docs: expand memory issue coverage and retention evidence

2026-09-25 08:02:31 +00:00 · 2026-09-16 21:16:22 -07:00
parent 34b3c3213a
commit 4a09b1d108
25 changed files with 2409 additions and 176 deletions
@@ -0,0 +1,69 @@
+# Expanded issue search and relay version stranding
+
+The expanded title search adds `heap`, `RSS` and `swap` to the original six
+terms. One batched query returned 66 distinct open reports; all nine searches
+fit a complete first page below 100 results. The issue index keeps 67 catalog
+rows because previously matched #9141 is now closed. This is search coverage,
+not a claim that every memory-related issue uses those words in its title.
+
+Six newly indexed reports and all their available comments were read:
+
+| Issue                                                   | Result                                                                                                                                                                                                                                               |
+| ------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [#10382](https://github.com/stablyai/orca/issues/10382) | macOS renderer exit-code-5 with low last reported JS heap in one cohort. [Historical telemetry and recovery controls](../renderer-exit5-telemetry/README.md) explain the diagnostic limits and repeated reloads; no incident root cause established. |
+| [#13852](https://github.com/stablyai/orca/issues/13852) | A relay build change moves the endpoint and prevents cross-build attach. Existing discovery retains live old owners.                                                                                                                                 |
+| [#1355](https://github.com/stablyai/orca/issues/1355)   | Sidebar-side swap is a layout request.                                                                                                                                                                                                               |
+| [#11824](https://github.com/stablyai/orca/issues/11824) | WSL account profile swapping loses settings; configuration identity.                                                                                                                                                                                 |
+| [#13171](https://github.com/stablyai/orca/issues/13171) | App archive replacement invalidates lazy chunk reads. The issue's archive-crash reproduction was not independently rerun in this audit and does not establish retained memory.                                                                       |
+| [#16703](https://github.com/stablyai/orca/issues/16703) | Windows agent icons swap identity; status presentation.                                                                                                                                                                                              |
+
+## Why #13852 strands sessions
+
+`readLocalFullVersion` reads the relay's content-hashed build version.
+`computeRemoteRelayDir` puts that version into the install directory;
+`ssh-relay-deploy.ts` derives the endpoint from that directory.
+The current handshake separately rejects a different version. The existing
+cross-version isolation test explicitly asserts that deploying v2 never touches
+v1's directory or socket. These properties explain why an updated client cannot
+adopt old relay-backed terminals through the current attach route.
+
+The old relay can still own live PTYs. Current install GC preserves directories
+whose liveness probe is positive or inconclusive. Current superseded-endpoint
+discovery does not grant authority to kill a live owner merely because the new
+client cannot reattach. Remote terminal state stays `unverifiable` when the
+execution host cannot answer. The distinction prevents memory cleanup from
+destroying running remote work.
+
+A [field comment](https://github.com/stablyai/orca/issues/13852#issuecomment-5493610344)
+reports 11 version directories, 11 sockets and 19 relay processes with 839 MB
+combined RSS, oldest 6.7 days. These are the commenter's measurements; this audit
+did not access that host. The source explains stranded owners, but does not
+identify every reported process or independently measure those bytes.
+
+The [latest status comment](https://github.com/stablyai/orca/issues/13852#issuecomment-5523691997)
+correctly distinguishes documentation from a repair: #17972 records the boundary,
+while cross-version adoption is still absent. The cold-restore path can resume
+an agent only when suitable resumable session state was captured. Source alone
+does not identify which missing condition produced a particular bare shell.
+
+Moving an endpoint is not a safe isolated memory fix. Protocol compatibility,
+incumbent discovery and install-GC ownership must be designed together, including
+older installed relays and Windows pipe liveness markers. No relay shutdown,
+endpoint or wire behavior was changed in this audit follow-up.
+
+## Validation and limits
+
+Seven existing tests pass across cross-version deploy isolation and real local
+socket handshake round trips. They verify matching-version success, mismatched
+version refusal and credential handling. They create temporary local sockets;
+they do not connect to a user's host or launch an application window.
+
+```sh
+ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/ssh-relay-cross-version-isolation.test.ts src/relay/relay-handshake-roundtrip.test.ts
+```
+
+`source-hashes.json` records reviewed code, test and boundary-document hashes,
+query counts and source-comment provenance. The current implementation was
+checked directly; historical comment line numbers are not substituted for
+current source. This remote mechanism does not explain the all-local workload
+reported in #19831.
@@ -0,0 +1,167 @@
+{
+  "reviewedHead": "ad2ae0213f437f7cb14250405c8222bb70bafc7d",
+  "scope": "Targeted source ownership/path/handshake reads; not every line or complete historical binary. No affected-host access.",
+  "sources": [
+    {
+      "path": "src/main/ssh/ssh-relay-versioned-install.ts",
+      "sha256": "b0899d2b2332c64fd471ab9e1ae754b34426945509e294410295c99eed3d8f6e"
+    },
+    {
+      "path": "src/main/ssh/ssh-relay-deploy.ts",
+      "sha256": "47b891482a039bb9e2118ef4ed2d842c19923a9909b72760fb0fea75c17d96eb"
+    },
+    {
+      "path": "src/relay/relay-handshake.ts",
+      "sha256": "9d5c8fd6ec28c44d748d19e9606fd29796e2d38f4d70d0daa71206b4525cb4d7"
+    },
+    {
+      "path": "src/main/ssh/remote-install-gc.ts",
+      "sha256": "c081c8fc6fab1ad47f7cfa423cb70e9c14886d01d9264a5c0fc40c83f57aad13"
+    },
+    {
+      "path": "src/main/ssh/ssh-relay-superseded-endpoints.ts",
+      "sha256": "895df6d04389e89d49d8fb8b2fd05fdb05ebee81e29d3051d18e4546a0a19eef"
+    },
+    {
+      "path": "src/main/ssh/ssh-relay-cross-version-isolation.test.ts",
+      "sha256": "f9354f3511f9dbca27f0c27601fa1259e4004a5e12c2d6c354dfa1058db7d624"
+    },
+    {
+      "path": "src/relay/relay-handshake-roundtrip.test.ts",
+      "sha256": "09d62cf35663d6527ea95374dd1e32efd79237d8fc2d75b373939d9c360dfbe6"
+    },
+    {
+      "path": "docs/reference/ssh-execution-boundary.md",
+      "sha256": "eb661689226400969cfa8e2418de3acc171cbb5f66ce7fbabf92aec8539938b2"
+    }
+  ],
+  "query": {
+    "observedAt": "2026-09-17T03:42:35.152687+00:00",
+    "counts": {
+      "memory": 12,
+      "oom": 5,
+      "leak": 28,
+      "orphan": 20,
+      "RAM": 6,
+      "growth": 3,
+      "heap": 1,
+      "RSS": 0,
+      "swap": 6
+    },
+    "uniqueOpenMatches": 66,
+    "allHasNextPageFalse": true
+  },
+  "newIssues": [
+    {
+      "number": 1355,
+      "url": "https://github.com/stablyai/orca/issues/1355",
+      "bodySha256": "9942664244295e23620fa46914b2e8f2de649eacda543a632c3b70b7d1565731",
+      "comments": [
+        {
+          "url": "https://github.com/stablyai/orca/issues/1355#issuecomment-4364783060",
+          "bodySha256": "8cac8a518cfee99e1e3484b9fd1224242b344aa674e9a6d0fd0693b2ece8f708"
+        },
+        {
+          "url": "https://github.com/stablyai/orca/issues/1355#issuecomment-4365059932",
+          "bodySha256": "55b8b8f2b3974475be330ca3623f98609cd3ddfd8ec37ea91616cd180d4e72b7"
+        },
+        {
+          "url": "https://github.com/stablyai/orca/issues/1355#issuecomment-4580788768",
+          "bodySha256": "6051fcc9dddcf1c7f7fae45cceaa9235147fe4490ed249fd6272ca22a35f152f"
+        },
+        {
+          "url": "https://github.com/stablyai/orca/issues/1355#issuecomment-4735499581",
+          "bodySha256": "7f2da268ab1f36109815ba0b165378ef45df441dbc15feacf1bf539d40d1ef9e"
+        },
+        {
+          "url": "https://github.com/stablyai/orca/issues/1355#issuecomment-5068228930",
+          "bodySha256": "65647564d43102f1c447afd4e53d13453ae3f2b6793629efb64f87554f55d122"
+        }
+      ]
+    },
+    {
+      "number": 10382,
+      "url": "https://github.com/stablyai/orca/issues/10382",
+      "bodySha256": "5c0d0100de8036adc488a53c6bf6a6da75e9fb041c7c5f42a909208f54a94e12",
+      "comments": [
+        {
+          "url": "https://github.com/stablyai/orca/issues/10382#issuecomment-5082624441",
+          "bodySha256": "9f8b54a8f289cc267244ff597a33c5e32cb3d3a194e7ddbc4999ea46626a72e0"
+        },
+        {
+          "url": "https://github.com/stablyai/orca/issues/10382#issuecomment-5087398732",
+          "bodySha256": "8971965e038464fbbea95653770113b5b7a11b826092dead756f6688459c342b"
+        }
+      ]
+    },
+    {
+      "number": 11824,
+      "url": "https://github.com/stablyai/orca/issues/11824",
+      "bodySha256": "87572a21d661b8b923c3c1c1f3bd2ab531804e187552e3ce8864c884e1dd4f93",
+      "comments": []
+    },
+    {
+      "number": 13171,
+      "url": "https://github.com/stablyai/orca/issues/13171",
+      "bodySha256": "59f140342ca4179ca8b07bb5861d6a30b8e737ba6335d753884cc59d629a145c",
+      "comments": [
+        {
+          "url": "https://github.com/stablyai/orca/issues/13171#issuecomment-5228572051",
+          "bodySha256": "60600e58e07f681fe4a6079bc4162a7be69468c9a349a96fb9464c73611a7672"
+        }
+      ]
+    },
+    {
+      "number": 13852,
+      "url": "https://github.com/stablyai/orca/issues/13852",
+      "bodySha256": "d571c08122e33ae4832a27cca90f7de74ae9e90f59c2bedad635175bd266cabb",
+      "comments": [
+        {
+          "url": "https://github.com/stablyai/orca/issues/13852#issuecomment-5305218946",
+          "bodySha256": "2b5549abdcdf81dd635ed70405794b738584e4bd1d04bb6b21d7e9ad428b69e7"
+        },
+        {
+          "url": "https://github.com/stablyai/orca/issues/13852#issuecomment-5490069178",
+          "bodySha256": "eacd67610c242db9922135c1d531be3ef1c83772909b2bab104a2c18f0bfba76"
+        },
+        {
+          "url": "https://github.com/stablyai/orca/issues/13852#issuecomment-5493610344",
+          "bodySha256": "4cc4031d153b72a13c47fab7bba34e6cddad0fd05e14b22375ad13da1eab7369"
+        },
+        {
+          "url": "https://github.com/stablyai/orca/issues/13852#issuecomment-5496034290",
+          "bodySha256": "ff0b9e3b77f618ff54a51cc5a2188c6500fde2273ee34caad197d1fe6f634d83"
+        },
+        {
+          "url": "https://github.com/stablyai/orca/issues/13852#issuecomment-5496204134",
+          "bodySha256": "9a8d195771882de27811b39a33a5c77e47f4ac1173e4560607f317e609838fea"
+        },
+        {
+          "url": "https://github.com/stablyai/orca/issues/13852#issuecomment-5523691997",
+          "bodySha256": "5d8e7a8a4731a6efcd20a7fcb63d83607dadb3964441cb959a30907602a313a8"
+        }
+      ]
+    },
+    {
+      "number": 16703,
+      "url": "https://github.com/stablyai/orca/issues/16703",
+      "bodySha256": "338c763ebb02fb27b75e1898d85b74d2a9ee39c2ec60247a483777716a18c93c",
+      "comments": [
+        {
+          "url": "https://github.com/stablyai/orca/issues/16703#issuecomment-5434798023",
+          "bodySha256": "fcc1ce292997d8f8d39ea62d944764d633eaf5f36c14ce6c1fb544c31f119943"
+        }
+      ]
+    }
+  ],
+  "tests": {
+    "backgroundLaunch": true,
+    "files": [
+      "src/main/ssh/ssh-relay-cross-version-isolation.test.ts",
+      "src/relay/relay-handshake-roundtrip.test.ts"
+    ],
+    "passed": 7,
+    "failed": 0,
+    "scope": "Existing cross-version deploy isolation and actual local-socket handshake; no remote host/app window."
+  }
+}
@@ -66,6 +66,20 @@ A [twelve-file progress and retention follow-up](./twelve-retention-sites.md) co

 ## Further ownership checks

+A further [twenty-site review](./twenty-main-shared-loop-sites.md) covers transport
+admission, terminal parsers, native-provider framing, journals and package output.
+Its [ordinary RPC diagnostic](../rpc-inflight-admission-review/README.md) separates
+pending ordinary provider calls from bounded long polls. A separate
+[byte-accounting and shared-wait review](./byte-accounting-and-wait-boundaries.md)
+records 28 primary/supporting source reads and an API-only cancellation-slot
+case that has no production caller in this checkout. These findings are not a
+claim that every remaining mechanical candidate has been manually reviewed.
+
+A [six-site stream accounting review](./six-stream-accounting-sites.md) records
+38 source/caller hashes. It found the separate SSH writer consumed-prefix defect,
+while distinguishing ordinary producers from malformed-peer empty chunks and
+unused buffer APIs. Its source manifest preserves the pre-fix checkpoint.
+
 - GitLab admission removes each selected entry before granting it; timeout removes its own queued entry and clears its timer. Reviewed issue, merge-state and authentication callers release their acquired slot in `finally`. This is a lifetime bound on queued waits, not an aggregate request-byte limit.
 - Workspace-space traversal advances each frame index and retires its entry array after dispatch. Local classification uses `lstat`; remote classification checks symlink identity before descending. Listing admission enforces 100,000 entries per directory and an estimated 64 MiB live-listing budget. Completed parent aggregates and active jobs are separate from that charge, so the budget is not a whole-process or arbitrary-depth bound.
 - Plugin language-catalog traversal removes a frame per iteration and rejects repeated/cyclic objects, depth over 16, or more than 20,000 entries. The JSON parse and `Object.keys` allocation occur before those traversal checks; this does not prove a pre-parse byte bound.
@@ -73,3 +87,29 @@ A [twelve-file progress and retention follow-up](./twelve-retention-sites.md) co
 - WSL auth filesystem admission removes queued work before starting and removes aborted queued entries. Its three reviewed callers coalesce a raw operation by path until actual settlement. The follow-up [auth waiter proof](../auth-filesystem-wait-retention/README.md) reproduces retained expired Errors on Electron and verifies detachable waiters preserve ordering. [#21135](https://github.com/stablyai/orca/pull/21135) removes those reactions; no actual native filesystem stall or incident magnitude was established.

 The follow-up also traced several shared-promise callers. Worktree metadata resolution races a fresh filesystem traversal on each call, so a timeout does not itself demonstrate repeated reactions on one shared promise. WSL environment probes cap subprocess output at 64 KiB and execution at ten seconds; process-table evidence joins a capture with its own longer timeout. Those controls limit ordinary reaction lifetime while leaving operating-system stalls separate. The desktop script request queue retains expired closures behind its predecessor, but its actual host aborts and rejects the active request on a timer and limits startup retries. No indefinitely pending ordinary producer was established in that review. Daemon shared preparation and terminal creation waits remain additional candidates for cancellation-lifetime analysis.
+
+## Consumed-prefix comparison
+
+The SSH writer finding prompted targeted comparison of other cursor-based owners.
+`RelayFrameBuffer` and the relay dispatcher writer clear consumed slots and
+compact the prefix. `RecentPtyOutputBuffer` clears fully dropped string slots,
+compacts after 1,024 drops, rejects empty appends and preserves the partially
+consumed head for its documented candidate-backfill obligation. Relay sent
+boundaries retain primitive sequence numbers and compact when the dropped prefix
+occupies at least half the array. Source-credit delivery retains sent spans until
+credit acknowledgement, then shifts reclaimed spans and adjusts its send cursor;
+selection alone does not end that ownership.
+
+Git admission compacts its consumed prefix at 256 entries and separately filters
+canceled tombstones. Its candidate heaps discard invalid roots and rebuild when
+storage exceeds twice the live-lane count plus 64. These policies can retain
+bounded stale records between compactions; they do not match an indefinitely
+growing consumed prefix. The shared concurrency mapper retains its input and
+ordered result arrays for the batch lifetime; worker count is a concurrency
+limit, not a total input-memory cap. A rejected worker does not cancel sibling
+workers, so a caller's rejection alone does not end their ownership.
+
+These are targeted source observations, recorded in
+`consumed-prefix-comparison.json`, not a universal capacity proof or a claim that
+native operations always finish. The SSH scheduler's distinct completed-entry
+path has its own actual-source before/after proof.
