[sambitcreate]

Requested by sbt · project thread

Stacked on #643 (deleted workspace folder notice). Item 5, part a (Mac), of the upstream-changes plan. The phone part (New worktree on the new-chat screen) comes in a separate PR.

What changes

When a chat's managed worktree folder is deleted outside Aiden, the chat used to fail every send with "The managed worktree is no longer available to Aiden." Now it is checked like any other workspace folder: the send is refused before it is added (your text stays), and the notice above the composer offers what the owner chose:

• Restore worktree: checks the same branch out again at the same managed path. Offered only while the branch still exists, no other worktree has it checked out, no Aiden removal of it is pending, and the folder it lived in is still there. Commits survive; uncommitted changes went with the folder.
• New chat in main checkout: opens a draft in the repository's main workspace in checkout mode with the unsent message. The old chat stays as it is.
• Check again stays: putting a folder back from the Trash is the only way to keep uncommitted work, and the notice says so.

Phones and paired Macs get a path-free workspace_unavailable refusal: "This chat's worktree folder was deleted on your Mac. Restore it from the chat on your Mac, then send again." No protocol revision (the code and the client handling already exist since #643).

A chat with No workspace (from #667) is left out of the folder check, as on main: its hidden folder is made again when the chat next runs.

How Restore stays safe

restoreDeletedManagedWorktreeCheckout (main/services/git.ts) runs inside the repository's mutation queue and:

1. verifies the target is inside the managed root and absent;
2. refuses while a removal journal for this worktree is pending (its files may be in quarantine);
3. verifies the old ownership token in Git's admin dir (a foreign token refuses);
4. refuses a moved registration, a branch checked out elsewhere, or a branch that is gone;
5. clears only Git's stale record, never with git worktree remove: a locked record is refused, otherwise the record's admin directory is moved out of .git/worktrees/ and put back if the new checkout fails or a folder reappears, then deleted once the new checkout exists;
6. runs worktree add with hooks disabled, verifies it, writes a new ownership token, and saves the workspace record through a callback while the lock is held. If any step after worktree add fails, the save included, the new checkout is taken back out through the same quarantine-and-recheck removal Aiden uses for managed worktrees, so Restore can be retried. If anything was written into it meanwhile, or the removal can't finish, the folder is kept (or put back into its own place) and the error says so.

It never creates, moves or deletes a branch. The application service takes the workspace mutation gate before any await, refuses No Access workspaces, then re-provisions .worktreeinclude files (errors only logged).

Tests

• managed-worktree-lifecycle.test.ts: restore keeps commits, gets a new identity and leaves no prunable record; a failed save rolls the checkout back with the branch kept, then a retry succeeds; refusals for a present folder, a deleted branch, a branch taken by another worktree, and a foreign token; a failed restore never deletes a file written while it was undoing itself, puts the folder back when a late write stops its removal, and keeps its removal record when something else took the folder's place.
• workspace-folder-presence.test.ts: managed worktrees checked at the checkout root (no path in the message), the remote refusal, No workspace chats left out and their folder made again, missingWorktreeOptions (restorable, pending removal, missing parent, No Access, no token, main workspace pick including through a symlink, Git error).
• aiden-remote-chats.test.ts: refusal message passes through.
• e2e tests/e2e/worktree-folder-deleted.spec.ts: create a New worktree chat, delete its folder, the notice appears with Check again; New chat in main checkout carries the text in checkout mode; Restore brings the folder back on its branch and the send goes through.

Locally: type-check and eslint clean; the suites above pass. Eight managed-worktree tests fail in the cloud container on the base branch too (container-specific, unchanged by this PR).

Flake notes (hosted CI):

