Handle unavailable remote sessions gracefully

[damienrj]

Summary

Show a friendly, read-only notice when a remote session no longer exists, instead of displaying the raw Session not found error.

• Preserve messages already in the in-memory cache; handle an empty cache too.
• Keep failed host connections on the existing reconnect path.
• Block sending and queue dispatch to a known missing session. Users can start a new chat with the existing controls.

No durable history, restoration, native storage changes, or Goose API changes. Cached messages are not guaranteed to survive restarting Berd.

Validation

• just check, just tauri-check, and just clippy
• Full unit suite: 7,703 passed, 1 skipped
• Final focused load/composer/view tests: 122 passed
• Browser check of the production notice in English and Spanish at 360px and 800px; English screenshot visually checked

Follows LAWS/CHAT.md: missing sessions cannot dispatch queued prompts, and prompts are not moved to another chat.

Screenshot

Updated English notice screenshot is ready for upload. The image below belongs to the superseded proposal, not the current UI.

Previous proposal — retained for reference

[morgmart]

🤖 Automated code review

REQUEST_CHANGES: two blocking correctness and lifecycle issues must be resolved. Restores currently report success and unlock the chat even when the replacement session fails to hydrate, and removing a remote chat does not remove the newly persisted local transcript/export. Three non-blocking UX issues remain around localized restore errors, narrow-width layout, and presenting a persistent read-only state as agent activity. Supplied GitHub evidence was inspected; checks are pending with no reported check runs, so required checks still govern merge readiness.

Deterministic publication result: 2 blocking and 3 non-blocking inline finding(s) publishable; 0 duplicate(s) suppressed; 0 blocking screenshot-evidence requirement(s) in this review body.

[morgmart]

🤖 Automated code review

REQUEST_CHANGES: two new blocking lifecycle issues remain. Retrying or concurrently restoring a snapshot can create multiple replacement sessions, and global pruning can silently remove recovery data for chats that Berd still retains. Three non-blocking implementation issues remain in persisted-message validation, responsive container scoping, and accessible loading feedback. The five prior review findings were inspected and are fixed at this head, so none are repeated. Supplied GitHub evidence was inspected; combined status is pending, so required checks still govern merge readiness.

Deterministic publication result: 2 blocking and 3 non-blocking inline finding(s) publishable; 0 duplicate(s) suppressed; 0 blocking screenshot-evidence requirement(s) in this review body.

[morgmart]

🤖 Automated code review

REQUEST_CHANGES: two new blocking cross-window lifecycle issues remain. An interrupted or never-completing restore can strand backend ownership until the app restarts, and a delayed checkpoint from another window can recreate history after permanent deletion. One non-blocking design-system issue remains on the recovery banner. All ten prior review threads were inspected, have substantive human replies, and their underlying issues are fixed at this head; these new lifecycle findings are genuinely different cross-window cases. Supplied GitHub evidence was inspected; combined status is pending, so required checks still govern merge readiness.

Deterministic publication result: 2 blocking and 1 non-blocking inline finding(s) publishable; 0 duplicate(s) suppressed; 0 blocking screenshot-evidence requirement(s) in this review body.

[morgmart]

🤖 Automated code review

COMMENT: one new non-blocking accessibility finding remains. The still-valid restore-ownership blocker is suppressed because its existing unresolved thread has a substantive human reply and is recorded in duplicate_audit. The other twelve prior issues were inspected and are fixed at this head. Two product/architecture decisions remain escalated. Supplied GitHub evidence was inspected; combined status is pending, so required checks still govern merge readiness.

Deterministic publication result: 0 blocking and 1 non-blocking inline finding(s) publishable; 1 duplicate(s) suppressed; 0 blocking screenshot-evidence requirement(s) in this review body.

[morgmart]

🤖 Automated code review

REQUEST_CHANGES: two new blocking lifecycle issues remain. Permanent deletion can wait forever behind a stalled checkpoint before creating its tombstone, and restore's forced hydration can join an ordinary cache-hit load and report success without verifying the replacement against the remote backend. One non-blocking design-system finding remains because the recovery banner hand-builds a shared alert pattern. All fourteen prior threads were inspected and their underlying issues are fixed at this head. Supplied GitHub evidence was inspected; combined status is pending, so required checks still govern merge readiness.

Deterministic publication result: 2 blocking and 1 non-blocking inline finding(s) publishable; 0 duplicate(s) suppressed; 0 blocking screenshot-evidence requirement(s) in this review body.