@@ -0,0 +1,124 @@
+{
+  "reviewedHead": "a8c4bed3fa4191d731bb28826d00318f18a5db0a",
+  "reviewPath": "docs/audits/main-collection-loop-review/byte-accounting-and-wait-boundaries.md",
+  "scope": "28 targeted primary and supporting module reads; no claim of 28 new findings or all-callers/ordering coverage",
+  "sources": [
+    {
+      "path": "src/main/daemon/cold-restore-payload-cache.ts",
+      "sha256": "6e97bb387ec9b00619226685934126a90e4572720de3ed6a16de0cf8f43ceb77"
+    },
+    {
+      "path": "src/main/daemon/terminal-history-seed-transfer-registry.ts",
+      "sha256": "262731857991b84e7bbe3fb113c48c93d6e6512d4a5f98d2a2e2505ead7a4331"
+    },
+    {
+      "path": "src/main/git/source-control/settled-diff-cache.ts",
+      "sha256": "02f88cdabd6a195264bb9043f66e94a78a098bb2445553db2acf3fac3863198d"
+    },
+    {
+      "path": "src/shared/ws-outbound-backpressure-queue.ts",
+      "sha256": "73bf7ff3c10c42ada557045ac4be57f7676b87678984985f2dfe1b99a6e23e17"
+    },
+    {
+      "path": "src/main/browser/browser-network-tunnel-outbound-memory-budget.ts",
+      "sha256": "e30dd41c2bba68a6c9789da4aae0295bbe97005f8fe28486b51399338b59abd0"
+    },
+    {
+      "path": "src/main/browser/browser-network-tunnel-resource-budget.ts",
+      "sha256": "2bace3438e4ada66527f52a4ee0023d466391c3388edf06501a9b47c70ad8fa5"
+    },
+    {
+      "path": "src/main/runtime/rpc/mobile-e2ee-outbound-memory-budget.ts",
+      "sha256": "1536385680c95497ed4c014d30cba31e638bebad94297bf0b047fb4031134398"
+    },
+    {
+      "path": "src/main/browser/browser-client-upload-staging.ts",
+      "sha256": "fa0fe89ba415f707e35bba06f9c6d72924dd2ef73a33c8130174fda751efdb6c"
+    },
+    {
+      "path": "src/main/ipc/runtime-upload-file-stream.ts",
+      "sha256": "3e1cbf889afca7ac0fd936f66f8d4d662f893d1626a37fcc68df932416daec7f"
+    },
+    {
+      "path": "src/main/daemon/terminal-shell-recovery-barrier.ts",
+      "sha256": "cc1c671618c9d53d46c05a60730cdcf0eee8a2497df5f8f89edb99df1a298913"
+    },
+    {
+      "path": "src/main/codex/codex-structured-acquisition-window.ts",
+      "sha256": "6828970d450a53fcb30ecc0ecb20d8452395bf579cc2295ee53415c299d039a4"
+    },
+    {
+      "path": "src/main/native-chat/agent-session-wire/structured-agent-session-event-sink-queue.ts",
+      "sha256": "0a92e8e51745c973cbed8f3e97bd16b5e8803900f85b91fc46fc3ca4a7e3d134"
+    },
+    {
+      "path": "src/main/orcad/orcad-sidecar-runtime-client.ts",
+      "sha256": "126cd062e8bbd8fe0d7fa794bba1f93adb2e4c9a6b3686ffb6e2433ade872e29"
+    },
+    {
+      "path": "src/main/claude/claude-prompt-registry.ts",
+      "sha256": "565227f7d89c1036fc7c31d0d619483f8528e8a4f5205fa3f89a71a9053c39e4"
+    },
+    {
+      "path": "src/main/claude/claude-structured-inbound-control.ts",
+      "sha256": "dd797317708a9b33da7ffb3066c4b4a65a448afab0b94cadef003a15b3fceb31"
+    },
+    {
+      "path": "src/main/claude/claude-structured-prompt-ownership.ts",
+      "sha256": "3d222c2a636510bc75c69c4f342868a87d081666ebdfbf3105c9bccb4070d794"
+    },
+    {
+      "path": "src/main/claude/claude-structured-control-actions.ts",
+      "sha256": "4f7fd77eff5e8a8280397e9f077ddb662fd5a3741514502ffd270290d51c64a0"
+    },
+    {
+      "path": "src/main/ai-vault-search/session-search-work-loop.ts",
+      "sha256": "774c5603346041c52da548d9a7cbad60c75be7cddee8b22b8515503acbadabed"
+    },
+    {
+      "path": "src/main/ai-vault-search/session-search-service-registry.ts",
+      "sha256": "926cc902440ad7c7b346c1da8a178aa965c3cbbaed3a42afd63b572ec91186b0"
+    },
+    {
+      "path": "src/main/ai-vault-search/session-search-indexer.ts",
+      "sha256": "ad01c5b44b0dff8c53eefd63d26f77d9bbea69935383c195020cdd9e0748c814"
+    },
+    {
+      "path": "src/main/ai-vault-search/session-search-service.ts",
+      "sha256": "bddf5f58c79f5e8fd7b99f9c932d1b3ea205b7ea71a04b7bd1aa52fdb106cde7"
+    },
+    {
+      "path": "src/main/ai-vault-search/session-search-child-service.ts",
+      "sha256": "49bf96acc37679dd0fbd92475c1c2afdd7871688f7a17999651565e69069f593"
+    },
+    {
+      "path": "src/main/ai-vault-search/session-search-in-process-service.ts",
+      "sha256": "1a12a3e75aa92bad9de48d6bcc336f1b9bc201ee3d5874f5e91c718f88eb2015"
+    },
+    {
+      "path": "src/main/ai-vault/session-scanner-service-client.ts",
+      "sha256": "6a71b08c6cb7de3cd0d0aa1a193d32f2f8835f361af083b91fdf72ff55c1bedd"
+    },
+    {
+      "path": "src/main/ai-vault/session-scanner-service-client-state.ts",
+      "sha256": "b6516ae06cfcdce44946a08441887f3987b020afcd0795c07635fe70a7f8f76c"
+    },
+    {
+      "path": "src/main/ai-vault/session-scanner-service-spawn.ts",
+      "sha256": "064f1d299547ec05e63a451a77774098cdb0ce9cbf45406167be6cbbcb846e19"
+    },
+    {
+      "path": "src/main/ai-vault/session-scanner-service-search.ts",
+      "sha256": "a6153a71323ba794ef270b2e4b346995d6046549b34bd8d30ae7b9b395f0d145"
+    },
+    {
+      "path": "src/main/providers/working-directory-validation.ts",
+      "sha256": "197bcb7ab254d2bca8cdcc7d7f0214dedca825bbb0dc4f0d2dcbb41df4cec043"
+    }
+  ],
+  "installedSdkReference": {
+    "path": "node_modules/@anthropic-ai/claude-agent-sdk/sdk.mjs",
+    "sha256": "9235fac983c29e614d7f572a578406dc5dbda006305faa99f9447f577738eb93",
+    "scope": "Targeted handleControlRequest/cancel and canUseTool excerpts only; source tracing, not complete dependency audit."
+  }
+}
@@ -0,0 +1,100 @@
+# Byte accounting and shared-wait boundaries
+
+This follow-up records targeted ownership and capacity reads, including negative
+results. The source manifest identifies the exact versions reviewed. It does not
+claim every caller, allocation, or asynchronous schedule has been proved safe.
+
+## Collections
+
+| Boundary                                           | Result and remaining limit                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `cold-restore-payload-cache.ts`                    | Each entry charges at least 16 bytes, with text and link charges; eviction removes actual oldest entries until the 16 MiB logical budget is met. This does not measure map/key overhead or sliced-string backing storage.                                                                                                                                                                                                                                                |
+| `terminal-history-seed-transfer-registry.ts`       | Rejects empty chunks; at most eight transfers and 4,096 chunks per manifest, with an aggregate byte cap. Take, abort, owner cleanup, disposal and 30-second expiry remove entries and timers. Pending native I/O elsewhere is outside this registry.                                                                                                                                                                                                                     |
+| `settled-diff-cache.ts`                            | Existing `BoundedMap` supplies independent 32-entry, one-million-character per-result and eight-million-character total caps. Generation/stamp checks fence late writes. This is a retained content budget, not a peak diff allocation measurement.                                                                                                                                                                                                                      |
+| `ws-outbound-backpressure-queue.ts`                | Ordinary queueing has byte and frame caps, drain clears consumed slots, and disposal drops the array. Its exposed cancellation API can leave arbitrarily many empty array slots behind an undrained first entry; see the bounded proof below. No production caller uses that cancellation API in this checkout, so this was not promoted as an incident mechanism or fix.                                                                                                |
+| `browser-network-tunnel-outbound-memory-budget.ts` | Independent claim, socket-source, lease and host counts prevent zero-byte claims from evading every bound. Releases are idempotent; hosts are deleted only after all owners leave. Claim/socket owners must still call release.                                                                                                                                                                                                                                          |
+| `browser-network-tunnel-resource-budget.ts`        | Zero-byte reservations return without appending an aggregate claim. Positive claims are consumed in order, slots cleared and the prefix compacted. Open attempts have a time-window count cap and pending opens a separate cap. Payload byte sizes originate from transport buffers; no arbitrary-number safety claim is made.                                                                                                                                           |
+| `mobile-e2ee-outbound-memory-budget.ts`            | Zero-byte claims still charge a frame. A process-level frame cap and socket-source cap complement the byte bounds. Release is idempotent; caller teardown remains necessary.                                                                                                                                                                                                                                                                                             |
+| `browser-client-upload-staging.ts`                 | Retained entries describe staged disk paths, not the uploaded buffers. Per-page eviction follows successful staging; failed directory removal deliberately keeps its record for retry. Concurrent pending writes retain their inputs until settlement, and repeated removal failures can retain metadata. Dropping those records would lose cleanup ownership.                                                                                                           |
+| `runtime-upload-file-stream.ts`                    | Sequential reads reuse one buffer of at most 384 KiB and await each base64 chunk RPC, with a 30-second RPC deadline, abort checks and handle cleanup in `finally`. Empty files send one empty chunk. This bounds each transfer's read buffer, not concurrent transfers or native filesystem waits.                                                                                                                                                                       |
+| `terminal-shell-recovery-barrier.ts`               | The queue flushes on its 262,144-code-unit budget or 750 ms deadline; teardown is explicitly bounded and settles waiters. The byte-named counter counts code units and has no independent emission-count cap. Actual ConPTY ingress can emit empty transformed records for suppressed queries. Its normal native job inspection is synchronous, so proof settlement releases the queue at the next microtask checkpoint; a delayed-proof stress case is qualified below. |
+| `codex-structured-acquisition-window.ts`           | Independent 1,024-operation and 4 MiB logical caps, with a minimum one-byte charge. Overflow discards buffered closures and refuses acquisition; drain transfers and removes them.                                                                                                                                                                                                                                                                                       |
+| `structured-agent-session-event-sink-queue.ts`     | Ordinary and lifecycle operations have separate byte/count admission; replacement removes the old queued operation. Close/failure drop queued operations and settle barriers. A running operation remains owned until its promise settles; repeated barrier callers during an indefinitely stalled operation need separate admission analysis.                                                                                                                           |
+| `orcad-sidecar-runtime-client.ts`                  | Each request limits retained response text to 64 MiB. Its 90-second default timer refreshes on keepalive frames; that is an inactivity deadline, not an absolute lifetime cap. Finish clears the timer and ends the socket; late data remains byte-bounded. Concurrent requests and peer-close behavior remain separate concerns.                                                                                                                                        |
+
+## Cancellation and reconciliation
+
+- `ClaudePromptRegistry` removes claims together with normal prompt retirement
+  and stores cancellation observations in a `WeakMap`. Permission callback
+  listeners are attached to per-request signals. The installed SDK rejects
+  duplicate in-flight request IDs and deletes its controller in `finally` after
+  writing the response. A pending response write is still an owner; the normal
+  completed-request path is not the Codex claim-map bug fixed in #21138. This is
+  source tracing, not a new SDK runtime reproduction.
+- `SessionSearchWorkLoop.queue` chains one task per reconcile request; it does
+  not coalesce requests. The registry's five-second freshness timeout only ends
+  the caller's wait. Desktop calls go through `AiVaultScannerServiceClient`,
+  which admits at most 16 queued/active calls, runs one interactive lane, and
+  starts a 15-second deadline once the child is ready. Those controls prevent
+  treating repeated desktop freshness requests as an uncapped indexer queue.
+  In-process relay/orcad registration has a different route and requires its
+  own caller admission analysis. Closing the loop aborts the running task and
+  prevents queued tasks from executing; native I/O can still outlive that abort.
+  The later `notes/session-search-admission-review/` traces 33 source files and
+  passes five existing controls: relay installs disabled defaults, orcad's timer
+  rearms only after settlement, and no current production caller requests
+  `wait-until-current`. Explicit custom freshness RPCs can enqueue work, but no
+  ordinary repeating producer of the proposed stalled queue was established.
+- The canceled working-directory wait investigation rejected an eager shared
+  observer because it changes external raw-promise cancellation ordering.
+  [#21144](https://github.com/stablyai/orca/pull/21144) instead clears per-caller
+  holders while preserving reaction order and native-operation ownership.
+  [Both runtime proofs](../working-directory-wait-retention/README.md) release
+  32 canceled signals; small empty reaction/holder records remain until settlement.
+
+## Cancellation-slot diagnostic
+
+```sh
+ORCA_BACKGROUND_LAUNCH=1 node docs/audits/main-collection-loop-review/outbound-cancellation-slot-probe.cjs
+```
+
+The runner transpiles the hash-checked actual queue source without changing it.
+It parks one frame, then enqueues and cancels four batches of 2,048 later frames.
+
+Array storage grows from 2,049 to 8,193 slots while retained frames stay at one
+and retained/claimed payload bytes stay at five. Canceled slots contain
+`undefined`: this is array storage, not retained canceled frame payloads. Draining
+the original frame returns slots, frames and byte claims to zero and preserves
+output order. The injected scheduler consumes callbacks before invoking them,
+as a real timer does.
+
+A repository-wide reference search found `enqueueCancelable` only in the queue
+implementation and its tests. Production `enqueue` calls discard the handle.
+Consequently, this API-only case is retained as a negative promotion decision;
+it does not explain #19831 or establish measured heap/RSS growth. The existing
+ordinary drain/compaction and byte/frame caps remain relevant to live callers.
+
+## Terminal recovery follow-up
+
+The actual `PtyStartupIngress` emits a transformed empty record, retaining its raw sequence span, for each suppressed ConPTY color query. Feeding its emissions to the actual recovery barrier reproduces 9,362 queued records from one 65,534-code-unit input before the next microtask checkpoint, charged as zero text. With the normal already-resolved confirmation shape, all later read callbacks see an empty queue.
+
+An injected asynchronous confirmation delay permits eight such reads to retain 74,896 records while the text counter remains zero; the production 750 ms timer then flushes every record and releases the queue. The POSIX no-startup-authority control preserves the queries as ordinary text and trips the byte limit. All three controls pass on Node and Electron using the actual classes, without a native PTY or heap measurement. The bounded runner and reports are retained locally in `notes/terminal-recovery-empty-emissions/`.
+
+The Windows caller obtains job membership synchronously through `readWindowsPtyJobProcessIds` / `QueryInformationJobObject`; an async wrapper alone does not establish a prolonged native wait. The delayed-proof condition is therefore not claimed as an ordinary Windows producer, a sustained leak, or an explanation of the Linux #19831 report. The result corrects the initial assumption that empty emissions required a synthetic input API, while preserving the distinction between within-callback allocation and indefinite retention.
+
+## Structured sink barrier follow-up
+
+Seven actual-source controls in `notes/structured-sink-barrier-waiters/` distinguish
+barrier metadata from operation admission. Injecting an asynchronously pending
+sink operation and retrying actual host close after each ten-second drain timeout
+retains one to 32 barrier waiters. Settling the original operation releases all
+of them. Serialized ordinary tasks leave only one active barrier; earlier provider
+stop timeouts add none; failure/close settle existing barriers. Actual SQLite
+appends and barriers drain with all rows durable.
+
+The reviewed journal row, epoch and close operations use synchronous SQLite.
+A native stall in those calls also prevents the retry timers from running.
+No ordinary asynchronous operation that would enable the repeated-timeout
+condition was established. Release-clock failures do not automatically rearm.
+This conditional metadata case is documented, with 32 source hashes, and is not
+promoted as a new product fix or incident explanation.
@@ -0,0 +1,42 @@
+{
+  "reviewedHead": "ad2ae0213f437f7cb14250405c8222bb70bafc7d",
+  "scope": "Targeted ownership/cursor/compaction reads, no new runtime reproduction for these negative/qualified controls. SSH scheduler proof is separate.",
+  "sources": [
+    {
+      "path": "src/shared/relay-frame-buffer.ts",
+      "sha256": "f89fcd33489894c34f79ba8fd5e5634487555a7c34fc8e7c054229ae1c20e0be"
+    },
+    {
+      "path": "src/relay/dispatcher-writer-admission.ts",
+      "sha256": "12e05ba04de5687c0a0db1e44eddf342cb0c21b9653eef2aeff7b5ccd2039797"
+    },
+    {
+      "path": "src/main/runtime/recent-pty-output-buffer.ts",
+      "sha256": "3c02b54567850b4f94a25e06142eef247c383a74fb702fe8f45fbfeb1a2488b8"
+    },
+    {
+      "path": "src/relay/pty-source-sent-boundaries.ts",
+      "sha256": "8e6becd99ec2c33981cc0fb56c820072dc4b6b69febaf2c1c20e1932e2593faf"
+    },
+    {
+      "path": "src/relay/pty-source-credit-record.ts",
+      "sha256": "2d5a90fa9aeccc95bee81e7a4474777579737b9d9ecba89af9a7ca0464aa8c1e"
+    },
+    {
+      "path": "src/relay/pty-source-credit-settlement.ts",
+      "sha256": "1845d77f4259ae7ad94288c3c83eec414a1523ba519ab68e4a9a5838d772302e"
+    },
+    {
+      "path": "src/main/git/command-runner/git-admission-waiter-queue.ts",
+      "sha256": "9b39e1a26cace97e4162194244c6c027bf242ce6cd03d93381cdfdd9ff7a1cc2"
+    },
+    {
+      "path": "src/main/git/command-runner/git-admission-candidate-heap.ts",
+      "sha256": "6ff4eabf0691aa3d0d66e81c01c48b2bfb9e8e565202a08581a53591ea35b5f9"
+    },
+    {
+      "path": "src/shared/map-with-concurrency.ts",
+      "sha256": "18ec54a56f444b6b79c3430cc3f73e9caaed2b9ddae5715ea16d36953d9cee59"
+    }
+  ]
+}
@@ -0,0 +1,92 @@
+const assert = require('node:assert/strict')
+const { createHash } = require('node:crypto')
+const fs = require('node:fs')
+const path = require('node:path')
+const Module = require('node:module')
+const { transformSync } = require('esbuild')
+
+assert.equal(process.env.ORCA_BACKGROUND_LAUNCH, '1')
+const root = path.resolve(__dirname, '../../..')
+const sourcePath = 'src/shared/ws-outbound-backpressure-queue.ts'
+const source = fs.readFileSync(path.join(root, sourcePath), 'utf8')
+const sourceSha256 = createHash('sha256').update(source).digest('hex')
+assert.equal(sourceSha256, '73bf7ff3c10c42ada557045ac4be57f7676b87678984985f2dfe1b99a6e23e17')
+const bundle = transformSync(source, { loader: 'ts', format: 'cjs' }).code
+const loaded = new Module(__filename, module)
+loaded._compile(bundle, __filename)
+const { createWsOutboundBackpressureQueue } = loaded.exports
+let timer = null
+let buffered = 100
+let claimed = 0
+const sent = []
+const queue = createWsOutboundBackpressureQueue({
+  send: (frame) => sent.push(frame),
+  byteLengthOf: (frame) => frame.length,
+  getBufferedAmount: () => buffered,
+  isWritable: () => true,
+  onOverflow: () => assert.fail('No retained frame or byte bound was exceeded'),
+  softCapBytes: 10,
+  claimQueuedBytes: (bytes) => {
+    claimed += bytes
+    return () => {
+      claimed -= bytes
+    }
+  },
+  setTimer: (callback) => {
+    timer = callback
+    return 1
+  },
+  clearTimer: () => {
+    timer = null
+  }
+})
+assert.equal(queue.enqueue('owner'), true)
+const batches = []
+for (let batch = 0; batch < 4; batch++) {
+  for (let index = 0; index < 2048; index++) {
+    const result = queue.enqueueCancelable('discard')
+    assert.equal(result.accepted, true)
+    assert.equal(result.cancel(), true)
+    assert.equal(result.cancel(), false)
+  }
+  const evidence = queue.evidence()
+  assert.equal(evidence.queuedFrames, 1)
+  assert.equal(evidence.queuedBytes, 5)
+  assert.equal(evidence.storageSlots, (batch + 1) * 2048 + 1)
+  assert.equal(claimed, 5)
+  batches.push(evidence)
+}
+buffered = 0
+assert.equal(typeof timer, 'function')
+const drain = timer
+timer = null
+drain()
+assert.deepEqual(sent, ['owner'])
+assert.deepEqual(queue.evidence(), { queuedBytes: 0, queuedFrames: 0, storageSlots: 0 })
+assert.equal(claimed, 0)
+assert.equal(timer, null)
+queue.dispose()
+const report = {
+  sourcePath,
+  sourceSha256,
+  runnerSha256: createHash('sha256').update(fs.readFileSync(__filename)).digest('hex'),
+  evaluatedBundleSha256: createHash('sha256').update(bundle).digest('hex'),
+  runtime: process.versions,
+  batches,
+  afterDrain: queue.evidence(),
+  productionReachability:
+    'No production reference to enqueueCancelable found in checked-out repository; ordinary enqueue discards cancellation handle. API-only capacity gap, not promoted as an incident explanation or product fix.',
+  scope:
+    'Canceled slots contain undefined; retained frame payloads and byte claims are released. No heap or RSS measurement.'