• iOS: AidenMessageVisualSnapshotLayoutTests.testVisualSnapshotKeepsItsHeightAlongsideAnImageDeck failed on head 6b917d0 with "the snapshot was squeezed" (0 vs 269), in the same run as a "Simulator device failed to launch" error. This known flake also hit Let a Bot set bounded wake-ups for itself #636, and Fix the flaky iOS visual snapshot layout test #681 has since fixed it on main. Run: https://github.com/sambitcreate/aiden-agent/actions/runs/40938909612/job/123677237158. The failed job was re-run once.
• Desktop tests (runtime-subagents): main/services/mcp-failure-diagnostics.test.ts "recorded events never contain URLs, paths, tokens, client secrets or stdio arguments" failed on head 537d201 with 8443 leaked. Nothing leaked: the event's per-run salted serverRef hash was c76b4b6844349fbe, which happens to contain the test's port digits. That's a test bug on main, and this PR doesn't touch MCP diagnostics. Run: https://github.com/sambitcreate/aiden-agent/actions/runs/41176004526/job/124463642431. The failed job is re-run once.
• Desktop tests (core-git): main/shared/process-group.test.ts "termination keeps escalating after the leader closes until a SIGTERM-ignoring descendant is gone" failed on head 8e11731 with true !== false (line 59). This PR doesn't touch process groups; the same macOS timing family also hit New worktree on the phone's new-chat screen (Remote rev 50, chat:new-worktree) #648. Run: https://github.com/sambitcreate/aiden-agent/actions/runs/41307272910/job/124850290989. Not re-run: 897a593 started a fresh run on a new head.

Known limits

• A crash in the few milliseconds between worktree add and the record save still leaves a checkout whose identity Aiden doesn't recognize (rollback covers thrown errors, not a killed process).
• New chat in main checkout carries the message text, not attachments.

Docs

README workspaces line, docs/plans/managed-worktree-lifecycle-plan.md (new section), docs/plans/README.md row, docs/aiden-on-the-go-remote-access.md troubleshooting, .memory/workspace-folder-presence.md.

https://claude.ai/code/session_018VA6RFZmgu9xAiKJ1wo2w2

---

Generated by Claude Code

[very-hermes-bot]

Hermes Review Bot

Confidence: 4

Engine: opencode/opencode-go/deepseek-v4.1-flash
Review mode: full
Head: c403264963b03fbdb6272d6539445d00f99238dd
Generated: 2026-11-01T13:40:58+00:00
Reviews: 1

Summary

This PR closes the gap where a chat whose Aiden-managed worktree folder was deleted outside Aiden failed every send with the generic managed-worktree admission error. It brings managed worktrees into the existing workspace-folder presence check (checkedWorkspaceFolder points the stat at the checkout root, workspaceFolderCheckApplies no longer excludes them), and extends the missing-folder notice with two actions: Restore worktree (a new workspaces:restoreDeletedWorktree → application service → restoreDeletedManagedWorktreeCheckout path that clears only Git's stale record, re-adds the branch with hooks disabled, verifies and re-tokens the new registration, and rolls the checkout back through the existing quarantine-and-remove machinery on any failure) and New chat in main checkout (a draft in the realpath-matched main workspace, in checkout mode, with the unsent text). Paired devices get a path-free workspace_unavailable refusal via a now message-returning option, so no protocol revision is needed and the existing code-based 409 settlement on iOS/Android still applies.

The restore path is the part to double-check on review: it deliberately never runs git worktree remove, re-checks for a folder put back from the Trash at three separate points, holds a placeholder over the old administrative name so Git picks a fresh one (I verified locally that git worktree add does pick fix1 and that git worktree list tolerates the leftover empty dir), and only deletes the set-aside record after the new checkout exists. The two documented residuals are real: a killed process between worktree add and the record save, and a "kept folder" whose saved identity (worktreeDevice/worktreeInode) no longer matches the workspace record — the latter is a deliberate, message-explained dead end that resolves once the folder is deleted and Restore is run again.

Confidence Score: 4/5

Traced the renderer refusal → IPC → application service → GitService mutation end-to-end, verified every call site of the renamed workspaceFolderMissing option and of the widened workspaceFolderCheckApplies, checked the iOS/Android 409 handling is code-based, and confirmed the Git name-collision mechanism with a local probe; the two suites and the e2e could not be run here, so their green status is unverified.