[morgmart]

🤖 Automated code review

REQUEST_CHANGES: one new blocking cross-window lifecycle race remains. If another window permanently deletes the source chat after an import returns but before its replacement is journaled, the imported remote session is left invisible and unrecoverable. All seventeen prior threads were inspected and their underlying issues are fixed at this head. Supplied GitHub evidence was inspected; combined status is pending, so required checks still govern merge readiness.

Deterministic publication result: 1 blocking and 0 non-blocking inline finding(s) publishable; 0 duplicate(s) suppressed; 0 blocking screenshot-evidence requirement(s) in this review body.

[morgmart]

🤖 Automated code review

REQUEST_CHANGES: one new blocking cross-window ordering issue remains because an older checkpoint can overwrite a newer saved conversation. One non-blocking UX regression remains because raw connection errors can expand the composer footer without limit. All eighteen prior threads were inspected and their underlying issues are fixed at this head. Supplied GitHub evidence was inspected; combined status is pending, so required checks still govern merge readiness.

Deterministic publication result: 1 blocking and 1 non-blocking inline finding(s) publishable; 0 duplicate(s) suppressed; 0 blocking screenshot-evidence requirement(s) in this review body.

[morgmart]

🤖 Automated code review

COMMENT: no new publishable findings remain. The still-current stale cross-window checkpoint issue is suppressed because its existing unresolved thread contains a substantive human reply and is recorded in duplicate_audit. All other prior findings were inspected and are fixed at this head. The remaining checkpoint-ownership decision is escalated, so approval is blocked despite zero publishable findings. Supplied GitHub evidence was inspected; combined status is pending, so required checks still govern merge readiness.

Deterministic publication result: 0 blocking and 0 non-blocking inline finding(s) publishable; 1 duplicate(s) suppressed; 0 blocking screenshot-evidence requirement(s) in this review body.

[morgmart]

🤖 Automated code review

COMMENT: no new publishable findings remain. All twenty prior threads were inspected and their underlying implementation issues are fixed at this head. The recovery flow still has a permanently unknown restore state without a terminal resolution path, which is escalated as a product decision rather than reported as a defect. Supplied GitHub evidence was inspected; combined status is pending, so required checks still govern merge readiness.

Deterministic publication result: 0 blocking and 0 non-blocking inline finding(s) publishable; 0 duplicate(s) suppressed; 0 blocking screenshot-evidence requirement(s) in this review body.

[damienrj]

🤖 Addressed the terminal-state concern from review 5148457199 in 7998d4a, following Damien’s product decision. Unknown restores now offer Keep as local history (durable, read-only, no silent reconnection) and Continue in a new copy (explicit confirmation that an earlier remote copy may exist). Both decisions atomically rotate restore ownership, rejecting stale confirmations and late replies. Continuation does not auto-send queued prompts; users must remove them before unlocking the copy. No Goose API change or automatic re-import was added. Validation: 7,768 unit tests passed (1 skipped), 174 final integration tests, 17 native recovery tests, 3 browser checks, frontend checks, Tauri checks, and Clippy. The earlier navigation-test timeout passed on rerun and the final full suite passed. Existing uploaded screenshot preserved; new component/confirmation screenshots captured locally. The recurring monitor remains paused as requested.

[morgmart]

🤖 Automated code review

REQUEST_CHANGES: one new blocking lifecycle issue remains because the shared session-removal path deletes the recovery snapshot even when export or fork merely discovers that a remote session is missing. One non-blocking action-hierarchy issue remains in the unknown-outcome recovery banner. All twenty prior threads were inspected and their underlying issues are fixed at this head. Supplied GitHub evidence was inspected; combined status is pending, so required checks still govern merge readiness.

Deterministic publication result: 1 blocking and 1 non-blocking inline finding(s) publishable; 0 duplicate(s) suppressed; 0 blocking screenshot-evidence requirement(s) in this review body.

[damienrj]

[morgmart]

🤖 Automated code review

REQUEST_CHANGES: two new blocking trust and lifecycle issues remain. Loading deliberately kept local-only history reports session readiness and can release queued prompts toward the obsolete remote session, while snapshot projection filters audience restrictions only for text and images and can expose model-only non-text blocks. All twenty-two prior threads were inspected and their underlying issues are fixed at this head. Supplied GitHub evidence was inspected; combined status is pending, so required checks still govern merge readiness.

Deterministic publication result: 2 blocking and 0 non-blocking inline finding(s) publishable; 0 duplicate(s) suppressed; 0 blocking screenshot-evidence requirement(s) in this review body.