+}
+fs.writeFileSync(
+  path.join(__dirname, 'outbound-cancellation-slot-results.json'),
+  `${JSON.stringify(report, null, 2)}\n`
+)
+console.log(
+  JSON.stringify({
+    batches: batches.length,
+    maximumSlots: batches.at(-1).storageSlots,
+    afterDrain: report.afterDrain
+  })
+)
@@ -0,0 +1,67 @@
+{
+  "sourcePath": "src/shared/ws-outbound-backpressure-queue.ts",
+  "sourceSha256": "73bf7ff3c10c42ada557045ac4be57f7676b87678984985f2dfe1b99a6e23e17",
+  "runnerSha256": "055649a287cfde2c8694d1f18d4b580a07b6cdfa65dd1056b3f0bd704715c406",
+  "evaluatedBundleSha256": "a8eeacdf980d4756cbb340208e7073a78e5e8d78bdb67d99df187ab913924d3e",
+  "runtime": {
+    "node": "26.6.0",
+    "acorn": "8.17.0",
+    "ada": "4.0.0",
+    "amaro": "1.1.11",
+    "ares": "1.34.8",
+    "brotli": "1.2.0",
+    "cldr": "48.0",
+    "icu": "78.3",
+    "libffi": "3.7.1",
+    "llhttp": "9.4.3",
+    "merve": "1.2.2",
+    "modules": "147",
+    "napi": "10",
+    "nbytes": "0.1.4",
+    "ncrypto": "0.0.1",
+    "nghttp2": "1.70.0",
+    "nghttp3": "",
+    "ngtcp2": "",
+    "openssl": "3.6.3",
+    "simdjson": "4.6.6",
+    "simdutf": "7.7.0",
+    "sqlite": "3.53.4",
+    "tz": "2026a",
+    "undici": "8.9.0",
+    "unicode": "17.0",
+    "uv": "1.52.1",
+    "uvwasi": "0.0.23",
+    "v8": "14.6.202.34-node.26",
+    "zlib": "1.2.12",
+    "zstd": "1.5.7"
+  },
+  "batches": [
+    {
+      "queuedBytes": 5,
+      "queuedFrames": 1,
+      "storageSlots": 2049
+    },
+    {
+      "queuedBytes": 5,
+      "queuedFrames": 1,
+      "storageSlots": 4097
+    },
+    {
+      "queuedBytes": 5,
+      "queuedFrames": 1,
+      "storageSlots": 6145
+    },
+    {
+      "queuedBytes": 5,
+      "queuedFrames": 1,
+      "storageSlots": 8193
+    }
+  ],
+  "afterDrain": {
+    "queuedBytes": 0,
+    "queuedFrames": 0,
+    "storageSlots": 0
+  },
+  "productionReachability": "No production reference to enqueueCancelable found in checked-out repository; ordinary enqueue discards cancellation handle. API-only capacity gap, not promoted as an incident explanation or product fix.",
+  "scope": "Canceled slots contain undefined; retained frame payloads and byte claims are released. No heap or RSS measurement."
+}
@@ -0,0 +1,125 @@
+{
+  "head": "96970f9b6efe915f9578b765c93f3d06880ccc2d",
+  "rows": [
+    {
+      "path": "src/shared/browser-network-tunnel-stream-framing.ts",
+      "lines": "12-18,36-40,125-156,159-200",
+      "verdict": "No zero-length/tiny-input retention bypass found.",
+      "evidence": "Encoder rejects empty payloads. Decoder ignores empty feed, validates 1..65552-byte frame and stores only fixed header + one frame; input-chunk retained-byte check is 2 MiB. Writer reserves length-prefix bytes before allocating and counts queued + in-flight frames: 1 MiB/512 frames; send(empty) refuses without enqueue. close clears queued storage, with at most one native write callback retaining its already-handed frame until I/O settles.",
+      "callers": [
+        "src/relay/wsl-browser-network-relay.ts",
+        "src/main/browser/wsl-browser-network-execution-route.ts"
+      ]
+    },
+    {
+      "path": "src/shared/growing-byte-buffer.ts",
+      "lines": "9-24,27-49,64-84,98-109",
+      "verdict": "No empty-chunk metadata array; two shipped users impose byte budgets.",
+      "evidence": "append(empty) returns, and storage is one copied geometrically-grown Buffer, not a chunk list. Quick Open limits a partial field to 64 KiB and clears/replaces storage after field/error/abort. SOCKS pending upstream enforces 256 KiB plus a 10-second opening timeout, transfers storage after connection, and clears on failure/close. retainSuffix/discardPrefix intentionally keep old capacity, but neither has a production caller; do not promote an API-only high-water concern.",
+      "callers": [
+        "src/shared/quick-open-listing-limits.ts",
+        "src/main/browser/remote-browser-socks-server.ts"
+      ]
+    },
+    {
+      "path": "src/main/ssh/ssh-multiplexer-transport-writer.ts",
+      "lines": "77-79,114-179,268-308",
+      "verdict": "NEW demonstrated consumed-prefix retention in its lane scheduler; separate ignored proof.",
+      "evidence": "Logical ordinary/control limits (2 MiB/2048 frames and protocol max-message+header/512 frames), one coalesced liveness write and settled guards all account correctly. However scheduler.shift advances head without clearing selected entries; a lane that stays nonempty retains every settled WriterEntry+Buffer+callback after writer release decrements all counters. Actual PTY helper\u2192multiplexer\u2192writer proof retains 2048 completed Buffers with only 2 live queued frames/706 logical bytes. Node and Electron agree; ignored clear-slot + existing relay-buffer compaction pattern yields 0 completed Buffers/2 slots. Full drain or dispose cleans baseline. No product changes.",
+      "callers": [
+        "src/main/ssh/ssh-multiplexer-writer-lane-scheduler.ts",
+        "src/main/ssh/ssh-channel-multiplexer.ts",
+        "src/main/providers/ssh-pty-write.ts",
+        "src/main/ssh/ssh-relay-deploy-helpers.ts",
+        "src/shared/relay-frame-buffer.ts"
+      ]
+    },
+    {
+      "path": "src/main/ssh/ssh-git-response-stream-reader.ts",
+      "lines": "16,61-68,72-80,90-99,112-164,212-217,282-305",
+      "verdict": "No shipped empty-chunk producer found; malformed-peer validation gap is unpromoted.",
+      "evidence": "Before sentinel pending frame count is 64. After sentinel parts[] appends even decoded empty input and validates announced total bytes/chunk count only on End; matching malformed chunks refresh the 30-second inactivity deadline, so fabricated empty/extra chunks can bypass announced totals. Actual shared relay registry constructs nonempty bounded base64 chunks from one finite serialized payload, emits each exactly once with increasing sequence and final End, and exposes finite chunkCount. No current producer can drive empty/extra chunks; this is not an ordinary-code growth proof. Full result reassembly remains input-sized. Fail/cancel/disposal removes subscriptions and timer; raw request has its own timeout and normal branch settles before collection.",
+      "callers": [
+        "src/relay/git-response-stream.ts",
+        "src/relay/protocol.ts",
+        "src/main/ssh/relay-protocol.ts",
+        "src/main/providers/ssh-git-provider.ts",
+        "src/main/providers/ssh-git-read-provider.ts",
+        "src/main/providers/ssh-filesystem-provider.ts"
+      ]
+    },
+    {
+      "path": "src/main/native-chat/transcript-stream-lines.ts",
+      "lines": "22-40,53-72,87-141",
+      "verdict": "No zero-length pending-fragment accumulation; retain existing input-size caveats.",
+      "evidence": "write(empty) or StringDecoder empty output never enters pending.push; every newline moves lineStart and resets fragments. Nonempty tiny pieces are proportional to record bytes; split yields records from only one input chunk before reading another. AI Vault supplies existing 10 MiB record quota. Legacy import supplies existing 16 MiB raw source limit (ML-021). Claude branch proof streams a fixed initial file prefix; largest record and UUID graph remain input-sized as already disclosed in ML-043, with no new arbitrary cap. Legacy whole transcript reader reaches only read-cache export, which has no current production caller; do not claim current active full-reader growth.",
+      "callers": [
+        "src/main/ai-vault/remote-session-content-lines.ts",
+        "src/main/ai-vault/session-transcript-record-budget.ts",
+        "src/main/native-chat/agent-session-journal/journal-legacy-import.ts",
+        "src/main/claude/claude-transcript-branch-proof.ts",
+        "src/main/native-chat/transcript-reader.ts",
+        "src/main/native-chat/transcript-read-cache.ts",
+        "src/main/native-chat/wsl-transcript-fs-access.ts"
+      ]
+    },
+    {
+      "path": "src/main/runtime/rpc/terminal-source-range-ledger.ts",
+      "lines": "96-105,107-181,199-237,251-305",
+      "verdict": "Positive-byte admission bounds frame count; no demonstrated zero-byte bypass.",
+      "evidence": "canAccept requires positive safe integer bytes with 2 MiB/stream and 16 MiB/connection reservations, plus one pending admission. ACK removes all completed frames, releases acknowledged bytes, and retains only the partially acknowledged first frame when applicable. Rollback releases pending reservation; transfer commit/close clear frames and unregister. Caller charges encoded payload length; normal empty output is discarded by batcher, while transformed zero-display output has positive JSON length. SSH intake passes a singleton source span; batcher aggregates only nonempty normal data or immediately flushes transformed spans. Tiny normal ranges can have object overhead well above byte charge, but all represent positive source/display progress. Generic API permits synthetic large range arrays; this alone is not shipped reachability. Active stream count 128; ACK windows additionally bound output to 2 MiB/stream and 8 MiB/connection.",
+      "callers": [
+        "src/main/runtime/rpc/terminal-source-range-registry.ts",
+        "src/main/runtime/rpc/terminal-source-range-validation.ts",
+        "src/main/runtime/rpc/terminal-output-frame-chunks.ts",
+        "src/main/runtime/rpc/methods/terminal/terminal-output-batcher.ts",
+        "src/main/runtime/rpc/methods/terminal/terminal-multiplex-frame-delivery.ts",
+        "src/main/runtime/rpc/methods/terminal/terminal-multiplex-stream-initialization.ts",
+        "src/main/runtime/rpc/methods/terminal/terminal-multiplex-flow-control.ts",
+        "src/shared/terminal-output-source-range.ts",
+        "src/shared/terminal-multiplex-flow-control.ts",
+        "src/main/ipc/pty/delivery/ssh-intake.ts"
+      ]
+    }
+  ],
+  "canonicalLfSha256": {
+    "src/main/ai-vault/remote-session-content-lines.ts": "3e6da0e99a2abe4ec31a33d5bb4846799dd2b2e86e8a4b35239ea835c3b6db78",
+    "src/main/ai-vault/session-transcript-record-budget.ts": "dc6632ad6cab7e98ccda78a4e82ea5ab9dee905777b2da33f0d3ab51855d5813",
+    "src/main/browser/remote-browser-socks-server.ts": "f508868699b7d922cc1cf9c0e3b701c98d4cad31070d2448130c0d60be1e47b7",
+    "src/main/browser/wsl-browser-network-execution-route.ts": "7dbf998a5e674b38c3c15fa40444af06718fc2a995b7af9586f736ff526fe5f5",
+    "src/main/claude/claude-transcript-branch-proof.ts": "8688711f711adf434c596dda729018e43cfa46ba746590187388e9f5e864648f",
+    "src/main/ipc/pty/delivery/ssh-intake.ts": "a854c369f8357f6e57cf96f76b464e82277e7847572fbc2ab7224b8e7018c14c",
+    "src/main/native-chat/agent-session-journal/journal-legacy-import.ts": "88c007b4fb83eba6ec5fdf21c50b4c4aff35199cc4eed92abe3a1c29addfc5f3",
+    "src/main/native-chat/transcript-read-cache.ts": "7494de59c2177179f88fc7842f75318d317e624a52ea12674aa87688dcf06afe",
+    "src/main/native-chat/transcript-reader.ts": "4b3b9af283fece28cc274f7405b0c78c5ad95d9ae88c59ed750bef61574d24ca",
+    "src/main/native-chat/transcript-stream-lines.ts": "5f3a0a1e5b3d003076452fa22234af00502808ed6463672c0e58aa49ae5b6aa1",
+    "src/main/native-chat/wsl-transcript-fs-access.ts": "707125ebdd120e342255d12660249bf0bdfd72b8335701f5efff028f4e66dab5",
+    "src/main/providers/ssh-filesystem-provider.ts": "de6051f43ea272fe0a15b7ef5c6df5c8caedfa7adaada205386c4f19be7f04f2",
+    "src/main/providers/ssh-git-provider.ts": "7953259ddd023af87130408f73231fe4c676a04829b229bf19b70f83438d0174",
+    "src/main/providers/ssh-git-read-provider.ts": "859369b72bde86b93666acd6e236bfcd9df665b62cd359006bdf7d547aeb7e13",
+    "src/main/providers/ssh-pty-write.ts": "357024da7dc5bf2df1dabd43f6f90146afa239d414e29f04b17f86a6351520ae",
+    "src/main/runtime/rpc/methods/terminal/terminal-multiplex-flow-control.ts": "e63a615d1f174e93b13ae234a8cc3030570628b5617c11079df2c3a31f7ee578",
+    "src/main/runtime/rpc/methods/terminal/terminal-multiplex-frame-delivery.ts": "a10626f33b803ab9d627812cefc5a7372e92e7bc9c336cea48ea6122ae72f963",
+    "src/main/runtime/rpc/methods/terminal/terminal-multiplex-stream-initialization.ts": "7dfa3be7cb935a19e9139e31a73fda1b47ecdf69d832effc6cc248fc81731e0a",
+    "src/main/runtime/rpc/methods/terminal/terminal-output-batcher.ts": "de99bcae5a0565504ec446f8779663dd2845b252fa23c16831d3a75ab0711ba5",
+    "src/main/runtime/rpc/terminal-output-frame-chunks.ts": "232b0ceb6ade396beb0122aac97400e93d2588434f6cf1c67824bf9384890845",
+    "src/main/runtime/rpc/terminal-source-range-ledger.ts": "1ec52fe96dcda0d4875219b47b93964e6bce6eece5235bc7908f0a49a674b343",
+    "src/main/runtime/rpc/terminal-source-range-registry.ts": "b61d4cfb462c2c719f1375be9c9d268da649ce2b71fbd423369a386f4bae589c",
+    "src/main/runtime/rpc/terminal-source-range-validation.ts": "fa87134b7c53047aec29606c72585854025f7541dc421d03b6b713e0a002efd7",
+    "src/main/ssh/relay-protocol.ts": "644aa6f2087b5867d41006bfdcec78ffba693157a2912feb8f82b120f5647b34",
+    "src/main/ssh/ssh-channel-multiplexer.ts": "9ecd88963fec72901596bd25d2cb4c8666ef41d3c8a968242c6eef52095ee108",
+    "src/main/ssh/ssh-git-response-stream-reader.ts": "8e3a2a5606f95ce1c70c1397ca5a807d90989074ea2be41497785c269381af0e",
+    "src/main/ssh/ssh-multiplexer-transport-writer.ts": "433a2cc400b5ed9743871ca03aac06d31a079ef23c42c2a2759f78967312d071",
+    "src/main/ssh/ssh-multiplexer-writer-lane-scheduler.ts": "3e5fe7a1e3537505baf42869449193fc0448339d851254a49527ec2a1c7cbb50",
+    "src/main/ssh/ssh-relay-deploy-helpers.ts": "5452b8a441268a42abe09ae71ae64c5684e070a7469eed0b421ab4cd8e41abae",
+    "src/relay/git-response-stream.ts": "953495aa5255d262e4cd4c6417d4b2d1f1391bb1b9a86f020e866ad8d6b58bbc",
+    "src/relay/protocol.ts": "faebaded7e8c8b98f021c791b4519d78d58be3879937fe2ed2cef68b22404060",
+    "src/relay/wsl-browser-network-relay.ts": "c94789582a60d8daeea51562db5707821102aed21e1844670425bff990c203a4",
+    "src/shared/browser-network-tunnel-stream-framing.ts": "8a735f634f5f17e13236ff462031924fb2db484a256aa1ed0639a975b7b67800",
+    "src/shared/growing-byte-buffer.ts": "6d2372f53b2c490ea2372f2ce503cc8a4bf9941d854112c4f0004c34f3a8d0ca",
+    "src/shared/quick-open-listing-limits.ts": "b27c21a88683bca11833b773f5203587d03e986a51a6532179e64f1a3752dda6",
+    "src/shared/relay-frame-buffer.ts": "f89fcd33489894c34f79ba8fd5e5634487555a7c34fc8e7c054229ae1c20e0be",
+    "src/shared/terminal-multiplex-flow-control.ts": "1044573cdf3c5c429c2ab838cc8c950f8c554ee5ec0a7ed98ef4392442094366",
+    "src/shared/terminal-output-source-range.ts": "c688a42096b547d653e0f91efb840c0ad4471d4951475401797ae1668623ece3"
+  }
+}
@@ -0,0 +1,18 @@
+# Six stream/buffer accounting sites
+
+Historical source review at the recorded pre-fix commit; the SSH scheduler candidate was subsequently promoted with a [portable actual-call-path proof](../ssh-writer-consumed-prefix/README.md). No affected-host attribution. Canonical LF source hashes and caller paths are in `six-stream-accounting-sites.json`.