📁 Important Files Changed

• main/services/git.ts — the core of the change: restoreDeletedManagedWorktreeCheckout plus helpers (setAsideWorktreeRecord, returnSetAsideRestore, settleKeptRestoreRecord, moveKeptRecordToRecordedName). Deserves the closest read; it is the only place that mutates Git state.
• main/services/workspace-folder-presence.ts — checkedWorkspaceFolder, worktree-aware workspaceFolderMissingText/workspaceFolderRemoteRefusal, and missingWorktreeOptions (the Restore/main-checkout eligibility the notice renders).
• renderer/shared/workspace-folder-presence.ts — shared messages plus workspaceFolderCheckApplies no longer excluding managed worktrees; this is the one behavioral change with blast radius into main's generation, scheduled-task and terminal paths.
• main/services/workspace-worktree-application-service.ts — restoreDeleted: mutation gate, permission refusal, .worktreeinclude re-provisioning after the same capacity check creation uses, and the in-lock workspace save.
• main/handlers/workspaces.ts — folderPresence now computes worktree options; new workspaces:restoreDeletedWorktree handler mirroring the sibling snapshot-restore handler.
• renderer/main/chat-pane.tsx, renderer/components/workspace-folder-missing-notice.tsx, renderer/lib/new-chat-actions.tsx, renderer/main/root-view.tsx — the two notice actions, the worktree-specific send refusal, and openNewChatIn's new initialText/gitMode options.
• main/services/aiden-remote-chats.ts, aiden-remote-service-main.ts — option renamed from a boolean to a message-returning refusal; no protocol change.
• Tests/docs — managed-worktree-lifecycle.test.ts (11 new restore scenarios), workspace-folder-presence.test.ts, workspace-worktree-application-service.test.ts, tests/e2e/worktree-folder-deleted.spec.ts, plus README/plan/remote-access/project-memory updates that match the implementation.

Findings

No findings.

📊 Sequence Diagram

sequenceDiagram
  participant R as ChatPane (renderer)
  participant H as workspaces handler
  participant A as WorktreeApplicationService
  participant G as GitService
  participant C as configStore

  R->>H: workspaces:folderPresence(workspaceId)
  H->>H: workspaceFolderPresence(checkout root)
  H->>H: missingWorktreeOptions(branch head, worktrees, deletion journal, parent)
  H-->>R: { presence: "missing", worktree: { restorable, mainWorkspaceId } }
  R->>H: workspaces:restoreDeletedWorktree(workspaceId)
  H->>A: restoreDeleted(owner, id)
  A->>A: beginWorkspaceMutation(id) (before any await)
  A->>G: restoreDeletedManagedWorktreeCheckout(...)
  G->>G: enqueueMutation → verify target, token, branch, room
  G->>G: move stale record aside, hold placeholder, git worktree add (hooks off)
  G->>G: verify registration, write new token
  G->>C: commit(restored) — save workspace inside the lock
  G-->>A: restored checkout
  A->>A: checkCreateCapacity, re-provision .worktreeinclude (errors logged)
  A-->>R: saved workspace → invalidate workspaces + presence, toast

Loading

Machine-Readable Findings

[]

---

Last reviewed commit: c403264963b0
Reviews (1) · Comment /hermes review to trigger a new review · /hermes review full for full re-review

[pullfrog]

Important

Two restore-path issues need attention before merging: interrupted identity persistence can strand the chat, and checkout admission is bypassed.

Reviewed changes — Reviewed all 22 changed files in the initial commit, including Git recovery, workspace persistence, desktop draft navigation, and remote refusals.

• Deleted worktree recovery: Recreates the recorded checkout on its surviving branch, refreshes ownership identity, and provisions included files.
• Missing-folder handling: Includes managed checkout roots in send checks and returns a path-free refusal to paired clients.
• Composer actions: Offers Restore or a new chat in the main checkout with the unsent text and explicit checkout mode.
• Coverage and documentation: Adds lifecycle, presence, and Electron coverage and updates workspace recovery guidance.

Validation: desktop and E2E type checks passed; the new Electron test collects; all 82 remote-chat tests passed. The lifecycle/presence run passed 36 tests, including the new restore cases; five lifecycle tests and three application-service tests failed because build/native/aiden-worktree-file-io is unavailable on Linux. Electron execution requires macOS. Both findings were reproduced with temporary probes using the real Git service.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[pullfrog]

Caution

The new rollback can permanently delete externally written edits when workspace persistence fails.

Reviewed changes since the prior review at 807afac09, focusing on the recovery and eligibility changes in f8302cdaf.