[morgmart]

🤖 Automated code review

REQUEST_CHANGES: three new blocking lifecycle and trust issues remain. Failed tool results can retain model-only nested content in local recovery history; a timed-out keep-history action can complete later and change state after reporting failure; and a timed-out import rejected after the recovery outcome changes can leave an orphaned remote session. All twenty-four prior threads were inspected and their underlying issues are fixed at this head. Supplied GitHub evidence was inspected; combined status is pending, so required checks still govern merge readiness.

Deterministic publication result: 3 blocking and 0 non-blocking inline finding(s) publishable; 0 duplicate(s) suppressed; 0 blocking screenshot-evidence requirement(s) in this review body.

[morgmart]

🤖 Automated code review

REQUEST_CHANGES: one new blocking persistence interruption issue remains because restore finalizes the replacement snapshot before separately retiring the source journal, allowing private source history to become orphaned after a crash. One non-blocking accessibility issue remains because the new-copy confirmation has no progress label or busy announcement during a potentially minute-long restore. All twenty-seven prior threads were inspected and their underlying issues are fixed at this head. Supplied GitHub evidence was inspected; combined status is pending, so required checks still govern merge readiness.

Deterministic publication result: 1 blocking and 1 non-blocking inline finding(s) publishable; 0 duplicate(s) suppressed; 0 blocking screenshot-evidence requirement(s) in this review body.

[morgmart]

🤖 Automated code review

COMMENT: one new non-blocking accessibility and state-feedback finding remains because every recovery choice drives loading feedback on Check restore status rather than on the action the person selected. All twenty-nine prior threads were inspected and their underlying issues are fixed at this head. The durable local-storage boundary remains an explicit product decision. Supplied GitHub evidence was inspected; combined status is pending, so required checks still govern merge readiness.

Deterministic publication result: 0 blocking and 1 non-blocking inline finding(s) publishable; 0 duplicate(s) suppressed; 0 blocking screenshot-evidence requirement(s) in this review body.

[morgmart]

🤖 Automated code review

COMMENT: one new non-blocking action-hierarchy finding remains because the normal read-only recovery state's sole path back to an active chat is styled as a secondary action. All thirty prior threads were inspected and their underlying issues are fixed at this head. The durable local-storage boundary remains an explicit product decision. Supplied GitHub evidence was inspected; combined status is pending, so required checks still govern merge readiness.

Deterministic publication result: 0 blocking and 1 non-blocking inline finding(s) publishable; 0 duplicate(s) suppressed; 0 blocking screenshot-evidence requirement(s) in this review body.

[morgmart]

🤖 Automated code review

REQUEST_CHANGES: two new blocking state and deletion-race issues remain. Read-only state and the recovery banner derive from different session snapshots during replacement, and deletion after import journaling but before replacement publication can retain the imported remote copy. One non-blocking intermediate-width layout risk also remains. All thirty-one prior threads were inspected and their underlying issues are fixed at this head. Supplied GitHub evidence was inspected; combined status is pending, so required checks still govern merge readiness.

Deterministic publication result: 2 blocking and 1 non-blocking inline finding(s) publishable; 0 duplicate(s) suppressed; 0 blocking screenshot-evidence requirement(s) in this review body.

[morgmart]

🤖 Automated code review

REQUEST_CHANGES: two new blocking lifecycle and durability issues remain. Rejected-import cleanup can erase its local identity even when deletion of the remote copy fails, and crash durability is incomplete because atomic filesystem changes sync files but not the containing directory. All thirty-four prior threads were inspected and their underlying issues are fixed at this head. Supplied GitHub evidence was inspected; combined status is pending, so required checks still govern merge readiness.

Deterministic publication result: 2 blocking and 0 non-blocking inline finding(s) publishable; 0 duplicate(s) suppressed; 0 blocking screenshot-evidence requirement(s) in this review body.

[morgmart]

🤖 Automated code review

REQUEST_CHANGES: one new blocking cleanup-liveness issue remains because one malformed cleanup journal makes listing fail before valid pending cleanup identities are returned. All thirty-six prior threads were inspected and their underlying issues are fixed at this head. The durable local-storage boundary remains an explicit product and architecture decision. Supplied GitHub evidence was inspected; combined status is pending, so required checks still govern merge readiness.

Deterministic publication result: 1 blocking and 0 non-blocking inline finding(s) publishable; 0 duplicate(s) suppressed; 0 blocking screenshot-evidence requirement(s) in this review body.