+
+| Site                                                                                          | Bounds, cleanup and caller evidence                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | Verdict                                                                                   |
+| --------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- |
+| `src/shared/browser-network-tunnel-stream-framing.ts:12-18,36-40,125-156,159-200`             | Encoder rejects empty payloads. Decoder ignores empty feed, validates 1..65552-byte frame and stores only fixed header + one frame; input-chunk retained-byte check is 2 MiB. Writer reserves length-prefix bytes before allocating and counts queued + in-flight frames: 1 MiB/512 frames; send(empty) refuses without enqueue. close clears queued storage, with at most one native write callback retaining its already-handed frame until I/O settles.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | No zero-length/tiny-input retention bypass found.                                         |
+| `src/shared/growing-byte-buffer.ts:9-24,27-49,64-84,98-109`                                   | append(empty) returns, and storage is one copied geometrically-grown Buffer, not a chunk list. Quick Open limits a partial field to 64 KiB and clears/replaces storage after field/error/abort. SOCKS pending upstream enforces 256 KiB plus a 10-second opening timeout, transfers storage after connection, and clears on failure/close. retainSuffix/discardPrefix intentionally keep old capacity, but neither has a production caller; do not promote an API-only high-water concern.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | No empty-chunk metadata array; two shipped users impose byte budgets.                     |
+| `src/main/ssh/ssh-multiplexer-transport-writer.ts:77-79,114-179,268-308`                      | Logical ordinary/control limits (2 MiB/2048 frames and protocol max-message+header/512 frames), one coalesced liveness write and settled guards all account correctly. However scheduler.shift advances head without clearing selected entries; a lane that stays nonempty retains every settled WriterEntry+Buffer+callback after writer release decrements all counters. Actual PTY helper→multiplexer→writer proof retains 2048 completed Buffers with only 2 live queued frames/706 logical bytes. Node and Electron agree; ignored clear-slot + existing relay-buffer compaction pattern yields 0 completed Buffers/2 slots. Full drain or dispose cleans baseline. No product changes.                                                                                                                                                                                                                                                                                    | NEW demonstrated consumed-prefix retention in its lane scheduler; separate ignored proof. |
+| `src/main/ssh/ssh-git-response-stream-reader.ts:16,61-68,72-80,90-99,112-164,212-217,282-305` | Before sentinel pending frame count is 64. After sentinel parts[] appends even decoded empty input and validates announced total bytes/chunk count only on End; matching malformed chunks refresh the 30-second inactivity deadline, so fabricated empty/extra chunks can bypass announced totals. Actual shared relay registry constructs nonempty bounded base64 chunks from one finite serialized payload, emits each exactly once with increasing sequence and final End, and exposes finite chunkCount. No current producer can drive empty/extra chunks; this is not an ordinary-code growth proof. Full result reassembly remains input-sized. Fail/cancel/disposal removes subscriptions and timer; raw request has its own timeout and normal branch settles before collection.                                                                                                                                                                                        | No shipped empty-chunk producer found; malformed-peer validation gap is unpromoted.       |
+| `src/main/native-chat/transcript-stream-lines.ts:22-40,53-72,87-141`                          | write(empty) or StringDecoder empty output never enters pending.push; every newline moves lineStart and resets fragments. Nonempty tiny pieces are proportional to record bytes; split yields records from only one input chunk before reading another. AI Vault supplies existing 10 MiB record quota. Legacy import supplies existing 16 MiB raw source limit (ML-021). Claude branch proof streams a fixed initial file prefix; largest record and UUID graph remain input-sized as already disclosed in ML-043, with no new arbitrary cap. Legacy whole transcript reader reaches only read-cache export, which has no current production caller; do not claim current active full-reader growth.                                                                                                                                                                                                                                                                           | No zero-length pending-fragment accumulation; retain existing input-size caveats.         |
+| `src/main/runtime/rpc/terminal-source-range-ledger.ts:96-105,107-181,199-237,251-305`         | canAccept requires positive safe integer bytes with 2 MiB/stream and 16 MiB/connection reservations, plus one pending admission. ACK removes all completed frames, releases acknowledged bytes, and retains only the partially acknowledged first frame when applicable. Rollback releases pending reservation; transfer commit/close clear frames and unregister. Caller charges encoded payload length; normal empty output is discarded by batcher, while transformed zero-display output has positive JSON length. SSH intake passes a singleton source span; batcher aggregates only nonempty normal data or immediately flushes transformed spans. Tiny normal ranges can have object overhead well above byte charge, but all represent positive source/display progress. Generic API permits synthetic large range arrays; this alone is not shipped reachability. Active stream count 128; ACK windows additionally bound output to 2 MiB/stream and 8 MiB/connection. | Positive-byte admission bounds frame count; no demonstrated zero-byte bypass.             |
+
+## New candidate
+
+The initial ignored evidence remains in `notes/ssh-writer-consumed-prefix/`. The promoted [durable proof](../ssh-writer-consumed-prefix/README.md) also adds real Node Writable and callback-ownership controls. Statements in the table describe the pre-fix source recorded by this review. This proof substitutes a bounded transport write/settlement/drain port; no real SSH socket or remote process is used. Ordinary caller route and actual production transport event contract are read separately. Samples demonstrate object reachability, not measured RSS or an affected-incident slope.
+
+6 primary sites; 38 named source/caller hashes; captured HEAD `96970f9b6efe915f9578b765c93f3d06880ccc2d`.
@@ -0,0 +1,457 @@
+{
+  "reviewPath": "docs/audits/main-collection-loop-review/twenty-main-shared-loop-sites.md",
+  "reviewedHead": "e73e91319ac6e0c8fd49529dda850761631d5d5c",
+  "sourceNormalization": "CRLF to LF",
+  "scope": "20 selected additional main/shared synchronous-loop sites, read with callers and lifetime boundaries. Not an exhaustive review; no affected-host or packaged-release attribution. All tests/background probes use ORCA_BACKGROUND_LAUNCH=1.",
+  "exclusionInputs": [
+    {
+      "path": "docs/audits/main-collection-loop-review/further-progress-sites.json",
+      "sha256": "00b483a55e2cec82efc6c193c0656330c288e17791e97a0addee6f4d55159d7c"
+    },
+    {
+      "path": "docs/audits/main-collection-loop-review/results.json",
+      "sha256": "498ab3e7e73b9756d28925d899529bf6ea69e0f166fa23965c7288ff9b9ab103"
+    },
+    {
+      "path": "docs/audits/main-collection-loop-review/twelve-retention-sites.json",
+      "sha256": "912c063cae2102a79c709b2eab986543ef4ff8a7c4ede0d40089b63bc3f240ce"
+    },
+    {
+      "path": "docs/audits/main-collection-loop-review/additional-sites.json",
+      "sha256": "00c9d8f79d2b96b5d1a62b49558f6daf880d7c221a9bb4a882df28bf4fbe38d3"
+    },
+    {
+      "path": "docs/audits/main-collection-loop-review/twenty-additional-sites.json",
+      "sha256": "ae46fbf30754dc5380069285e84950e6ba774586074f9c3c9b9627aeae08a84b"
+    },
+    {
+      "path": "docs/audits/main-collection-loop-review/README.md",
+      "sha256": "9a9214e31acc24b6c1edd43604685fabc4c72a591e4667b66a21e0f6faa9155c"
+    },
+    {
+      "path": "docs/audits/memory-leak-audit-2026-09-15.md",
+      "sha256": "9004f2464b21247e32f7ec9d6bb6e92ec8291f8407d9f9f2484ae9b218b98466"
+    },
+    {
+      "path": "docs/audits/memory-leak-scan-2026-09-15.md",
+      "sha256": "1e999d52409112c6c2c35d9a3af66f4b7fa5f1a76ea0d6ddbb27ffc7ab9c2b5c"
+    }
+  ],
+  "sites": [
+    {
+      "path": "src/main/computer/macos-native-provider-transport.ts",
+      "lines": "74",
+      "sha256": "c9a025550fb0049f145e7c130640a5f1bfa80425e08fbb65f686d45d950f10f5",
+      "progressAndOwnership": "Newline consumption strictly shortens pending text; no newline returns. The caller clears pending text on shutdown, socket close/error and process replacement. Every request has a 60-second timer that shuts down this client.",
+      "limitsAndAssessment": "No line-byte cap in this class. Complete helper JSON and newline-less traffic can allocate input-sized memory before timeout. No ordinary runaway helper producer or persistent leak established.",
+      "supportingSources": [
+        {
+          "path": "src/main/computer/macos-native-provider-client.ts",
+          "sha256": "5d933e0b75d2b8e8c8f2dc5e6a0091f18731936dbe3004c940fb209623054a7a"
+        }
+      ]
+    },
+    {
+      "path": "src/main/runtime/rpc/unix-socket-transport.ts",
+      "lines": "127,155",
+      "sha256": "3052d9ac2777535480e1376ace4960d784fc1a37ce9e1a6cac0c7e1747e88377",
+      "progressAndOwnership": "Each line is consumed before dispatch. The per-connection cleanup Set removes replied requests; close aborts every remaining controller, clears the Set and removes the socket. Input admission is 1 MiB, active connections 32 and socket idle lifetime 30 seconds. Actual admission caps long polls at 16, with narrower specialized classes.",
+      "limitsAndAssessment": "Ordinary requests explicitly bypass long-poll counters and receive no abort signal at dispatcher invocation. A bounded actual-auth/dispatcher/method control defers worktree.list and tests concurrent calls, socket close and provider settlement. This is a conditional capacity boundary, not an established indefinite production stall or incident attribution.",
+      "supportingSources": [
+        {
+          "path": "src/main/runtime/runtime-rpc/runtime-rpc-request-admission.ts",
+          "sha256": "55701c215abd0def001f11d6c32cadadf1928d45ddcb6dd2fb6fc71c4744dc39"
+        },
+        {
+          "path": "src/main/runtime/runtime-rpc/runtime-rpc-long-poll.ts",
+          "sha256": "211acfd93a56b3fba1ca211ff7138c78f17d3883e713faba705af45664c6ba6f"
+        },
+        {
+          "path": "src/main/runtime/runtime-rpc/runtime-rpc-lifecycle.ts",
+          "sha256": "899fc92a756a75a49f70deb768023aa75f046d19405e04b70b0f00bb061bad1d"
+        },
+        {
+          "path": "src/main/runtime/rpc/dispatcher.ts",
+          "sha256": "1753b9ab3244bc6a1441511c16632a341ec5617b2b73308ba0914d02c9f54fc2"
+        },
+        {
+          "path": "src/main/runtime/rpc/dispatcher-unary-method-invocation.ts",
+          "sha256": "32f5a00d3ef58b6501851dae935f7e36dec96246e48b94e6a621125b8f638a2c"
+        },
+        {
+          "path": "src/main/runtime/rpc/methods/worktree-catalog-methods.ts",
+          "sha256": "0205845ab6e44e2c4e2ff100860a3cc496c7e209de18f43ab6994f96550e6790"
+        },
+        {
+          "path": "src/main/runtime/runtime-managed-worktree-queries.ts",
+          "sha256": "f22a16f2c905ef1d2a6b10b4803949cb4356bb6c480dd644c9b16adfddbf1fc4"
+        },
+        {
+          "path": "src/main/runtime/orca-runtime-list-known-resolved-worktrees-for-explicit-target.ts",
+          "sha256": "36b23ae998ee90188454a769e4e9fdadc87041a12384a5929f88bc9cc509913a"
+        }
+      ]
+    },
+    {
+      "path": "src/main/orcad/orcad-sidecar-runtime-client.ts",
+      "lines": "87",
+      "sha256": "126cd062e8bbd8fe0d7fa794bba1f93adb2e4c9a6b3686ffb6e2433ade872e29",
+      "progressAndOwnership": "Response parsing consumes through a newline, skips blank lines, and stops at settlement. Response allowance is 64 MiB per request. A timer defaults to 90 seconds; valid keepalive frames refresh it. Finish is idempotent, clears the timer and ends the socket; timeout/error destroys it.",
+      "limitsAndAssessment": "Keepalives make this an idle deadline, not an absolute wall-clock deadline. Extra data after a terminal response can still enter the data handler until peer/socket close, bounded by the same response cap. No ordinary continuing-after-result producer or persistent ownership leak established. Concurrent requests multiply the allowance.",
+      "supportingSources": [
+        {
+          "path": "src/main/orcad/electron-serve-browser-process.ts",
+          "sha256": "f53c831c95a3822594ad2c05eb6d97ec6e9628a2191407a3352b1dc101741fde"
+        }
+      ]
+    },
+    {
+      "path": "src/main/jira/request-queue.ts",
+      "lines": "47",
+      "sha256": "7483d7d4128d2b4ad44369fe25d522777eb0f1eecc9b204e583ca8e4416ed783",
+      "progressAndOwnership": "Release shifts each queued waiter before granting or skipping it; abort removes a queued entry, and grant removes its abort listener. Four requests run concurrently. Reviewed read/search/mutation/metadata callers release acquired slots in finally.",
+      "limitsAndAssessment": "The waiter queue has no count or byte cap. Some callers omit AbortSignal. Authenticated fetch has no common request timeout in this layer. Four prolonged network operations plus further requests can accumulate queued closures, but no sustained production retry/poll producer or actual indefinite network stall has been demonstrated.",
+      "supportingSources": [
+        {
+          "path": "src/main/jira/authenticated-request.ts",
+          "sha256": "bcbf9263771b6cea60e9930c6173487b85fb5e1ac12150a4afa1a5a90dc82780"
+        },
+        {
+          "path": "src/main/jira/client.ts",
+          "sha256": "2c1319e8b5af933cb19de914cd0be874fcc8c76829dfb5642691a5ebe782fb6f"
+        },
+        {
+          "path": "src/main/jira/jira-issue-read.ts",
+          "sha256": "81d6871675875691cbe20a8bfbe3fa0e317f9e71d0062c7b96de892e4427fd6c"
+        },
+        {
+          "path": "src/main/jira/jira-issue-search.ts",
+          "sha256": "d41ccb1f474011a834607bb40760635af13e11dc02cbefc44b90ae40607f830e"
+        }
+      ]
+    },
+    {
+      "path": "src/main/automations/external-automation-probe-scheduler.ts",
+      "lines": "126,134,142",
+      "sha256": "902a82b2696bbaacad355bc1920f68f455a5c354210ee82e2ab2a03e041995d6",
+      "progressAndOwnership": "Pump shifts entries before starting; active ownership is set before running. Production concurrency is four; identical keys coalesce. Final settlement removes active/shared ownership and pumps again. Queued cancellation removes the entry; active cancellation rejects the consumer but holds its real slot until provider settlement. Priority hold release is idempotent.",
+      "limitsAndAssessment": "Queue count/bytes are separate from running concurrency. Production run callbacks are async. Local command lookup has a five-second timeout and SSH mux requests default to 30 seconds; local JSON filesystem reads remain OS-lifetime dependent. No ordinary indefinitely pending producer established; custom NaN capacity or synchronous callback throws were not promoted as production findings.",
+      "supportingSources": [
+        {
+          "path": "src/main/automations/external-manager.ts",
+          "sha256": "cd5b9e76ba6ed92205171d031893bcfe247cda35803c9491c1fff557b201573c"
+        },
+        {
+          "path": "src/main/automations/external-manager-discovery.ts",
+          "sha256": "50369ae36c70dacd532a64c1dce72041918677d9c8816844b1ea25c0ae563bff"
+        },
+        {
+          "path": "src/main/automations/external-manager-local-command.ts",
+          "sha256": "fa42f9c4a7f4bf42d8aea4462d7161c79a50f8db32ee39bf74ceb1a9400fa6a3"
+        },
+        {
+          "path": "src/main/ipc/automations.ts",
+          "sha256": "c53f9226e50094c20a069f871c7ae6963da6c9ed603f7e12ad65b317ea5d3624"
+        },
+        {
+          "path": "src/main/ssh/ssh-channel-multiplexer.ts",
+          "sha256": "9ecd88963fec72901596bd25d2cb4c8666ef41d3c8a968242c6eef52095ee108"
+        }
+      ]
+    },
+    {
+      "path": "src/main/daemon/terminal-history-seed-chunks.ts",
+      "lines": "23,35,67",
+      "sha256": "a2616cd2815d92ba8dbe9ddad9d34adc08076a33765010ee18e82c4905adee3f",
+      "progressAndOwnership": "The chunk end advances, or a surrogate-boundary adjustment is forced forward by one unit. Cross-segment surrogate carry is at most one UTF-16 unit. Chunks are 512 Ki UTF-16 units and inline mode stops at 1 Mi units. The actual daemon spawn sender awaits each append request before requesting the next chunk; failure aborts the transfer.",
+      "limitsAndAssessment": "This bounds transferred chunks and pending requests, not the original seed segments retained while the spawn is pending. Substring backing memory and measurement Buffers are separate. Completed spawn input lifetime is covered by its existing dedicated artifact; no new growing loop identified here.",
+      "supportingSources": [
+        {
+          "path": "src/main/daemon/daemon-pty-spawn-request.ts",
+          "sha256": "d3c2e9f8995c73df427dea36e0ea64508fef6fd5880616df9ad430e34d3acb3e"
+        }
+      ]
+    },
+    {
+      "path": "src/main/daemon/terminal-history-restorable-retention.ts",
+      "lines": "18,37,49",
+      "sha256": "1bfc897132026875086cb99e9d2d5df73db793cd6cef916706934b215bfd7b7d",
+      "progressAndOwnership": "The min-heap keeps the newest 10,000 metadata entries by default. Sift descends to a child index or stops; production enumeration reads one directory entry at a time and closes the directory in finally.",
+      "limitsAndAssessment": "The scan may visit arbitrarily many directory entries even though the retained heap is bounded. Entry metadata/string bytes are not charged by the count. No custom invalid limit was found in production, and no non-progressing loop or additional retained owner was established.",
+      "supportingSources": [
+        {
+          "path": "src/main/daemon/history-reader.ts",
+          "sha256": "8579629f0d023bad3d652661c6f767ad5be767a2759c2978b114645df0814a3d"
+        }
+      ]
+    },
+    {
+      "path": "src/main/daemon/daemon-health.ts",
+      "lines": "77,189",
+      "sha256": "c1ba2c5c687bfbf6d99ee82f51b81d9eac238ff90f48af23a086d10ceb2ed114",