• Moved identity persistence: Saved the restored workspace through a callback inside the Git mutation lock and added rollback for failures after checkout creation.
• Tightened restore eligibility: Checked pending removal journals, parent-folder availability, ownership fields, and workspace permissions, and acquired the workspace mutation gate before asynchronous work.
• Changed stale-registration cleanup: Tried plain worktree remove before an absence-checked forced fallback.
• Improved recovery navigation: Matched main-checkout workspaces through symlinks, retained Check again, and explained Trash recovery for uncommitted changes.
• Extended tests and guidance: Covered failed-save rollback/retry and the additional eligibility cases, and updated recovery documentation.

Validation passed: desktop and E2E type checks, nine folder-presence tests, two focused real-Git lifecycle tests, and seven workspace environment/mutation tests. Playwright collected the recovery scenario; Electron execution requires macOS and was not run on this Linux runner. A separate real-Git probe reproduced the data loss described inline.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[pullfrog]

Caution

The revised rollback can still delete an ignored file written after its status check. The checkout-admission fix passes its focused test.

Reviewed changes since the prior review at f8302cdaf, covering the new restore safeguards and their integration after the base-branch merge.

• Added checkout admission: Validated the current branch's checkout transformations and disk capacity before clearing the stale registration.
• Revised failed-restore cleanup: Checked directory identity and uncommitted, untracked, and ignored content, then used nonforced removal for a clean checkout.
• Extended lifecycle coverage: Tested preservation of an external write during the save callback and refusal of a branch that acquired checkout filters.
• Integrated base changes: Retained the chat-visit send guard and updated missing-folder/refusal documentation.

Validation: desktop TypeScript, all four focused deleted-worktree lifecycle tests, and all nine folder-presence tests passed. A separate real-Git probe reproduced the ignored-file loss described inline. Electron execution was not run on Linux.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[pullfrog]

Important

The new cleanup preserves late-written content, but can leave it in hidden quarantine with no working Restore/recovery path.

Reviewed changes since the prior review at 11db1df, focusing on df28162.

• Replaced rollback removal: Routed failed-restore cleanup through the identity-bound quarantine helper with the strict safe deletion policy, preserving the existing branch.
• Retained unverified checkouts: Kept the folder when its identity changed or the replacement ownership token was not successfully saved.
• Extended coverage and memory: Added an ignored-file timing test and documented the revised rollback behavior.

Validation: desktop TypeScript, all five focused lifecycle tests, and all nine folder-presence tests passed after building the native remover. A separate real-Git/native-helper probe reproduced the recovery issue inline. Electron execution was not run on Linux.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[pullfrog]

Important

The new put-back helper can discard the recovery journal while the actual checkout remains hidden in quarantine if another process recreates its original pathname.

Reviewed changes since the prior review at df28162, focusing on the recovery changes in 75fdd7e.

• Added quarantine return: Returned the checkout and Git administrative directory after failed rollback removal, then removed the journal when both were considered restored.
• Extended lifecycle coverage: Added a successful late-write rejection scenario and documented the put-back behavior.

Validation: desktop TypeScript, all six focused deleted-worktree lifecycle tests, and all nine folder-presence tests passed. A separate real-Git/native-helper probe confirmed that the previously reported uncontended late-write case is fixed and reproduced the pathname-collision issue inline. Electron execution was not run on Linux.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes since the prior review at 75fdd7e, focusing on the recovery safeguards in 6b917d0.

• Tightened put-back checks: Rejected occupied destinations and ambiguous set-aside paths, and verified checkout identity when nothing remains set aside.
• Preserved collision recovery state: Left the Git record quarantined and retained the journal when the checkout could not return safely.
• Extended behavioral coverage: Added a pathname-collision test that verifies preservation of the new occupant, quarantined work, and removal record.

Validation passed: desktop TypeScript, seven focused deleted-worktree lifecycle tests, and nine folder-presence tests. A separate real-Git/native-helper probe confirmed both ordinary late-write recovery and collision preservation, including the quarantined Git record and pending journal. Electron execution was not run on Linux.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[sambitcreate]

"iOS build and simulator tests" failed on 6b917d0 in one test: AidenMessageVisualSnapshotLayoutTests.testVisualSnapshotKeepsItsHeightAlongsideAnImageDeck ("the snapshot was squeezed", 0 vs 269). In the same run the simulator also failed to launch the app. This is a known flaky test (it hit #636 the same way), and this PR adds no iOS code beyond its base #643, which passed. I'll re-run the failed job once when the rest of the run finishes, and the flake is recorded in the PR description.