[morgmart]

🤖 Automated code review

REQUEST_CHANGES: two new blocking lifecycle issues remain. Cleanup retries are serialized without a timeout so one remote deletion can prevent every later journal from being attempted, and permanent tombstones assume remote session IDs are globally never reused across datastore resets. All thirty-seven prior threads were inspected and their underlying issues are fixed at this head. Supplied GitHub evidence was inspected; combined status is pending, so required checks still govern merge readiness.

Deterministic publication result: 2 blocking and 0 non-blocking inline finding(s) publishable; 0 duplicate(s) suppressed; 0 blocking screenshot-evidence requirement(s) in this review body.

[morgmart]

🤖 Automated code review

COMMENT: no new publishable findings remain. The only current defect—permanent tombstones outliving reusable host-plus-ACP session identity—is suppressed because it is already tracked in an unresolved thread with a substantive human reply confirming it remains pending the upstream identity contract. The durable local-storage and stable-identity boundaries require Morgan's decision. All thirty-nine threads and supplied GitHub evidence were inspected; combined status is pending, so required checks still govern merge readiness.

Deterministic publication result: 0 blocking and 0 non-blocking inline finding(s) publishable; 1 duplicate(s) suppressed; 0 blocking screenshot-evidence requirement(s) in this review body.

[morgmart]

🤖 Automated code review

REQUEST_CHANGES: one new blocking state-consistency issue remains because ChatView availability and composer admission can derive from different session snapshots during replacement or reconciliation. One non-blocking copy issue remains because the notice describes messages as cached without explaining that they may disappear after restart. All thirty-nine prior threads were inspected and their underlying issues are resolved or removed in the reduced scope. Supplied GitHub evidence was inspected; combined status is pending, so required checks still govern merge readiness.

Deterministic publication result: 1 blocking and 1 non-blocking inline finding(s) publishable; 0 duplicate(s) suppressed; 0 blocking screenshot-evidence requirement(s) in this review body.

[morgmart]

🤖 Automated code review

REQUEST_CHANGES: one new blocking identity-consistency issue remains because the security confirmation surface registers the selected replacement session while its panel still reads the originally requested session. All forty-one prior threads were inspected and their underlying issues are fixed or removed in this reduced scope. Meaningful graphical UI changed, but the supplied attachments are explicitly superseded and do not provide current visual evidence, so screenshots or a short screen recording are required. Supplied GitHub check evidence was inspected; combined status is pending, so required checks still govern merge readiness.

Deterministic publication result: 1 blocking and 0 non-blocking inline finding(s) publishable; 0 duplicate(s) suppressed; 1 blocking screenshot-evidence requirement(s) in this review body.

🤖 Blocking · Screenshots needed

This PR changes Berd’s graphical interface. Please add screenshots or a short screen recording so the visual result can be reviewed. Screenshots are review evidence; they do not replace accessibility, responsive, theme, localization, or behavior validation.

[damienrj]

updated the screenshot

[morgmart]

🤖 Automated code review

COMMENT: one new non-blocking localization and accessibility finding remains because the unavailable-state title inherits a one-line clamp and can hide longer translations or enlarged text. All forty-two prior threads were inspected and their underlying issues are fixed or removed in this reduced scope. Supplied GitHub evidence was inspected and current screenshots are present; combined status is pending, so required checks still govern merge readiness.

Deterministic publication result: 0 blocking and 1 non-blocking inline finding(s) publishable; 0 duplicate(s) suppressed; 0 blocking screenshot-evidence requirement(s) in this review body.

[damienrj]

🤖 All review threads are resolved on dca849a, and the full required check suite is now green across frontend, macOS, Linux, Windows, security, smoke, and transcript-virtualization checks. This is ready for re-review and approval.

[morgmart]

🤖 Automated code review

APPROVE: no new publishable findings remain. The reduced change consistently models missing remote sessions as transient read-only state, preserves available context, blocks composer and queued dispatch, and clearly communicates the temporary lifecycle. All forty-three prior threads were inspected and their underlying issues are fixed or removed. Supplied GitHub evidence and current screenshots were inspected; combined status is pending, so required checks still govern merge readiness.

Deterministic publication result: 0 blocking and 0 non-blocking inline finding(s) publishable; 0 duplicate(s) suppressed; 0 blocking screenshot-evidence requirement(s) in this review body.

Pending checks: 1 check(s) are not complete.

This approval reflects the completed code review only; merge readiness remains governed by the repository's required checks.