+      "progressAndOwnership": "Both health parsers consume a full line or await more data. A three-second absolute timer settles each probe. Settlement clears its timer, removes owned listeners and destroys the socket.",
+      "limitsAndAssessment": "There is no input-byte cap during the three-second probe. Ordinary local-daemon health replies are small; a large finite input remains possible. No lifetime beyond the owned socket/timer was established.",
+      "supportingSources": [
+        {
+          "path": "src/main/daemon/daemon-health.ts",
+          "sha256": "c1ba2c5c687bfbf6d99ee82f51b81d9eac238ff90f48af23a086d10ceb2ed114"
+        }
+      ]
+    },
+    {
+      "path": "src/main/daemon/daemon-durable-history-snapshot.ts",
+      "lines": "81,110,156,169",
+      "sha256": "35c3b071f3cd5f41e6d2f507f029057663983cf42ec211180fabb9f775cc5072",
+      "progressAndOwnership": "Ownership replay slices past each complete shell lifecycle trigger. The scanner clears its armed state and retained tail on a complete trigger, and the returned trigger end advances beyond the incomplete prior prefix. The scratch emulator is always disposed in finally after success or fallback.",
+      "limitsAndAssessment": "History and replay inputs are finite but input-sized; scrollback is capped separately from dimensions. Newline counting splits the ANSI string transiently. No persistent growing collection was established in this function.",
+      "supportingSources": [
+        {
+          "path": "src/main/daemon/terminal-shell-lifecycle-scanner.ts",
+          "sha256": "2bc25f07183c727e5d4e9d5670bbcaa015e37f74abadba422b6bf8f040fdc04c"
+        },
+        {
+          "path": "src/main/daemon/daemon-pty-buffer-snapshots.ts",
+          "sha256": "dd0e66898c3035be4c4fe41138a26f00f2d9d84e3999e328c77aa4cc2f29faf9"
+        },
+        {
+          "path": "src/main/daemon/daemon-pty-checkpoint-persistence.ts",
+          "sha256": "2cbe518533013d4208e10c34c40ece45368c11366a9db898fc043c9d19b7fad0"
+        }
+      ]
+    },
+    {
+      "path": "src/main/daemon/terminal-shell-recovery-barrier.ts",
+      "lines": "101,118,153,232,300,334",
+      "sha256": "cc1c671618c9d53d46c05a60730cdcf0eee8a2497df5f8f89edb99df1a298913",
+      "progressAndOwnership": "Recovery replay consumes scanner triggers and limits nested recovery episodes to 16. Output waiting on proof has a 750-ms timer and defaults to 262,144 code units; overflow ends the episode and flushes. Disposal clears timer, queue and idle waiters; stale episode/generation checks reject obsolete proof completions.",
+      "limitsAndAssessment": "The quantity called bytes is string length; one incoming chunk is pushed before overflow handling. Async raw proof lifetime can exceed the logical wait deadline. Reviewed ownership is per live session, not a global byte bound or proof that an OS probe always settles.",
+      "supportingSources": [
+        {
+          "path": "src/main/daemon/session-output-pipeline.ts",
+          "sha256": "94f6f221d85388274d585ad714fda25c32a824942950074e4e95b85c94a6771f"
+        },
+        {
+          "path": "src/main/daemon/terminal-shell-lifecycle-scanner.ts",
+          "sha256": "2bc25f07183c727e5d4e9d5670bbcaa015e37f74abadba422b6bf8f040fdc04c"
+        }
+      ]
+    },
+    {
+      "path": "src/main/daemon/terminal-view-attribute-responder.ts",
+      "lines": "86,110,145",
+      "sha256": "51fa68da93e150a2c15072999b63b3440fb5540b67d732020ca287123ae20fa7",
+      "progressAndOwnership": "OSC palette parsing removes two slots per iteration. Color override keys are restricted to valid ANSI indices or the three special colors. HeadlessEmulator registers these handlers once; xterm disposal owns handler lifetime and explicit clearing removes overrides.",
+      "limitsAndAssessment": "Splitting the OSC payload is input-sized and repeated shift can be quadratic, but the loop does not add slots. Parser admission and terminal dimensions are separate bounds; no additional lifetime leak established.",
+      "supportingSources": [
+        {
+          "path": "src/main/daemon/headless-emulator.ts",
+          "sha256": "ace96102285c3967cd9544e7696fe73e1ac6df576b476939aa9819f5c298bab6"
+        }
+      ]
+    },
+    {
+      "path": "src/main/daemon/terminal-mouse-mode-mirror.ts",
+      "lines": "54,63",
+      "sha256": "e8f4888dabee5c4cc50b0f15584b3b1b5e2da4db1ba25695dd5762ef9c4a6fb3",
+      "progressAndOwnership": "Positive-width escape regex matches advance. Parameter iteration is finite and only scalar mouse modes survive. Incomplete prefixes are logically limited to 4,096 code units. Actual HeadlessEmulator parsed-write and synchronous-write paths feed this mirror.",
+      "limitsAndAssessment": "The retained suffix is sliced from the full input. This is a sibling of the already assigned kitty escape-tail backing-string candidate, not a separately counted new mechanism. The RPC audit agent owns the comparative Node/Electron backing-memory proof; this review records static reachability only.",
+      "supportingSources": [
+        {
+          "path": "src/main/daemon/headless-emulator.ts",
+          "sha256": "ace96102285c3967cd9544e7696fe73e1ac6df576b476939aa9819f5c298bab6"
+        }
+      ]
+    },
+    {
+      "path": "src/main/daemon/startup-device-attributes-responder.ts",
+      "lines": "34",
+      "sha256": "de1092ba15ec03cdd2fb08b33cd5ba5a04f26b19616476e3c7f717e54d337b7b",
+      "progressAndOwnership": "DA1 filtering consumes a complete query, advances past an unmatched candidate, or retains a proper prefix of one of two short queries. Release returns and clears the pending prefix; SessionOutputPlane releases filter authority and forwards any held data.",
+      "limitsAndAssessment": "The incomplete prefix is at most three UTF-16 units, while returned output is input-sized. No growing loop identified; short string length alone is not an allocator backing-storage measurement.",
+      "supportingSources": [
+        {
+          "path": "src/main/daemon/session-output-plane.ts",
+          "sha256": "505e4319ef6666101770991e93aa69b97bea6d8c2c60f1ddf9f6ffe02adf7487"
+        }
+      ]
+    },
+    {
+      "path": "src/main/runtime/worktree-terminal-mutation-lock.ts",
+      "lines": "131",
+      "sha256": "2b7551d3e4fd4dddbdbe5311f40e7f953edfaee88394dfe6918e657ee12b6758",
+      "progressAndOwnership": "Drain shifts before granting. Shared grants increment active spawn count; an exclusive grant blocks the next iteration. Promise continuations run after the synchronous drain. Release is idempotent and removes an empty state only when it is still the current owner. Deadline rejection removes its queued entry.",
+      "limitsAndAssessment": "A live operation can hold ownership until actual completion and callers without deadlines can wait without a count/byte cap. Production shared spawn and exclusive mutation callers release in finally. No indefinitely pending native producer or byte-growth incident was established.",
+      "supportingSources": [
+        {
+          "path": "src/main/runtime/orca-runtime-stop-terminals-for-worktree.ts",
+          "sha256": "7b69d511258fe5944d71644c8781a95778c41dd37eaa3473674aa758375e8700"
+        },
+        {
+          "path": "src/main/ipc/pty/runtime/spawn-execute.ts",
+          "sha256": "b35128bc7010f8b6e4788dc3b8ebbe0ad1222b7e71840ecb4e5c572ab273b76d"
+        }
+      ]
+    },
+    {
+      "path": "src/main/native-chat/agent-session-wire/structured-conversation-command-controller.ts",
+      "lines": "63,77",
+      "sha256": "0b322ceef37531efd3e06c9fa6a6d45ed04f1fe48feabc1809ce6e5477474234",
+      "progressAndOwnership": "Replacement traversal follows one link per step, memoizes resolved destinations and breaks cycles through a per-walk visited Set. Command ownership is a per-session operation key plus refcount; a finally path decrements and deletes the exact final entry.",
+      "limitsAndAssessment": "Record/index/visited allocations scale with the input history. A pending command retains its ownership until settlement; no ended-owner growth established. No universal history-byte limit is proved by this loop.",
+      "supportingSources": [
+        {
+          "path": "src/main/native-chat/agent-session-wire/structured-agent-session-host.ts",
+          "sha256": "036107aa9d70e51c84a4845f7d5cc27082bb71255cd617c314035a33fa1fbeef"
+        }
+      ]
+    },
+    {
+      "path": "src/main/skills/skill-package-deterministic-gzip.ts",
+      "lines": "32",
+      "sha256": "2f148e520baef6083593967fd8d92fdaef8ae537d09dcb9e7aecdb20a8b436b7",
+      "progressAndOwnership": "Gzip staging is a 65,535-byte pending Buffer. Each copy advances offset; filling the buffer emits a stored block and resets its pending count. The archive writer awaits backpressure and pipes through compressed-byte admission to the file sink; failures destroy the gzip stream and await sink settlement.",
+      "limitsAndAssessment": "Transform.push can queue output for the current incoming chunk before upstream backpressure resumes. This bounds staging, not all transient bytes of an arbitrarily large already-admitted input chunk. No self-growing loop found.",
+      "supportingSources": [
+        {
+          "path": "src/main/skills/skill-package-tar.ts",
+          "sha256": "2a6ac122604cbca5a6297017029ff838a5b943167c201dc94867e59fa32bbc69"
+        },
+        {
+          "path": "src/shared/skill-package-manifest.ts",
+          "sha256": "52f29f85154f1873fbb17c0797be587a1a8e4bbbe92c6aa55c34ef497c6c244f"
+        }
+      ]
+    },
+    {
+      "path": "src/main/native-chat/agent-session-wire/agent-session-delta-coalescer.ts",
+      "lines": "119,134,247",
+      "sha256": "48828e4ee21858075cbb87ec1caa4a82991a55f80928482615d1df7ec5dc0fb2",
+      "progressAndOwnership": "Ordinary stream eviction removes a selected stream, removes a newly protected entry from the evictable set, or returns under backpressure. UTF-8 truncation decrements a byte offset. Production Codex keys include a colon and Claude keys include provider identity, so the artificial empty-key branch is not a demonstrated caller case.",
+      "limitsAndAssessment": "New separate candidate: empty delta strings append a persistent chunks-array slot while both byte counters remain zero; flush joins without compacting. Actual Codex stream control retains 16,384\u219265,536 slots across four flushes. Forget/dispose clear them. Narrow approved candidate guards only the push and preserves stream creation, dirty publication, timer and admission semantics. Nonempty tiny-chunk overhead and transient overflow concatenation remain separate.",
+      "supportingSources": [
+        {
+          "path": "src/main/codex/codex-structured-item-streams.ts",
+          "sha256": "b70c3306e8bec3587342afc3bc156f40903513fa7ff3865b217ba4cc912cd89f"
+        },
+        {
+          "path": "src/main/codex/codex-structured-item-stream-bounds.ts",
+          "sha256": "88e9efa8a9c163905f1a5eb5eaf316fba2f194d76c5a94ed7f55636cc0d74ae0"
+        },
+        {
+          "path": "src/main/codex/codex-structured-journal-translation.ts",
+          "sha256": "56e17b9649471e804d29d1d54a3e14b4298ca8af2e25c4759dc37fce000b06a1"
+        },
+        {
+          "path": "src/main/claude/claude-streamed-text-checkpoints.ts",
+          "sha256": "a0e435f5fcf73f37e48e5363f8f9245d992a0d6c0a80abdf5cc5c72b2595fe6d"
+        },
+        {
+          "path": "src/shared/agent-session-journal-item-key.ts",
+          "sha256": "09ebe4758e3f38b5b7591f07f7b4dbfd04c7cc01713c9b0afe03b07b656d1fe8"
+        }
+      ],
+      "followUp": {
+        "path": "docs/audits/empty-streamed-delta-retention/README.md",
+        "fixedSourceSha256": "7caf0f24250b42e0ac4fe99e93bcbe0a4acb7cb3465fdde6b248d8bf6ba0d2d0",
+        "status": "Narrow push guard promoted; four-phase Node/Electron source proof preserves publication behavior."
+      }
+    },
+    {
+      "path": "src/main/native-chat/agent-session-wire/agent-session-history-page-bounds.ts",
+      "lines": "72,98,102,110,125",
+      "sha256": "57e49a0ea59cdccf4a4fc1532d43d2c127b077233602139b2d36d79fd547fc9d",
+      "progressAndOwnership": "Each whole-sequence group advances the cursor to a distinct run boundary. Byte bounding emits admitted groups or truncates the first oversized group then stops. The submissions cache uses a WeakMap keyed by the existing snapshot array.",
+      "limitsAndAssessment": "JSON serialization happens before admission and a single atomic sequence group can exceed an item-count target. Text truncation does not prove total group-frame overhead is under the budget. Original snapshots are separately owned; no new persistent strong cache root established.",
+      "supportingSources": [
+        {
+          "path": "src/main/native-chat/agent-session-wire/agent-session-history-page.ts",
+          "sha256": "f0c7530bf972642b2e55e9ce39166fa913ddd1744adcef4d43fd8765a25df65e"
+        }
+      ]
+    },
+    {
+      "path": "src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.ts",
+      "lines": "130,168,186,205,236",
+      "sha256": "4c948fd869aedbe9b3960ba7ed64dd4adbba4590034de63ab0da145ac50fb19d",
+      "progressAndOwnership": "Catch-up sends a page only while its sequence advances; no advancement, no newer rows or subscriber removal returns. Fan-out traverses snapshots of subscriber values. Close and emit failure remove the subscriber and delete an empty session map. Provider ended/turn-settlement paths explicitly publish null activity before ordinary sink teardown drains.",
+      "limitsAndAssessment": "Per-page bounds do not by themselves bound all queued outbound transport bytes. ActivityBySession clears on null publication rather than subscriber disconnect; ordinary ended paths provide that publication. Failed/aborted sink ownership remains a separate exceptional-lifecycle question, not a proved leak here. No synchronous journal append from the reviewed transport emit path was established.",
+      "supportingSources": [
+        {
+          "path": "src/main/native-chat/agent-session-wire/structured-agent-session-event-sink.ts",
+          "sha256": "dd5c8223d28f2348e03e189d05c70df43c7213907f83b410a3fab49f381a7852"
+        },
+        {
+          "path": "src/main/native-chat/agent-session-wire/structured-agent-session-eviction.ts",
+          "sha256": "6f5040fedeedf498b083677bfc1ab9a59b7cfd1802fa7428769646f807a07c44"
+        },
+        {
+          "path": "src/main/native-chat/agent-session-wire/structured-agent-session-host-lifetime.ts",
+          "sha256": "9795ef145d69fde19178f4819d3c06f735a6ea7fa97c5bce21a11a17f797b740"
+        },
+        {
+          "path": "src/main/codex/codex-structured-journal-translation.ts",
+          "sha256": "56e17b9649471e804d29d1d54a3e14b4298ca8af2e25c4759dc37fce000b06a1"
+        },
+        {
+          "path": "src/main/claude/claude-structured-journal-translation.ts",
+          "sha256": "286884b5e4ca61757b3866aca5dcb1cf778ff93f824381b04d40f7ee68a0615b"
+        }
+      ]
+    },
+    {
+      "path": "src/shared/pty-startup-ingress.ts",
+      "lines": "119,181,252,301",
+      "sha256": "70c693b9d461a4e3b02881244162ae05735da2ddbafbc20240e0f467b50ccf6e",
+      "progressAndOwnership": "Serial drain shifts operations before execution and guards reentry. Echo/query scanning consumes a positive-width match, advances an escape candidate, or returns with an incomplete suffix. Query tails are limited to 64 units; echo hold is 500 ms; startup teardown closes timers and delivery. Expected echoes are capped at 64 with a 256 KiB search allowance, reduced after deadline.",
+      "limitsAndAssessment": "Production native output arrives asynchronously; no callback was found that synchronously re-enqueues forever. Source-span slices and current input ownership require a separate backing-storage analysis. Query/echo limits are per ingress owner, not whole-process byte bounds.",
+      "supportingSources": [
+        {
+          "path": "src/shared/pty-startup-reply-delivery.ts",
+          "sha256": "228664a21850922a2b9742d7b36dee10938d3f45df3f1210a1c60a2561cf9e12"
+        },
+        {
+          "path": "src/main/daemon/session.ts",
+          "sha256": "ddd71285f6e72bcee012e7a9955170be4fb59c8e41e70971bc629c13504a4338"
+        },
+        {
+          "path": "src/main/providers/local-pty-session-activation.ts",
+          "sha256": "7f6dd5b11c3d7d825dd5f79ba9db772f1240104029bb652dcf2bc4ba5c3d0d7f"
+        }
+      ]
+    }
+  ],
+  "separateCandidates": [
+    {
+      "candidate": "empty streamed text array slots",
+      "status": "Promoted narrow guard; actual Codex caller, named main/v198 module overlays, matching publication/scheduling behavior.",
+      "proof": "docs/audits/empty-streamed-delta-retention/reproduce.cjs"
+    },
+    {
+      "candidate": "mouse escape-tail backing string",
+      "status": "same candidate family as kitty tail; comparative proof owned by rpc_queue_retention"
+    },
+    {
+      "candidate": "ordinary RPC in-flight capacity",
+      "status": "conditional pending-handler capacity, with settlement and long-poll negative controls; no real permanently stalled provider proved",
+      "proof": "notes/main-growth-producers/short-rpc-inflight.test.mjs"
+    },
+    {
+      "candidate": "Jira wait queue pressure",
+      "status": "source candidate only; no sustained ordinary producer or actual indefinite network operation established"
+    }
+  ],
+  "proofs": [
+    {
+      "path": "notes/main-growth-producers/short-rpc-inflight.test.mjs",
+      "sha256": "e3ff3e48ad4847943bc236d4fcdebb63310cd65f08c4540211966635951d1df3"
+    },
+    {
+      "path": "notes/main-growth-producers/short-rpc.config.mjs",
+      "sha256": "1815a077ec8746f9b8bc3b9a64c51699c162b65308d752924dfb64b6d67aed27"
+    },
+    {
+      "path": "notes/main-growth-producers/short-rpc-inflight-results.json",
+      "sha256": "c020f41c314d8756e22ab476bc3433f9badc08bbdbc3b9e70dbf8b08c3c40f4b"
+    }
+  ]
+}
@@ -0,0 +1,38 @@
+# Twenty additional main/shared synchronous-loop sites
+
+20 selected additional main/shared synchronous-loop sites, read with callers and lifetime boundaries. Not an exhaustive review; no affected-host or packaged-release attribution. All tests/background probes use ORCA_BACKGROUND_LAUNCH=1.
+
+Reviewed head: `e73e91319ac6e0c8fd49529dda850761631d5d5c`. Source and caller hashes are in [the manifest](./twenty-main-shared-loop-sites.json). Existing main-loop manifests, README prose and broader memory ledgers were checked before selecting these sites. The initial mechanical remainder list is only a candidate list; it does not establish that every omitted site was reviewed.
+
+No growing synchronous production iterator was established in this batch. One separate lifetime defect was reproduced: empty streamed deltas grow a retained array without consuming the byte budget. Ordinary RPC and Jira capacity findings remain conditional.