---

Generated by Claude Code

[pullfrog]

✅ No new issues found.

Reviewed changes since the prior review at 6b917d0, focusing on the folder-presence integration in merge commit 537d201.

• Preserved managed-worktree checks: Kept missing-checkout detection at the checkout root and retained the worktree-specific recovery notice and remote refusal.
• Integrated No workspace handling: Exempted hidden No workspace folders from missing-folder checks while retaining their recreation before generation; ordinary project folders remain protected from automatic recreation.
• Reconciled behavioral coverage: Retained tests for both managed-worktree recovery eligibility and No workspace folder exemption/recreation.

Validation passed: desktop TypeScript and all 92 folder-presence/remote-chat tests. All prior Pullfrog threads are already resolved. Electron execution was not run on Linux; hosted CI for this head is still pending.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[sambitcreate]

Flake in Desktop tests (runtime-subagents) on 537d201: main/services/mcp-failure-diagnostics.test.ts "recorded events never contain URLs, paths, tokens, client secrets or stdio arguments" failed with 8443 leaked. Nothing leaked. The event's serverRef is a hash salted per run, and this time it was c76b4b6844349fbe, which happens to contain the test's port 8443. That's a test bug on main: it substring-checks the port digits against random hex. This PR doesn't touch MCP diagnostics. Run: https://github.com/sambitcreate/aiden-agent/actions/runs/41176004526/job/124463642431. I'll re-run the failed job once when the run finishes. Fixing the oracle (for example, leaving the hash fields out of the check) is a small follow-up outside this PR.

---

Generated by Claude Code

[pullfrog]

✅ No new issues found.

Reviewed changes since the prior review at 537d201, focusing on the integration with main in merge commit 2adbc33.

• Preserved refusal ordering: Kept the worktree-specific missing-folder refusal before attachment reservation and message append in the updated remote-turn path.
• Integrated workspace watching: Retained main's shared Git watcher so workspace handlers and removal services use the same instance.
• Reconciled composer and documentation changes: Preserved draft-text recovery imports and the worktree recovery guidance alongside main's updated server documentation.

Validation passed: npm run type-check and all 98 remote-chat, folder-presence, and Git watcher tests. All prior Pullfrog threads remain resolved. Electron and native mobile suites were not run on Linux; hosted CI for this exact head is still pending.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[very-hermes-bot]

Inline review — 2 finding(s) anchored to the diff. See the pinned summary comment for the overview.

[pullfrog]

✅ No new issues found.

Reviewed changes since the prior Pullfrog review at 2adbc33, focusing on the restore safeguards and behavioral coverage in 6041786.

• Added a pre-removal folder check: Rechecked the registered and canonical checkout paths after size and capacity admission, refusing to remove a folder returned from the Trash during those checks.
• Strengthened ignored-file coverage: Wrote the late backup into the actual quarantined checkout and unconditionally verified that its contents survived at the original worktree path.
• Added Trash-return coverage: Exercised a folder returned during checkout measurement and verified that Restore refused while preserving its ignored .env file.

Validation passed: desktop TypeScript, ESLint on both changed files, all eight focused deleted-worktree lifecycle tests using the compiled native remover, and all ten folder-presence tests. All prior Pullfrog threads are already resolved. Electron execution was not run on Linux; hosted CI for this exact head is still pending.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[very-hermes-bot]

Inline review — 3 finding(s) anchored to the diff. See the pinned summary comment for the overview.

[pullfrog]

✅ No new issues found.

Reviewed changes since the prior Pullfrog review at 6041786, covering the recovery and provisioning changes in 21a4236.

• Replaced stale-registration removal: Renamed Git metadata aside without touching the checkout folder, refused locked records, and returned the registration when a folder reappeared from the Trash.
• Reconciled retained-checkout ownership: Restored the recorded ownership identity after failed recovery so deleting the retained folder and choosing Restore again works.
• Added provisioning admission and coverage: Checked capacity before optional .worktreeinclude copies, retained successful checkout recovery when copies were skipped, and extended lifecycle tests and recovery documentation.

