
@@ -292,7 +304,7 @@ gates remain required for this unit.
 
 ## Next work, in order
 
-1. Complete Commons readiness: run grouped Chrome and `npm run check` on frozen source,
+1. Complete saved-author recovery: run grouped Chrome and `npm run check` on frozen source,
    commit it, use `publication:prepare` dry run/explicit staging in the separate
    checkout, compare Git trees, commit/push without force and inspect public CI.
    Record exact SHA and receipt.

docs/MISSION-2026-10-19.md

@@ -134,4 +134,13 @@ Complete Commons model-readiness recovery after five related Chrome cases passed
 
 - A separate saved-author baseline created only an explicitly configuration-only author in disposable identity services, then routed the owner-list read to HTTP 503. It exposed a false sign-in instruction, native select falling back visually to Workspace Builder despite the retained selected ID, and no explicit list retry. Trace/context: `runtime/verification/saved-author-baseline-2026-10-19`. No author launch or task submission occurred. Repair this as the next bounded unit after readiness publication, keeping the selected identity explicit and recovery read-only.
 
-Freeze source for the 51-test browser suite and full 102-test Node gate. Commit, prepare/publish and inspect exact CI. Preserve the final 90-minute reserve from 14:16:17 UTC.
+- 12:54 UTC: Commons readiness committed locally as `7ed1ea0df32c3ec942313bd10b1004dbadb03f8f` after full 102/102 Node, 2/2 DOM and Chrome 51/51 gates on frozen source-index v2 hash `fee9f65a04891d506c54db9a953cabeeb4d018ee1cf1dcc1a5745c9a979fc95a`, unchanged after commit. Fresh fetch and qualified preparation transferred a 172,922-byte patch, SHA-256 `cef8d1e63ece47e4aabd82f8468f0f97238d0372d6fe9c0d6c7860aaa7dc3f53`. Ordinary public commit/push produced `9a8dde0de8cf7076f3f46b1e539e68ee9cfc0e9f`, identical tree `5b4fdf3ef9a4233552c2a97b8b550894acaf7863`. CI39255670021 subsequently passed all three jobs. Receipts: `runtime/verification/commons-readiness-{full,browser,evidence}-2026-10-19.json` and `commons-readiness-preparation-{ready,staged}-2026-10-19.json`.
+- Saved-author recovery now retains explicit selected identity through failed/malformed reads, scopes configurations by owner, cancels replaced reads and exposes a read-only refresh with pending and last-available states. A stale selected configuration cannot authorize submission; native selection never silently falls back to Workspace Builder. Four focused Chrome cases passed against actual disposable account/configuration endpoints, including strict read fields, duplicate IDs, absent selected author, both manual focus outcomes and 390px light/dark axe. Initial fixture creation asserts configuration-only status and unavailable standalone execution. Subsequent checks assert no non-GET request or scenario/Commons revision, event or job change; no task or model is started. The inspected narrow capture `docs/media/commons-saved-agents-unavailable-2026-10-19.png` has SHA-256 `6da3987d`. `check:fast` passed 9/9 focused tests; full acceptance remains separate.
+
+- The first saved-author focused UI gate passed its lint/build/two DOM/serving stages but correctly failed source stability because handoff/mission documentation was edited during the run. Receipt and raw log `runtime/verification/commons-saved-agents-ui-2026-10-19` are retained as failed evidence, not acceptance. Freeze all indexed source and documentation for the complete browser and full gate below; no stage is waived.
+
+- The first full browser group then exposed an anonymous-session focus regression in the new hook (`entry` was null while both owner IDs were undefined). Its stable failed receipt is `commons-saved-agents-browser-2026-10-19.json`; no full gate or publication followed. Add an explicit non-null guard and a signed-out selected-author journey. An initial focused rebuild inadvertently still used the uncorrected source after a patch-context failure; its four failures remain under `commons-saved-agents-corrected-focused-2026-10-19`. The corrected built source passed all three first-run cases plus four author cases, then hit the unchanged 180/minute limiter when combined in one service cluster. Preserve that result under `commons-saved-agents-corrected-built-2026-10-19`; run the five author cases in their own fresh group, as the complete suite already does. No limiter, retry or assertion was weakened.
+
+- The rebuilt anonymous fix and all five author cases then passed together in a fresh isolated cluster: `runtime/verification/commons-saved-agents-corrected-isolated-2026-10-19.log`. The existing full-run first-entry assertions remain unchanged. Freeze all source/docs for complete acceptance next.
+
+Freeze source for the 56-test browser suite and full 102-test Node gate. Commit, prepare/publish and inspect exact CI. Preserve the final 90-minute reserve from 14:16:17 UTC.

docs/media/commons-saved-agents-unavailable-2026-10-19.png

@@ -0,0 +1,100 @@
+import {
+  useCallback,
+  useEffect,
+  useLayoutEffect,
+  useRef,
+  useState,
+} from "react";
+import { request } from "../api.mjs";
+
+// Saved configuration discovery never starts an author or submits a task.
+export function useCommonsAgents(owner) {
+  const [state, setState] = useState({
+    owner: null,
+    items: [],
+    known: false,
+    loading: false,
+    error: "",
+  });
+  const [revision, setRevision] = useState(0);
+  const origin = useRef(null);
+  const scoped = state.owner === owner;
+  const loading = Boolean(owner && (!scoped || state.loading));
+  const refresh = useCallback(
+    (trigger) => {
+      origin.current = { trigger, hash: location.hash, owner };
+      setState((old) => ({ ...old, loading: true, error: "" }));
+      setRevision((value) => value + 1);
+    },
+    [owner],
+  );
+  useEffect(() => {
+    if (!owner) {
+      setState({ owner, items: [], known: false, loading: false, error: "" });
+      return;
+    }
+    const controller = new AbortController();
+    setState((old) => ({
+      owner,
+      items: old.owner === owner ? old.items : [],
+      known: old.owner === owner && old.known,
+      loading: true,
+      error: "",
+    }));
+    void request("account/agents", { signal: controller.signal })
+      .then((value) => {
+        if (
+          !Array.isArray(value?.agents) ||
+          value.agents.some(
+            (agent) =>
+              !agent ||
+              ["id", "name", "provider", "model"].some(
+                (field) =>
+                  typeof agent[field] !== "string" || !agent[field].trim(),
+              ) ||
+              !Number.isSafeInteger(agent.version) ||
+              agent.version < 1,
+          ) ||
+          new Set(value.agents.map((agent) => agent.id)).size !==
+            value.agents.length
+        )
+          throw new Error(
+            "The service returned invalid saved agents. Refresh saved agents to try again.",
+          );
+        if (!controller.signal.aborted)
+          setState({
+            owner,
+            items: value.agents,
+            known: true,
+            loading: false,
+            error: "",
+          });
+      })
+      .catch((error) => {
+        if (!controller.signal.aborted)
+          setState((old) => ({ ...old, loading: false, error: error.message }));
+      });
+    return () => controller.abort();
+  }, [owner, revision]);
+  useLayoutEffect(() => {
+    if (loading) return;
+    const entry = origin.current;
+    origin.current = null;
+    if (
+      entry &&
+      entry.owner === owner &&
+      entry.hash === location.hash &&
+      entry.trigger?.isConnected &&
+      (document.activeElement === document.body ||
+        document.activeElement === entry.trigger)
+    )
+      entry.trigger.focus({ preventScroll: true });
+  }, [loading, state, owner]);
+  return {
+    agents: scoped ? state.items : [],
+    known: Boolean(owner && scoped && state.known),
+    loading,
+    error: scoped ? state.error : "",
+    refresh,
+  };
+}