+
+| Site                                                                                                  | Progress and ownership                                                                                                                                                                                                                                                                                                                                                                        | Limits / outcome                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| ----------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `src/main/computer/macos-native-provider-transport.ts:74`                                             | Newline consumption strictly shortens pending text; no newline returns. The caller clears pending text on shutdown, socket close/error and process replacement. Every request has a 60-second timer that shuts down this client.                                                                                                                                                              | No line-byte cap in this class. Complete helper JSON and newline-less traffic can allocate input-sized memory before timeout. No ordinary runaway helper producer or persistent leak established.                                                                                                                                                                                                                                                                                  |
+| `src/main/runtime/rpc/unix-socket-transport.ts:127,155`                                               | Each line is consumed before dispatch. The per-connection cleanup Set removes replied requests; close aborts every remaining controller, clears the Set and removes the socket. Input admission is 1 MiB, active connections 32 and socket idle lifetime 30 seconds. Actual admission caps long polls at 16, with narrower specialized classes.                                               | Ordinary requests explicitly bypass long-poll counters and receive no abort signal at dispatcher invocation. A bounded actual-auth/dispatcher/method control defers worktree.list and tests concurrent calls, socket close and provider settlement. This is a conditional capacity boundary, not an established indefinite production stall or incident attribution.                                                                                                               |
+| `src/main/orcad/orcad-sidecar-runtime-client.ts:87`                                                   | Response parsing consumes through a newline, skips blank lines, and stops at settlement. Response allowance is 64 MiB per request. A timer defaults to 90 seconds; valid keepalive frames refresh it. Finish is idempotent, clears the timer and ends the socket; timeout/error destroys it.                                                                                                  | Keepalives make this an idle deadline, not an absolute wall-clock deadline. Extra data after a terminal response can still enter the data handler until peer/socket close, bounded by the same response cap. No ordinary continuing-after-result producer or persistent ownership leak established. Concurrent requests multiply the allowance.                                                                                                                                    |
+| `src/main/jira/request-queue.ts:47`                                                                   | Release shifts each queued waiter before granting or skipping it; abort removes a queued entry, and grant removes its abort listener. Four requests run concurrently. Reviewed read/search/mutation/metadata callers release acquired slots in finally.                                                                                                                                       | The waiter queue has no count or byte cap. Some callers omit AbortSignal. Authenticated fetch has no common request timeout in this layer. Four prolonged network operations plus further requests can accumulate queued closures, but no sustained production retry/poll producer or actual indefinite network stall has been demonstrated.                                                                                                                                       |
+| `src/main/automations/external-automation-probe-scheduler.ts:126,134,142`                             | Pump shifts entries before starting; active ownership is set before running. Production concurrency is four; identical keys coalesce. Final settlement removes active/shared ownership and pumps again. Queued cancellation removes the entry; active cancellation rejects the consumer but holds its real slot until provider settlement. Priority hold release is idempotent.               | Queue count/bytes are separate from running concurrency. Production run callbacks are async. Local command lookup has a five-second timeout and SSH mux requests default to 30 seconds; local JSON filesystem reads remain OS-lifetime dependent. No ordinary indefinitely pending producer established; custom NaN capacity or synchronous callback throws were not promoted as production findings.                                                                              |
+| `src/main/daemon/terminal-history-seed-chunks.ts:23,35,67`                                            | The chunk end advances, or a surrogate-boundary adjustment is forced forward by one unit. Cross-segment surrogate carry is at most one UTF-16 unit. Chunks are 512 Ki UTF-16 units and inline mode stops at 1 Mi units. The actual daemon spawn sender awaits each append request before requesting the next chunk; failure aborts the transfer.                                              | This bounds transferred chunks and pending requests, not the original seed segments retained while the spawn is pending. Substring backing memory and measurement Buffers are separate. Completed spawn input lifetime is covered by its existing dedicated artifact; no new growing loop identified here.                                                                                                                                                                         |
+| `src/main/daemon/terminal-history-restorable-retention.ts:18,37,49`                                   | The min-heap keeps the newest 10,000 metadata entries by default. Sift descends to a child index or stops; production enumeration reads one directory entry at a time and closes the directory in finally.                                                                                                                                                                                    | The scan may visit arbitrarily many directory entries even though the retained heap is bounded. Entry metadata/string bytes are not charged by the count. No custom invalid limit was found in production, and no non-progressing loop or additional retained owner was established.                                                                                                                                                                                               |
+| `src/main/daemon/daemon-health.ts:77,189`                                                             | Both health parsers consume a full line or await more data. A three-second absolute timer settles each probe. Settlement clears its timer, removes owned listeners and destroys the socket.                                                                                                                                                                                                   | There is no input-byte cap during the three-second probe. Ordinary local-daemon health replies are small; a large finite input remains possible. No lifetime beyond the owned socket/timer was established.                                                                                                                                                                                                                                                                        |
+| `src/main/daemon/daemon-durable-history-snapshot.ts:81,110,156,169`                                   | Ownership replay slices past each complete shell lifecycle trigger. The scanner clears its armed state and retained tail on a complete trigger, and the returned trigger end advances beyond the incomplete prior prefix. The scratch emulator is always disposed in finally after success or fallback.                                                                                       | History and replay inputs are finite but input-sized; scrollback is capped separately from dimensions. Newline counting splits the ANSI string transiently. No persistent growing collection was established in this function.                                                                                                                                                                                                                                                     |
+| `src/main/daemon/terminal-shell-recovery-barrier.ts:101,118,153,232,300,334`                          | Recovery replay consumes scanner triggers and limits nested recovery episodes to 16. Output waiting on proof has a 750-ms timer and defaults to 262,144 code units; overflow ends the episode and flushes. Disposal clears timer, queue and idle waiters; stale episode/generation checks reject obsolete proof completions.                                                                  | The quantity called bytes is string length; one incoming chunk is pushed before overflow handling. Async raw proof lifetime can exceed the logical wait deadline. Reviewed ownership is per live session, not a global byte bound or proof that an OS probe always settles.                                                                                                                                                                                                        |
+| `src/main/daemon/terminal-view-attribute-responder.ts:86,110,145`                                     | OSC palette parsing removes two slots per iteration. Color override keys are restricted to valid ANSI indices or the three special colors. HeadlessEmulator registers these handlers once; xterm disposal owns handler lifetime and explicit clearing removes overrides.                                                                                                                      | Splitting the OSC payload is input-sized and repeated shift can be quadratic, but the loop does not add slots. Parser admission and terminal dimensions are separate bounds; no additional lifetime leak established.                                                                                                                                                                                                                                                              |
+| `src/main/daemon/terminal-mouse-mode-mirror.ts:54,63`                                                 | Positive-width escape regex matches advance. Parameter iteration is finite and only scalar mouse modes survive. Incomplete prefixes are logically limited to 4,096 code units. Actual HeadlessEmulator parsed-write and synchronous-write paths feed this mirror.                                                                                                                             | The retained suffix is sliced from the full input. This is a sibling of the already assigned kitty escape-tail backing-string candidate, not a separately counted new mechanism. The completed Node/Electron backing-memory proof and accepted-tail copy correction are in [terminal mode tail retention](../terminal-mode-tail-retention/README.md), published as an extension of #20960. This row records the earlier static review.                                             |
+| `src/main/daemon/startup-device-attributes-responder.ts:34`                                           | DA1 filtering consumes a complete query, advances past an unmatched candidate, or retains a proper prefix of one of two short queries. Release returns and clears the pending prefix; SessionOutputPlane releases filter authority and forwards any held data.                                                                                                                                | The incomplete prefix is at most three UTF-16 units, while returned output is input-sized. No growing loop identified; short string length alone is not an allocator backing-storage measurement.                                                                                                                                                                                                                                                                                  |
+| `src/main/runtime/worktree-terminal-mutation-lock.ts:131`                                             | Drain shifts before granting. Shared grants increment active spawn count; an exclusive grant blocks the next iteration. Promise continuations run after the synchronous drain. Release is idempotent and removes an empty state only when it is still the current owner. Deadline rejection removes its queued entry.                                                                         | A live operation can hold ownership until actual completion and callers without deadlines can wait without a count/byte cap. Production shared spawn and exclusive mutation callers release in finally. No indefinitely pending native producer or byte-growth incident was established.                                                                                                                                                                                           |
+| `src/main/native-chat/agent-session-wire/structured-conversation-command-controller.ts:63,77`         | Replacement traversal follows one link per step, memoizes resolved destinations and breaks cycles through a per-walk visited Set. Command ownership is a per-session operation key plus refcount; a finally path decrements and deletes the exact final entry.                                                                                                                                | Record/index/visited allocations scale with the input history. A pending command retains its ownership until settlement; no ended-owner growth established. No universal history-byte limit is proved by this loop.                                                                                                                                                                                                                                                                |
+| `src/main/skills/skill-package-deterministic-gzip.ts:32`                                              | Gzip staging is a 65,535-byte pending Buffer. Each copy advances offset; filling the buffer emits a stored block and resets its pending count. The archive writer awaits backpressure and pipes through compressed-byte admission to the file sink; failures destroy the gzip stream and await sink settlement.                                                                               | Transform.push can queue output for the current incoming chunk before upstream backpressure resumes. This bounds staging, not all transient bytes of an arbitrarily large already-admitted input chunk. No self-growing loop found.                                                                                                                                                                                                                                                |
+| `src/main/native-chat/agent-session-wire/agent-session-delta-coalescer.ts:119,134,247`                | Ordinary stream eviction removes a selected stream, removes a newly protected entry from the evictable set, or returns under backpressure. UTF-8 truncation decrements a byte offset. Production Codex keys include a colon and Claude keys include provider identity, so the artificial empty-key branch is not a demonstrated caller case.                                                  | New separate candidate: empty delta strings append a persistent chunks-array slot while both byte counters remain zero; flush joins without compacting. Actual Codex stream control retains 16,384→65,536 slots across four flushes. Forget/dispose clear them. Narrow approved candidate guards only the push and preserves stream creation, dirty publication, timer and admission semantics. Nonempty tiny-chunk overhead and transient overflow concatenation remain separate. |
+| `src/main/native-chat/agent-session-wire/agent-session-history-page-bounds.ts:72,98,102,110,125`      | Each whole-sequence group advances the cursor to a distinct run boundary. Byte bounding emits admitted groups or truncates the first oversized group then stops. The submissions cache uses a WeakMap keyed by the existing snapshot array.                                                                                                                                                   | JSON serialization happens before admission and a single atomic sequence group can exceed an item-count target. Text truncation does not prove total group-frame overhead is under the budget. Original snapshots are separately owned; no new persistent strong cache root established.                                                                                                                                                                                           |
+| `src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.ts:130,168,186,205,236` | Catch-up sends a page only while its sequence advances; no advancement, no newer rows or subscriber removal returns. Fan-out traverses snapshots of subscriber values. Close and emit failure remove the subscriber and delete an empty session map. Provider ended/turn-settlement paths explicitly publish null activity before ordinary sink teardown drains.                              | Per-page bounds do not by themselves bound all queued outbound transport bytes. ActivityBySession clears on null publication rather than subscriber disconnect; ordinary ended paths provide that publication. Failed/aborted sink ownership remains a separate exceptional-lifecycle question, not a proved leak here. No synchronous journal append from the reviewed transport emit path was established.                                                                       |
+| `src/shared/pty-startup-ingress.ts:119,181,252,301`                                                   | Serial drain shifts operations before execution and guards reentry. Echo/query scanning consumes a positive-width match, advances an escape candidate, or returns with an incomplete suffix. Query tails are limited to 64 units; echo hold is 500 ms; startup teardown closes timers and delivery. Expected echoes are capped at 64 with a 256 KiB search allowance, reduced after deadline. | Production native output arrives asynchronously; no callback was found that synchronously re-enqueues forever. Source-span slices and current input ownership require a separate backing-storage analysis. Query/echo limits are per ingress owner, not whole-process byte bounds.                                                                                                                                                                                                 |
+
+## Bounded proofs and next steps
+
+- Empty-delta proof: `empty-delta-probe.cjs` and `empty-delta-results.json`. The original early-return experiment changed empty-stream publication semantics and is superseded by docs/audits/empty-streamed-delta-retention/, whose narrow array-push guard preserves all recorded publication and scheduling behavior. Measurement instrumentation only reads the private map/array cardinality. Counts are not heap or RSS measurements.
+- [Ordinary RPC proof](../rpc-inflight-admission-review/README.md): actual transport parser, auth/admission prototype, dispatcher and production method handlers, with an inert socket, explicit admission counters and deliberately delayed provider. This establishes admission scope, not an ordinary indefinitely pending native operation.
+- Mouse-tail backing memory is included with the kitty-tail correction in #20960; it is not another independently counted PR.
+- Jira queue requires a real caller-pressure and network-lifetime control before promotion. The existing finally/abort cleanup must be preserved.
+- No process kill, remote liveness policy, wire schema, UI, or product change is part of this 20-site review.
@@ -37,10 +37,37 @@
      "state": "open",
      "match": "title",
      "limit": 100
+    },
+    {
+      "term": "heap",
+      "state": "open",
+      "match": "title",
+      "limit": 100
+    },
+    {
+      "term": "RSS",
+      "state": "open",
+      "match": "title",
+      "limit": 100
+    },
+    {
+      "term": "swap",
+      "state": "open",
+      "match": "title",
+      "limit": 100
    }
  ],
-  "note": "Original58 title matches plus3 later matches;60 currently open. All six latest searches fit one100-result page with hasNextPage=false. Duplicate editor reports21121/21122 remain individually accounted. Body-search reports are also recorded in the correlation ledger; keyword matches alone do not establish memory retention.",
+  "note": "67 catalog rows:58 original title matches plus9 later matches;66 currently open. All nine latest searches fit one100-result page with hasNextPage=false. Duplicate editor reports21121/21122 remain individually accounted. Body-search reports are also recorded in the correlation ledger; keyword matches alone do not establish memory retention.",
  "issues": [
+    {
+      "number": 1355,
+      "title": "[Feature]: Add a setting to swap left and right sidebar sides",
+      "url": "https://github.com/stablyai/orca/issues/1355",
+      "scope": "adjacent-or-unrelated",
+      "triage": "Sidebar-side swap feature; layout preference, not memory or process retention.",
+      "openTitleMatchAtRecheck": true,
+      "commentsReviewed": 5
+    },
    {
      "number": 7175,
      "title": "[Bug] Windows: 'Not responding' and crash when running more than 3 sessions in parallel (32GB RAM)",
@@ -51,7 +78,7 @@
    },
    {
      "number": 7410,
-      "title": "on submidule-heavy repos, worktree create hangs ~30s → runtime_unavailable and orphans a git worktree on submodule-heavy repos under load (macOS 1.4.121)",
+      "title": "on submidule-heavy repos, worktree create hangs ~30s \u2192 runtime_unavailable and orphans a git worktree on submodule-heavy repos under load (macOS 1.4.121)",
      "url": "https://github.com/stablyai/orca/issues/7410",
      "scope": "adjacent-or-unrelated",
      "triage": "Git worktree directory orphan; disk/transaction cleanup, not reported RAM retention.",
@@ -59,7 +86,7 @@
    },
    {
      "number": 8362,
-      "title": "node-pty in the remote relay leaks PTY master fds (no FD_CLOEXEC after forkpty) — later children can inherit earlier terminals' masters",
+      "title": "node-pty in the remote relay leaks PTY master fds (no FD_CLOEXEC after forkpty) \u2014 later children can inherit earlier terminals' masters",
      "url": "https://github.com/stablyai/orca/issues/8362",
      "scope": "memory-or-process-resource",