Validation: desktop TypeScript, ESLint, all nine focused deleted-worktree lifecycle tests, all ten folder-presence tests, and the new capacity-refusal test passed. The full application-service suite passed two tests and hit three existing Linux failures: one macOS-specific capacity expectation and two missing aiden-worktree-file-io helper failures (ENOENT). Electron execution was not run on Linux; hosted CI for this head is still pending.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[very-hermes-bot]

Inline review — 2 finding(s) anchored to the diff. See the pinned summary comment for the overview.

[pullfrog]

Important

A failure deleting the old Git metadata can now strand the restored chat before its ownership is persisted.

Reviewed changes since the prior Pullfrog review at 21a4236, focusing on the recovery changes in 7d49465.

• Retained the old Git record: Kept the set-aside registration until worktree add succeeds and returned it when checkout creation fails.
• Rejected missing nested folders: Verified that a nested workspace folder exists before saving the restored workspace, rolling the checkout back when the branch no longer contains it.
• Extended recovery coverage: Added behavioral tests for a Trash return immediately before checkout creation and a branch that dropped its workspace subfolder, and updated the lifecycle plan.

Validation passed: desktop TypeScript, ESLint on both changed TypeScript files, all 11 focused deleted-worktree lifecycle tests with the compiled native remover, and all ten folder-presence tests. A separate real-Git permission-failure probe reproduced the issue inline. All prior Pullfrog threads remain resolved. Electron execution was not run on Linux; hosted CI for this exact head is still pending.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes since the prior Pullfrog review at 7d49465, focusing on the cleanup-failure fix in 974fc4a.

• Made old-record deletion best effort: Allowed restore verification and ownership persistence to continue when deleting the discarded Git metadata fails; that metadata is already outside Git's worktree list.
• Added cleanup-failure coverage: Injected EACCES after checkout creation and verified that the new identity is recorded and the restored checkout passes managed-worktree admission.

Validation passed: desktop TypeScript, ESLint on both changed files, all 12 focused deleted-worktree lifecycle tests using the compiled native remover, and all ten folder-presence tests. The prior finding is addressed and its thread is already resolved. Electron execution was not run on Linux; hosted CI for this exact head is still pending.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[very-hermes-bot]

Inline review — 2 finding(s) anchored to the diff. See the pinned summary comment for the overview.

[pullfrog]

✅ No new issues found.

Reviewed changes since the previously reviewed e2603d5 checkpoint, focusing on the failed-Restore notice fix in 8e11731.

• Refreshed recovery state: Invalidated the affected workspace's folder-presence query after a failed Restore so the notice follows any folder returned or retained on disk.
• Corrected refusal copy: Removed the unsupported claim that a non-restorable branch must be deleted or checked out elsewhere.
• Extended recovery coverage: Added an E2E sequence that recreates the folder before Restore, checks that the refusal clears the notice, then deletes it again and completes recovery.

Validation passed: desktop and E2E TypeScript checks, ESLint on all three changed files, all ten folder-presence tests, and collection of the updated E2E scenario. Electron execution requires macOS and was not run on Linux. All prior Pullfrog threads remain resolved; hosted CI for this exact head was still pending when checked.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[very-hermes-bot]

Inline review — 2 finding(s) anchored to the diff. See the pinned summary comment for the overview.

[pullfrog]

✅ No new issues found.

Reviewed changes since the prior Pullfrog review at 8e11731, covering the recovery changes in 897a593 and the memory update in c403264.

• Reserved the old Git record name: Made successful Restore allocate fresh checkout metadata so an externally moved copy cannot share the replacement's index and HEAD.
• Preserved retained-folder recovery: Reconciled the fresh administrative name after failed restoration so the existing delete-and-retry recovery path remains available.
• Recovered queued message text: Used the first queued message when the composer draft is empty before opening a new chat in the main checkout.
• Clarified moved-folder guidance: Updated desktop and remote copy, recovery documentation, and project memory to cover moved folders as well as deleted ones.

Validation passed: desktop TypeScript, ESLint on all five changed TypeScript files, 13 focused restore lifecycle tests with the compiled native remover, and all 125 folder-presence, remote-chat, and message-queue tests. The chat-transition file passed its 35 assertions but did not terminate within the deadline on its isolated retry, so that suite is not counted as passed. Electron and native mobile execution were not run on Linux; exact-head hosted CI is still pending.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}