      "triage": "See memory-leak-scan-2026-09-15.md issue correlation.",
@@ -75,7 +102,7 @@
    },
    {
      "number": 8928,
-      "title": "[Feature] Add Nushell as a first-class supported shell — 500MB+ RAM and ~1s cold-start savings for the headline 5-worktree use case",
+      "title": "[Feature] Add Nushell as a first-class supported shell \u2014 500MB+ RAM and ~1s cold-start savings for the headline 5-worktree use case",
      "url": "https://github.com/stablyai/orca/issues/8928",
      "scope": "adjacent-or-unrelated",
      "triage": "Feature request comparing normal shell working sets; no leak claim.",
@@ -83,7 +110,7 @@
    },
    {
      "number": 9138,
-      "title": "[Bug]: App updates leave previous daemon generations running forever — invisible agent sessions accumulate and exhaust memory",
+      "title": "[Bug]: App updates leave previous daemon generations running forever \u2014 invisible agent sessions accumulate and exhaust memory",
      "url": "https://github.com/stablyai/orca/issues/9138",
      "scope": "memory-or-process-resource",
      "triage": "See memory-leak-scan-2026-09-15.md issue correlation.",
@@ -131,15 +158,24 @@
    },
    {
      "number": 10358,
-      "title": "[Bug]: Windows remote env — \"Timed out waiting for terminal handle after creation\" on Ctrl+T; ConPTY console host leaks and only a full restart recovers",
+      "title": "[Bug]: Windows remote env \u2014 \"Timed out waiting for terminal handle after creation\" on Ctrl+T; ConPTY console host leaks and only a full restart recovers",
      "url": "https://github.com/stablyai/orca/issues/10358",
      "scope": "memory-or-process-resource",
      "triage": "See memory-leak-scan-2026-09-15.md issue correlation.",
      "openTitleMatchAtRecheck": true
    },
+    {
+      "number": 10382,
+      "title": "[Bug]: Silent renderer crashes (exit_code 5, reason \"crashed\") recurring every ~2 min on macOS v1.4.152 \u2014 no unhandled rejection, heap healthy, auto-recovers",
+      "url": "https://github.com/stablyai/orca/issues/10382",
+      "scope": "memory-or-process-resource",
+      "triage": "Renderer exit-code-5 report with low last sampled JS heap in one cohort. Comments report both near-limit and low-heap cohorts; cached/quantized historical telemetry cannot attribute native failure. Current heap telemetry and crash-classification source audit is recorded separately; no affected-host reproduction.",
+      "openTitleMatchAtRecheck": true,
+      "commentsReviewed": 2
+    },
    {
      "number": 10493,
-      "title": "[Bug]: macOS — unbounded agent process growth panics the kernel (watchdogd timeout); RunAtLoad+KeepAlive turns it into a reboot loop",
+      "title": "[Bug]: macOS \u2014 unbounded agent process growth panics the kernel (watchdogd timeout); RunAtLoad+KeepAlive turns it into a reboot loop",
      "url": "https://github.com/stablyai/orca/issues/10493",
      "scope": "memory-or-process-resource",
      "triage": "See memory-leak-scan-2026-09-15.md issue correlation.",
@@ -155,7 +191,7 @@
    },
    {
      "number": 11218,
-      "title": "[Bug]: Sudden CPU/memory runaway with two worktrees in one workspace — Resource Manager reports 135 GB (211% of system RAM) on a 64 GB Mac, machine froze and required force power-off",
+      "title": "[Bug]: Sudden CPU/memory runaway with two worktrees in one workspace \u2014 Resource Manager reports 135 GB (211% of system RAM) on a 64 GB Mac, machine froze and required force power-off",
      "url": "https://github.com/stablyai/orca/issues/11218",
      "scope": "memory-or-process-resource",
      "triage": "See memory-leak-scan-2026-09-15.md issue correlation.",
@@ -163,7 +199,7 @@
    },
    {
      "number": 11342,
-      "title": "[Bug]: Terminal pty leaks — stale daemons survive upgrade, ptys survive tab close, `orphaned` flag unreliable",
+      "title": "[Bug]: Terminal pty leaks \u2014 stale daemons survive upgrade, ptys survive tab close, `orphaned` flag unreliable",
      "url": "https://github.com/stablyai/orca/issues/11342",
      "scope": "memory-or-process-resource",
      "triage": "See memory-leak-scan-2026-09-15.md issue correlation.",
@@ -185,9 +221,18 @@
      "triage": "Orphan workspace identity/UI metadata; no live-process or RAM evidence.",
      "openTitleMatchAtRecheck": true
    },
+    {
+      "number": 11824,
+      "title": "[Bug]: WSL account switching replaces the entire CLAUDE_CONFIG_DIR profile (host runtime does an auth-only swap) \u2014 switched sessions lose settings, plugins, statusline",
+      "url": "https://github.com/stablyai/orca/issues/11824",
+      "scope": "adjacent-or-unrelated",
+      "triage": "WSL account profile swap loses settings; configuration identity, not reported RAM retention.",
+      "openTitleMatchAtRecheck": true,
+      "commentsReviewed": 0
+    },
    {
      "number": 11904,
-      "title": "Tab close during a broken pane binding orphans the daemon session — kill intent is fire-and-forget",
+      "title": "Tab close during a broken pane binding orphans the daemon session \u2014 kill intent is fire-and-forget",
      "url": "https://github.com/stablyai/orca/issues/11904",
      "scope": "memory-or-process-resource",
      "triage": "See memory-leak-scan-2026-09-15.md issue correlation.",
@@ -203,7 +248,7 @@
    },
    {
      "number": 11993,
-      "title": "Orphaned adopted Run cannot be taken over — run-use and --takeover-legacy both refuse, tasks stuck in dispatched forever",
+      "title": "Orphaned adopted Run cannot be taken over \u2014 run-use and --takeover-legacy both refuse, tasks stuck in dispatched forever",
      "url": "https://github.com/stablyai/orca/issues/11993",
      "scope": "adjacent-or-unrelated",
      "triage": "Orchestration takeover/state policy; no memory-growth evidence.",
@@ -211,7 +256,7 @@
    },
    {
      "number": 12243,
-      "title": "Orphaned daemon processes accumulate silently across app restarts/crashes — no cross-launch reaping",
+      "title": "Orphaned daemon processes accumulate silently across app restarts/crashes \u2014 no cross-launch reaping",
      "url": "https://github.com/stablyai/orca/issues/12243",
      "scope": "memory-or-process-resource",
      "triage": "See memory-leak-scan-2026-09-15.md issue correlation.",
@@ -259,12 +304,21 @@
    },
    {
      "number": 13011,
-      "title": "[Bug]: `orca worktree create` can't create a branch containing `/` — sanitized worktree name leaks into the branch name",
+      "title": "[Bug]: `orca worktree create` can't create a branch containing `/` \u2014 sanitized worktree name leaks into the branch name",
      "url": "https://github.com/stablyai/orca/issues/13011",
      "scope": "adjacent-or-unrelated",
      "triage": "Branch-name sanitization defect; 'leak' describes wrong text.",
      "openTitleMatchAtRecheck": true
    },
+    {
+      "number": 13171,
+      "title": "Update installer swaps app.asar under the running renderer, corrupting lazy chunks (root cause of the corrupt-chunk crash cluster)",
+      "url": "https://github.com/stablyai/orca/issues/13171",
+      "scope": "adjacent-or-unrelated",
+      "triage": "Updater app.asar replacement invalidates lazy chunk offsets in a running renderer. Reported archive/disk crash mechanism, not demonstrated memory retention; audit did not independently rerun that updater reproduction.",
+      "openTitleMatchAtRecheck": true,
+      "commentsReviewed": 1
+    },
    {
      "number": 13764,
      "title": "macOS: TCC login-shell wrapper leaks PTYs (session-kill-failed, session-closed never fires)",
@@ -273,6 +327,15 @@
      "triage": "See memory-leak-scan-2026-09-15.md issue correlation.",
      "openTitleMatchAtRecheck": true
    },
+    {
+      "number": 13852,
+      "title": "[Bug]: Direct SSH: updating Orca strands all remote terminals and running agent sessions (relay version swap)",
+      "url": "https://github.com/stablyai/orca/issues/13852",
+      "scope": "memory-or-process-resource",
+      "triage": "Build-hash relay endpoint and exact handshake version isolate successive builds, stranding old remote sessions. Existing discovery retains live owners; docs-only PR17972 does not restore cross-version attach. Field comment reports19 relay processes/839MB combined RSS; this audit did not measure that host. Safe adoption needs compatibility design, not loss-of-contact reaping.",
+      "openTitleMatchAtRecheck": true,
+      "commentsReviewed": 6
+    },
    {
      "number": 14316,
      "title": "[Bug]: Re-registering a repo mints a new UUID, orphaning live terminals into an \"Unknown\" heading with no re-bind path",
@@ -291,7 +354,7 @@
    },
    {
      "number": 14549,
-      "title": "Renderer killed with SIGKILL (exit 9) — 5 occurrences in 2 days, low memory footprint",
+      "title": "Renderer killed with SIGKILL (exit 9) \u2014 5 occurrences in 2 days, low memory footprint",
      "url": "https://github.com/stablyai/orca/issues/14549",
      "scope": "memory-or-process-resource",
      "triage": "See memory-leak-scan-2026-09-15.md issue correlation.",
@@ -331,7 +394,7 @@
    },
    {
      "number": 15909,
-      "title": "[Bug]: Live PTY orphaned with no tab row in a non-empty tabsByWorktree — blank pane, permanent terminal_pane_owner_changed",
+      "title": "[Bug]: Live PTY orphaned with no tab row in a non-empty tabsByWorktree \u2014 blank pane, permanent terminal_pane_owner_changed",
      "url": "https://github.com/stablyai/orca/issues/15909",
      "scope": "memory-or-process-resource",
      "triage": "See memory-leak-scan-2026-09-15.md issue correlation.",
@@ -361,6 +424,15 @@
      "triage": "Terminal color-query replies become input; not resource leakage.",
      "openTitleMatchAtRecheck": true
    },
+    {
+      "number": 16703,
+      "title": "[Bug]: Tab header CLI agent icons randomly swap or render incorrectly during active sessions / orchestration",
+      "url": "https://github.com/stablyai/orca/issues/16703",
+      "scope": "adjacent-or-unrelated",
+      "triage": "Windows agent icons swap identity; status presentation, not reported memory retention.",
+      "openTitleMatchAtRecheck": true,
+      "commentsReviewed": 1
+    },
    {
      "number": 16714,
      "title": "Hand-typed agent sessions (claude/codex in a plain shell) leak their process tree on tab close",
@@ -371,7 +443,7 @@
    },
    {
      "number": 16905,
-      "title": "[Bug]: orca-terminal-daemon still spawns powershell.exe every ~2s on v1.4.190 (partial fix from #15209 / #15749) — memory collector + identity probes not migrated to native process-tree reader",
+      "title": "[Bug]: orca-terminal-daemon still spawns powershell.exe every ~2s on v1.4.190 (partial fix from #15209 / #15749) \u2014 memory collector + identity probes not migrated to native process-tree reader",
      "url": "https://github.com/stablyai/orca/issues/16905",
      "scope": "memory-or-process-resource",
      "triage": "See memory-leak-scan-2026-09-15.md issue correlation.",
@@ -395,7 +467,7 @@
    },
    {
      "number": 17298,
-      "title": "session-kill-failed drops the underlying error, and non-immediate kill never verifies death — leaked PTYs are indistinguishable from benign ones in daemon.log",
+      "title": "session-kill-failed drops the underlying error, and non-immediate kill never verifies death \u2014 leaked PTYs are indistinguishable from benign ones in daemon.log",
      "url": "https://github.com/stablyai/orca/issues/17298",
      "scope": "memory-or-process-resource",
      "triage": "See memory-leak-scan-2026-09-15.md issue correlation.",
@@ -411,7 +483,7 @@
    },
    {
      "number": 18789,
-      "title": "[Bug]: worker-terminal reap leak on the headless serve — unbounded process/memory growth (OOM) or cgroup PID exhaustion (EAGAIN) crashes the serve and co-tenant agents",
+      "title": "[Bug]: worker-terminal reap leak on the headless serve \u2014 unbounded process/memory growth (OOM) or cgroup PID exhaustion (EAGAIN) crashes the serve and co-tenant agents",
      "url": "https://github.com/stablyai/orca/issues/18789",
      "scope": "memory-or-process-resource",
      "triage": "See memory-leak-scan-2026-09-15.md issue correlation.",
@@ -419,7 +491,7 @@
    },
    {
      "number": 18803,
-      "title": "[Bug]: federation worker reap leaks the live PTY on a stale durable handle — the federation twin of #18737",
+      "title": "[Bug]: federation worker reap leaks the live PTY on a stale durable handle \u2014 the federation twin of #18737",
      "url": "https://github.com/stablyai/orca/issues/18803",
      "scope": "memory-or-process-resource",
      "triage": "See memory-leak-scan-2026-09-15.md issue correlation.",
@@ -475,7 +547,7 @@
    },
    {
      "number": 19831,
-      "title": "[Bug]: Unbounded memory growth on Linux — app OOM-killed after ~44h (16.2G RAM + 15.2G swap peak), second instance killed within 3 minutes",
+      "title": "[Bug]: Unbounded memory growth on Linux \u2014 app OOM-killed after ~44h (16.2G RAM + 15.2G swap peak), second instance killed within 3 minutes",
      "url": "https://github.com/stablyai/orca/issues/19831",
      "scope": "memory-or-process-resource",
      "triage": "See memory-leak-scan-2026-09-15.md issue correlation.",
@@ -507,7 +579,7 @@
    },
    {
      "number": 21066,
-      "title": "[Bug]: serve/headless: closed workspace tabs resurrect on workspace re-entry — orphan PTYs re-adopted, persisted tabs rehydrated without tombstone check",
+      "title": "[Bug]: serve/headless: closed workspace tabs resurrect on workspace re-entry \u2014 orphan PTYs re-adopted, persisted tabs rehydrated without tombstone check",
      "url": "https://github.com/stablyai/orca/issues/21066",
      "scope": "memory-or-process-resource",
      "triage": "Headless/mobile tab resurrection; actual host close, persistence and adoption authority under code review.",
@@ -530,8 +602,8 @@
      "openTitleMatchAtRecheck": true
    }
  ],
-  "recheckedAtUtc": "2026-09-17T02:29:40.666932+00:00",
-  "recheckTitleMatches": 60,
+  "recheckedAtUtc": "2026-09-17T03:42:35.152687+00:00",
+  "recheckTitleMatches": 66,
  "recheckHasNextPage": false,
  "recheckQueryCounts": {
    "memory": 12,
@@ -539,7 +611,10 @@
    "leak": 28,
    "orphan": 20,
    "RAM": 6,
-    "growth": 3
+    "growth": 3,
+    "heap": 1,
+    "RSS": 0,
+    "swap": 6
  },
-  "recheckNewMatches": [21066, 21121, 21122]
+  "recheckNewMatches": [1355, 10382, 11824, 13171, 13852, 16703, 21066, 21121, 21122]
 }
@@ -1,6 +1,6 @@
 # Memory leak audit (2026-09-15)

-The audit produced **49 separate PRs**: 44 target `main`; five are stacked to reuse existing fixes and fixtures. Terminal-cell cleanup builds on the contrast-cache PR, reflow cleanup builds on terminal-cell cleanup, scoped remote pending-pane close builds on IPC pending-close, and queued-graph plus observed-exit fixes build on physical-exit reconciliation. The largest new
+The audit produced **52 separate PRs**: 47 target `main`; five are stacked to reuse existing fixes and fixtures. Terminal-cell cleanup builds on the contrast-cache PR, reflow cleanup builds on terminal-cell cleanup, scoped remote pending-pane close builds on IPC pending-close, and queued-graph plus observed-exit fixes build on physical-exit reconciliation. The largest new
 reproduced mechanisms are terminal hyperlink metadata retention, stalled daemon
 output, stalled CDP delivery, oversized strings retained by small text tails,
 unbounded transcript record assembly, invisible WebGL glyph caches, and contrast-color caches. They establish real defects in code paths that
@@ -60,10 +60,10 @@ found a race that could kill live work; it is excluded from the fix count. The l
 The [issue ledger](./memory-leak-scan-2026-09-15.md#github-memory-issue-correlation)
 accounts for the memory/process-resource title matches and additional reports
 from body searches. The [search index](./memory-issue-index-2026-09-15.json)
-preserves 58 original title matches plus three later reports, with explicit
-unrelated exclusions. The latest batched recheck found 60 open matches and #9141
-still absent. All six searches returned a complete first page below the 100-result
-cap. The new editor reports #21121/#21122 have identical bodies; four baseline
+preserves 58 original title matches plus nine later reports, with explicit
+unrelated exclusions. The expanded batched recheck found 66 open matches and #9141
+still absent. All nine searches, now including `heap`, `RSS` and `swap`, returned
+a complete first page below the 100-result cap. The editor reports #21121/#21122 have identical bodies; four baseline
 store controls and existing PRs #21124/#21125 are recorded in the
 [editor review](./editor-duplicate-issue-review/README.md). For headless/mobile
 [#21066](https://github.com/stablyai/orca/issues/21066), an initially unbound tab's
@@ -77,6 +77,13 @@ safe cleanup must also protect a newer live owner.
 The ledger separates reproduced retaining paths, ownership/cleanup gaps,
 intentional resource policies, historical fixes, and incidents without enough
 attribution evidence. It also records existing PRs rather than duplicating them.
+The expanded search adds renderer exit-code-5 report #10382 and SSH relay version
+swap #13852; four other new matches concern UI/configuration/archive swaps.
+The SSH stranding mechanism is explicit in current endpoint, handshake and
+cross-version isolation code. Existing discovery preserves live work; it does
+not restore attach across builds. The [renderer telemetry review](./renderer-exit5-telemetry/README.md)
+explains sampling limits and repeated recovery through 89 current tests and five
+historical actual-source controls. The renderer crash remains unattributed.
 In particular, Linux/Windows Chromium descriptor inheritance remains covered by
 [#16963](https://github.com/stablyai/orca/pull/16963); renderer string-slice cleanup
 from #13040 already exists in the reported release. The main and daemon xterm
@@ -123,20 +130,20 @@ because the retaining path crosses that boundary.

 | Category       | Inventoried files |
 | -------------- | ----------------: |
-| Source         |            25,659 |
-| Config         |               893 |
-| Documentation  |               300 |
-| Asset/other    |               226 |
-| **Total rows** |        **27,078** |
+| Source         |            25,685 |
+| Config         |               920 |
+| Documentation  |               311 |
+| Asset/other    |               231 |
+| **Total rows** |        **27,147** |

 The [file inventory](./memory-leak-file-inventory-2026-09-15.tsv) records size and
 SHA-256 for every tracked path except the inventory itself. That self-exclusion
-avoids a circular hash; symlinks are hashed as link text. Thus 27,078 rows plus
-the inventory account for 27,079 tracked paths. Hashes describe the final
+avoids a circular hash; symlinks are hashed as link text. Thus 27,147 rows plus
+the inventory account for 27,148 tracked paths. Hashes describe the final
 worktree contents, including staged evidence files, rather than only HEAD.

 The [mechanical search results](./memory-pattern-scan-2026-09-15.json) record
-25,659 source files searched, including 7,877 matching files, and per-file hits for
+25,685 source files searched, including 7,888 matching files, and per-file hits for
 listener, timer, subscription, disposal, Map/Set, buffer-concatenation and shared-promise signals. Zero-hit source
 files remain represented in the inventory. These searches include comments and
 tests; unequal add/remove counts do not establish a leak. Candidate review traced
@@ -200,3 +207,34 @@ The [speech-worker proof](./speech-worker-audio-queue/README.md) confirms 16 MiB
 [#21139](https://github.com/stablyai/orca/pull/21139) releases completed terminal spawn inputs captured by session-exit and foreground-confirmation callbacks. Three live sessions retain three sets of original options/environment/history before and zero after; the seeded terminal content remains readable. Actual admission narrows signal cleanup to stream detach. The 67-test run, desktop typechecks, independent admission review and post-commit proof pass. This path can run locally, but restore traffic and incident-scale retained bytes remain unproven. Native merged-environment capture is separate. [Artifacts](./terminal-completed-spawn-inputs/README.md).

 [#21140](https://github.com/stablyai/orca/pull/21140) removes that separate native-wrapper capture by copying its immutable exit-status boolean before registering the callback. Actual wrapper proofs release the merged environment and arguments while the native event owner stays live; PATH, exit interpretation, foreground lookup and disposal remain covered. The 114-test run, Node typecheck, independent review and post-commit proof pass. Environment strings may have other owners, so object collection does not imply equal RSS reduction. [Artifacts](./native-pty-spawn-env-retention/README.md).
+
+## Empty streamed output and terminal mode tails
+
+[#21142](https://github.com/stablyai/orca/pull/21142) prevents empty Codex text deltas from growing an array outside its byte accounting. Four batches retain 65,536 slots before and zero afterward, with identical scheduling and publication. Current and reported-release module overlays pass on Node and Electron. This is an entry-count reproduction; the incident frequency and byte contribution remain unknown. [Artifacts](./empty-streamed-delta-retention/README.md).
+
+The [#20960](https://github.com/stablyai/orca/pull/20960) follow-up copies retained kitty keyboard and headless mouse-mode scan tails. Ordinary 18-character unfinished sequences can retain their input chunk: 32 normal 64 Ki-character inputs keep about 2.1 MB before and owner-scale kilobytes afterward. All 98 focused tests and 84 Node/Electron proof cases pass. This remains a last-input cost per owner, with separate V8 regexp statics explicitly excluded from the measurement. [Artifacts](./terminal-mode-tail-retention/README.md).
+
+The same PR now covers plugin worker stdout/stderr tails and emitted log lines.
+Two hundred short log rows from 64 KiB inputs retain about 13.15 MB before and
+43 KB after; truncated rows keep their legitimate capped text. Worker stream end
+does not retire the service's log ring. Twenty tests and 48 Node/Electron cases
+pass independently, including both string copiers, UTF-16 and stream controls.
+This feature-gated path is bounded parent retention for fixed owners and chunk
+size, not proof of a production growth rate. [Artifacts](./plugin-worker-output-retention/README.md).
+
+## Shared filesystem waits and completed SSH writes
+
+[#21144](https://github.com/stablyai/orca/pull/21144) releases canceled working-directory
+callers while the shared native stat stays owned. Both runtimes release 32 signals
+without changing the one underlying operation, UNC slots or callback order.
+Thirty-one tests and 54 ordering/lifecycle cases per runtime pass; small empty
+reaction/holder records still remain until native settlement.
+[Artifacts](./working-directory-wait-retention/README.md).
+
+[#21150](https://github.com/stablyai/orca/pull/21150) clears completed SSH writer
+entries behind a rolling nonempty queue. Both runtimes drop 2,048 completed
+buffers/callbacks to zero while retaining the same two queued frames. A real
+Node writable control preserves the in-flight buffer and releases 127 completed
+ones. Thirty-one tests, independent scheduling review and both runtime proofs
+pass. This SSH mechanism does not explain #19831's all-local workload.
+[Artifacts](./ssh-writer-consumed-prefix/README.md).
@@ -1313,6 +1313,19 @@ documentation	2988	efe18c39a541d266aebc712beed55292b47fec4ca9363671890cc3d942e94
 source	3844	3ec4beeff6383293aafb7c322d024454aa6a1b22427b05baaebe33d3520c2f54	docs/audits/editor-duplicate-issue-review/baseline.test.ts
 source	180	23ff35e4b5b1a94d17070a49e8a0caa0bea75daa535800f4463d1e0198f97950	docs/audits/editor-duplicate-issue-review/config.mjs
 config	2118	e5323f8ca0915e2ee9475e6946d93ce4bfa9389a695ac96b739435bca289a0fb	docs/audits/editor-duplicate-issue-review/results.json
+documentation	4695	494a196201b23524e9cf13e99abc52611633d47b96aa34c576da8e28a9bee9d1	docs/audits/empty-streamed-delta-retention/README.md
+source	867	a55e7576be2348edddc137af9c34fca4323bd060d325a1140ab0ede66618c6e9	docs/audits/empty-streamed-delta-retention/before.config.mjs
+config	22983	1ba7c0dd598244cc8c5af9643823470198bf4409deae60939f13dc5dc4b716d5	docs/audits/empty-streamed-delta-retention/electron-results.json
+asset-or-other	264	06f11750dcd64042b7f208b00ae0feb3e0bdea6d5db66b3823ce063fce8ab97a	docs/audits/empty-streamed-delta-retention/fix.patch
+config	22935	a858b703a1c94c2bc4bc817f244a76fb84bd4ea4cb2dbbb6688acef91d25905d	docs/audits/empty-streamed-delta-retention/node-results.json
+asset-or-other	2075	9d340925bd2a875334a1a4c3ce58c4ba0f977c66bf0c6f5d66848f862fc95d59	docs/audits/empty-streamed-delta-retention/reported.patch
+source	2198	e55b45abda1a7c6078cc3fc867f2553cf9ed6ffea10fbffdb61c99494d797fe1	docs/audits/empty-streamed-delta-retention/reproduce.cjs
+source	5120	66cfb53b821f631d2f57988c2fab5d28aa0da95fb4a6a3a2b8b643a82d233550	docs/audits/empty-streamed-delta-retention/scenario.cjs
+config	5725	1038900fcbc3310ae4b38eb8603d0eea3d6a417c3835a70f3537d27eee6debc9	docs/audits/empty-streamed-delta-retention/source-versions.json
+source	4347	7902098e4cd0e07825684c778d7d2af74ba1438a55ccf0b9ffe6eb96f76698c8	docs/audits/empty-streamed-delta-retention/sources.cjs
+config	2999	8ede959faa9e648ec68561fa601e3b4b938d5048466b6da4fa9ddf1ca5e48009	docs/audits/empty-streamed-delta-retention/validation.json
+documentation	5889	9f52b8a6487fb3d4d2779f27c6bd62c6b235a2c7aaa7778e0fa77636578ba5fc	docs/audits/expanded-memory-issue-review/README.md
+config	6415	dd69af24537bc646bc2d3d05234d21d4c32117f8361d551e504c4fefa9248bed	docs/audits/expanded-memory-issue-review/source-hashes.json
 documentation	4121	9a5bde77f676ff65779f040d360ae7c26311300279f1ce2760bec83dbae0a922	docs/audits/gitlab-known-host-retirement/README.md
 config	2891	7bf29467de4d24737f5e2a92ac090fd8812da4efccf401b22df715b40fc2a281	docs/audits/gitlab-known-host-retirement/electron-results.json
 asset-or-other	4646	695c929087006b3406ce2c30a7ab783d88af3f9675f4ea320dc7f98b8476be9f	docs/audits/gitlab-known-host-retirement/fix.patch
@@ -1362,22 +1375,31 @@ documentation	8117	a644dead620cdbd7fde16f14f8bdb1428e5aa77f7697793a8626cdf4e9258
 source	5631	8b4ed9c4fa7db26b8c4e7d32e87ce1f711a1bcab8e459c28d1e03b9f954dae4c	docs/audits/macos-allocation-tags/probe.cjs
 config	71070	70c78c716e363a361c7242ba7ac1f0289a447050a69d1e9c13632b740249bc98	docs/audits/macos-allocation-tags/results.json
 config	12839	4f8c0af2d8a5a27ec2f7958b84fcd5b4a102348bd7dde0b38e7e8206a20853bb	docs/audits/macos-allocation-tags/sources.json
-documentation	12671	9a9214e31acc24b6c1edd43604685fabc4c72a591e4667b66a21e0f6faa9155c	docs/audits/main-collection-loop-review/README.md
+documentation	15211	df916a40f524922614434844b6483128b1121229b862d45a4893a5b930532078	docs/audits/main-collection-loop-review/README.md
 config	16380	00c9d8f79d2b96b5d1a62b49558f6daf880d7c221a9bb4a882df28bf4fbe38d3	docs/audits/main-collection-loop-review/additional-sites.json
 documentation	19251	e42e3b117025fc7b82d159ecd44f802f6ef8a02cc530276b38e5c66cf2d0ee15	docs/audits/main-collection-loop-review/additional-sites.md
+config	5296	b96321b74befb9e5906327bb4fb5f4c455cd5117eedc4349ccaf0152e7b9253c	docs/audits/main-collection-loop-review/byte-accounting-and-wait-boundaries.json
+documentation	13785	6008740f5f5b99da7f9621cc8fc11d96ea8eed6d0bb5c7571ba2d23813e6dce9	docs/audits/main-collection-loop-review/byte-accounting-and-wait-boundaries.md
+config	1651	e6fbc6cf67adde832dd39613e96c89a82f07477d4eda403be0bf0fb84a40ed74	docs/audits/main-collection-loop-review/consumed-prefix-comparison.json
 config	3466	00b483a55e2cec82efc6c193c0656330c288e17791e97a0addee6f4d55159d7c	docs/audits/main-collection-loop-review/further-progress-sites.json
 documentation	8041	b0eb03be396689479bd9023768ac9f8eef6032dd4727bb21cea2855bc3ad52c7	docs/audits/main-collection-loop-review/further-progress-sites.md
+source	3216	055649a287cfde2c8694d1f18d4b580a07b6cdfa65dd1056b3f0bd704715c406	docs/audits/main-collection-loop-review/outbound-cancellation-slot-probe.cjs
+config	1854	eaaa47ca0931e399e45a8b1c8adc0a46984f69af332519e861d41d9fa4fc2b33	docs/audits/main-collection-loop-review/outbound-cancellation-slot-results.json
 config	4868	498ab3e7e73b9756d28925d899529bf6ea69e0f166fa23965c7288ff9b9ab103	docs/audits/main-collection-loop-review/results.json
 source	3533	b5b299012619cbd25380ef2fd4768c7e852338c8c42abfd7cb2963f394bbaadb	docs/audits/main-collection-loop-review/scan.cjs
+config	12263	3facd5339219ea33cac15e4e012a7d4e85ed749a43e97db3c82bbba270f9712a	docs/audits/main-collection-loop-review/six-stream-accounting-sites.json
+documentation	10151	e9bff83d2e0fa6aff81ca6002caff9e8115ca6cd6da2f94f0577dac9152d9a8b	docs/audits/main-collection-loop-review/six-stream-accounting-sites.md
 config	6136	912c063cae2102a79c709b2eab986543ef4ff8a7c4ede0d40089b63bc3f240ce	docs/audits/main-collection-loop-review/twelve-retention-sites.json
 documentation	5167	3a0f7dcda0be37c7fa48e895417071e2e36339a6494d8ffd3613b5af2a1f5eaf	docs/audits/main-collection-loop-review/twelve-retention-sites.md
 config	25804	ae46fbf30754dc5380069285e84950e6ba774586074f9c3c9b9627aeae08a84b	docs/audits/main-collection-loop-review/twenty-additional-sites.json
 documentation	23472	9b5047e5d0b67fc39d0dc9928fa84471dd4236621dfe2d8a97635d01e8051a9d	docs/audits/main-collection-loop-review/twenty-additional-sites.md
-config	25561	03985611d7b714ab2063b85508e1fb0eaa825fba6af4cd79845151f862c7f277	docs/audits/memory-issue-index-2026-09-15.json
-documentation	37884	9004f2464b21247e32f7ec9d6bb6e92ec8291f8407d9f9f2484ae9b218b98466	docs/audits/memory-leak-audit-2026-09-15.md
-documentation	246260	1e999d52409112c6c2c35d9a3af66f4b7fa5f1a76ea0d6ddbb27ffc7ab9c2b5c	docs/audits/memory-leak-scan-2026-09-15.md
-config	886182	9a3122ffaaa17bea776fa3d471c762f39b56e8be18807251f6260e022d3b959a	docs/audits/memory-pattern-scan-2026-09-15.json
-config	139829	b69e888010d84ea6aa68937e465cdabab64a0fff20f0457c5a18e4cb23fd9d6a	docs/audits/memory-pr-validation-2026-09-16.json
+config	29805	707f9bcbe49baec31f7ed20af68e561ac2fdadf8cadcb646b92ccc50852b0bb8	docs/audits/main-collection-loop-review/twenty-main-shared-loop-sites.json
+documentation	23216	23a575f71c41f815ccad41c1bc317d2ec6cac87e98bac874c9e098503805694a	docs/audits/main-collection-loop-review/twenty-main-shared-loop-sites.md
+config	29405	b186975634a855e2989c053c73ad992680b9c867806594745db6fd34c3bba100	docs/audits/memory-issue-index-2026-09-15.json
+documentation	41151	25670bc86bea541a9233590b7c9e191c600c99ff08a3224d6a2cef0dd10c5af8	docs/audits/memory-leak-audit-2026-09-15.md
+documentation	304532	6ad54a79b19ab15f5b7799dad93a1aa9a51c8486d5765b6cbbe399fa879649ff	docs/audits/memory-leak-scan-2026-09-15.md
+config	887364	9a20b966223188073fe29e1a992b4aa56147b287142deb32d17e6dcb82246ce2	docs/audits/memory-pattern-scan-2026-09-15.json
+config	141089	738957aef104b654c082cbb22214219b25e68c1b752064eddcdec9e9330e2ef5	docs/audits/memory-pr-validation-2026-09-16.json
 documentation	5983	42f24851e7131ad4ac99bf504eac02aa90ae49da8e50a219d3d8a1df4f18bd93	docs/audits/native-pty-spawn-env-retention/README.md
 source	710	0f5be920c2f0828798f238035760d113dace3bdcb3f121d51b3d861050bc15ca	docs/audits/native-pty-spawn-env-retention/before.config.mjs
 config	21356	f41f839cafc2f9d303a41adbd55c54ece6a7e013d9c7f34530d5ea404495128c	docs/audits/native-pty-spawn-env-retention/electron-results.json
@@ -1405,6 +1427,14 @@ source	4820	0a29132942a9f8aa60ceada3498fb4fb344c1c0e14a8c9b4cbc8ed4cfa9543d9	doc
 asset-or-other	6465	b9a590cb0f4205505ecdffd1573c07c2e9582c1536ea0517b734dea0232a9a99	docs/audits/pending-split-close/fix.patch
 source	5003	3306c13c5d61483cf907abc0c658cd8f52dfeb58fbbdc25d5e2d01839f9c1932	docs/audits/pending-split-close/reproduce.mjs
 config	3393	495c7cb98db0d3a7bbecf82ae6fe0f025d2b05dcf94ed7f7953aa1d8d60fc11d	docs/audits/pending-split-close/results.json
+documentation	7247	9b5a2f9afd8fb99534bb9d70b202283c50553e462edbc3a19c0196e31fe256f1	docs/audits/plugin-worker-output-retention/README.md
+source	691	318168c5ebebc03b33062977170350cecd88dd1e31b52e54688eee00ac8045ce	docs/audits/plugin-worker-output-retention/before.config.mjs
+config	179630	dab47497166edc9b9b07e56651d3c625dcb78c136b7b2491e4f22251bf484a0e	docs/audits/plugin-worker-output-retention/electron-results.json
+asset-or-other	942	ec28362681138dbc311e1c1a14154c250f418423bbb3d30cc75adfc46bbb5d57	docs/audits/plugin-worker-output-retention/fix.patch
+config	179607	c5ecdc957c4fd0a7d60752cbdcee7adcb63009a64a338f75c021208bab992471	docs/audits/plugin-worker-output-retention/node-results.json
+source	8504	1fe840d9b4ecc76c42cc2e8bcb87c54db78a91510819f755403a01ecb49181da	docs/audits/plugin-worker-output-retention/reproduce.cjs
+config	7480	247bf1f8587b37129212582e88b792dc345197666b6ceadaddc12eaa65f84de7	docs/audits/plugin-worker-output-retention/source-versions.json
+source	3886	8390b117b07ff8c0638e02183624d8da71b32cea955a366e16c80701dd9c38b1	docs/audits/plugin-worker-output-retention/sources.cjs
 documentation	1155	97d9e0679805f88c44a59b0b353817657454a86458b1136b5d231c9dacfd0951	docs/audits/posix-command-row-framing/README.md
 source	3340	de204507fb7a60cff9f91ddc9b4c25e77a4c0ac47c87f6d1058b79837a6b9ec8	docs/audits/posix-command-row-framing/reproduce.cjs
 config	628	92653d3593ff8b93e368aa14a4dcf6e7b31370dec8d9427e7c70b6960dfc5c98	docs/audits/posix-command-row-framing/results.json
@@ -1422,9 +1452,16 @@ source	4548	38c6d8a2c63607625db323631955d602cf0d244ac9464a952ab4cf95f87324cc	doc
 source	6653	6599c991b82adb9d2ff8c232d5d0d6f6b54c5b3de9ba3dc1756ac06ccd8e32bc	docs/audits/relay-replay-overflow/reproduce.mjs
 config	6018	49d37702c5678bb7761896f87bd57bb8e4979a2319b61aa6a5d62365f203a0f0	docs/audits/relay-replay-overflow/results.json
 config	3065	ecb18bd77a4ce2b6667979795a49b8ad6e82f8b1a60fcfd3698a2ac493ed957e	docs/audits/relay-replay-overflow/watcher-validation.json
+documentation	4582	0a4447d1806f788a179f2fd59fe26cf6732c89dd5d9417e5881eda2536deedda	docs/audits/renderer-exit5-telemetry/README.md
+config	4063	1681b02760d35e0543ae2c92583c387c1a4505d41b29eba1b02268dd30aef846	docs/audits/renderer-exit5-telemetry/probe-results.json
+config	11933	92cf5ff5f8e5f819b24ce0a4e19f0ae03f248670c28ec125a3025b2f9ac65da4	docs/audits/renderer-exit5-telemetry/source-hashes.json
 documentation	4796	01f65992785f7406115f7ec661069de60cc65fdca4136713aac22cddbb8808ce	docs/audits/retained-text-slices/README.md
 source	6160	d356834bdfedf9059a0975633121c897b9e2a367989b67e506d0a927c057487b	docs/audits/retained-text-slices/reproduce.mjs
 config	3165	3c493185f0f245676c46b9beaa9b1efa40ea99969445ab8083daf85ce48fbbba	docs/audits/retained-text-slices/results.json
+documentation	2283	64e2b3a3e2f9e00c41ec2cdf7c8127c98a0e489b2d396fcd7a55b99fb0ff9c9e	docs/audits/rpc-inflight-admission-review/README.md
+source	6862	46c417fc4640f545cd640a77bd1404f6de5c57164c1805193e07c0f85b6eb3f8	docs/audits/rpc-inflight-admission-review/fixture.test.mjs
+config	1838	81b600e8bac67503ee00eb8564a21533b75a1c6bd125e564967e1b4e6e640811	docs/audits/rpc-inflight-admission-review/results.json
+source	180	12db74bfddd23c7712664f74b9b4ac9ecc7b0655cc3217b0294dba8c13e59a08	docs/audits/rpc-inflight-admission-review/vitest.config.mjs
 documentation	7058	de96ffd4b9f49fcdb5619877e4d1cca6b7ea635d0405f9316406da2244b3e3f4	docs/audits/runtime-rpc-consumed-queue/README.md
 source	819	aae5fc4520df561f7adca62dc3016aca427e858740e6ee21e49fbcaf67cc5c44	docs/audits/runtime-rpc-consumed-queue/baseline.config.mjs
 config	3109	4564adb87a432619bd456292e926d9518f84a28427bca2789c4ac5cfbc65e588	docs/audits/runtime-rpc-consumed-queue/electron-extended-results.json
@@ -1462,6 +1499,16 @@ source	6858	df1e7dce64cbce75a0fe293022b8b2442f2741c2d6f8dbf551496f950bc934b4	doc
 config	4117	35e2f40eabb24b58aeba01ab477be8710fb95f30cc59604fc3db23c6b3f8536e	docs/audits/speech-worker-audio-queue/results.json
 source	779	1833b5408881d99fbb30791d8d3358465d80bfa8f99d39865506e28bc7e169eb	docs/audits/speech-worker-audio-queue/stalled-recognizer.cjs
 config	551	b764bf83beb591a72db37284930fe0762398a81a4b5c0a5805cdeaecf0a061e9	docs/audits/speech-worker-audio-queue/versions.json
+documentation	6472	a31dc813d9e80877b65bc28e9ecc6de906ca2a0878fa844147f2f37d7ce0ddc8	docs/audits/ssh-writer-consumed-prefix/README.md
+source	705	1e20ad5be9cfd9d0c750ecbaedf68be654e4f390492f4d677641368aea8cb56b	docs/audits/ssh-writer-consumed-prefix/before.config.mjs
+config	10787	86b0c1082e5f2745490257f04dcdb4e8e565efd480d241d1536c6654de82f988	docs/audits/ssh-writer-consumed-prefix/electron-results.json
+asset-or-other	676	ffa1a77564951b5411d7170d4bd5323c97c139d387be616588d56cf466ceab02	docs/audits/ssh-writer-consumed-prefix/fix.patch
+config	10739	8b5b92745a1dbcc523b6866dff24a35a4fa6a3d21b8ae3feecebceea79655f4f	docs/audits/ssh-writer-consumed-prefix/node-results.json
+source	2088	a385a770521b6f0450730a63f43c1c3b9189842a20eafde90f4dd9ff9aa0ab57	docs/audits/ssh-writer-consumed-prefix/reproduce.cjs
+source	7113	11bea9ed74937e9526ae2ebcfa645506910000a5ac36d784f20781709e290788	docs/audits/ssh-writer-consumed-prefix/scenario.cjs
+config	8053	65fce5db3f1203ddbb687cf65af66b84fde4325f2bce6e5786017803b28fd50b	docs/audits/ssh-writer-consumed-prefix/source-versions.json
+source	4146	2732c6fa86a109bc7bb88975e2b11cbcf4794964432b30a24eed301f6bb7b3e0	docs/audits/ssh-writer-consumed-prefix/sources.cjs
+config	6596	752658c972c9977ca03e5105a38492fc5ac493310ab03afbbc233c4ed14f4dd3	docs/audits/ssh-writer-consumed-prefix/validation.json
 documentation	4662	3ad8c129ef55df4ebf9b6bcd2bb2ad993f771851fd467bba522df34be9317a9e	docs/audits/stale-pty-inventory/README.md
 asset-or-other	3823	e004402dc6549ffeab562e908a1c68803fa5ceb292755cc51a4a4a6b25169b00	docs/audits/stale-pty-inventory/fix.patch
 source	4851	02931c2487f324500939991b5c834a94bbb54ffe7ccc54fea1c5fa41e2f9c1e4	docs/audits/stale-pty-inventory/reproduce.mjs
@@ -1510,6 +1557,12 @@ source	8815	5c5b4fd49387806ab6f95fcba0a1dc763d4537dcb96c5f74988f106f2413322d	doc
 config	26856	5a3d50f84328053dcdda20c2400d27d2a2eb2f73e4c59ec93dd9afd963ae4d25	docs/audits/terminal-contrast-cache-retention/results-dom.json
 config	18075	cfc10a411c292de3b0055c38808e4d8af1571b0aaa217bfc685b17d54f278e49	docs/audits/terminal-contrast-cache-retention/results-mobile-dom.json
 config	18940	300c9d1b5220e7f8fc6a25310ddc16030af60a9087d0a2c462f238eb1a4dc074	docs/audits/terminal-contrast-cache-retention/results.json
+documentation	7749	ec4311f1abcc9b15d3776caddfebb6183c4bdf1c4a836288a7ca37b276c50ab7	docs/audits/terminal-mode-tail-retention/README.md
+config	12678	6126bcd6001af264f71c0a24bb7673a42df9a588c5073165d426c156112c2223	docs/audits/terminal-mode-tail-retention/electron-results.json
+source	2779	730da9091abba3997432657aef4a2e6e7a3dd0e9218ea78f1838806b6c0fa789	docs/audits/terminal-mode-tail-retention/load-source.cjs
+config	12690	6ee19a8d07eb65db3003b12c68c65b44f472140cd73d917268639b6c3f4187ca	docs/audits/terminal-mode-tail-retention/node-results.json
+source	6469	b78dc54a08345732235d4fcc1f72ca1534b00f89280981beda00667d22b8f291	docs/audits/terminal-mode-tail-retention/reproduce.cjs
+config	2074	29cde88cb882b2d7726a2d4a077484217076090acc009f47a805e368f597e51a	docs/audits/terminal-mode-tail-retention/source-versions.json
 documentation	2487	8e679fec0996361e87af1ee93c88c608807858eebd55ba3916555d856626e677	docs/audits/terminal-wait-leading-blank/README.md
 source	9471	e9f27cbcb69575606ad65e352c865bb521d24e8571ee9c1284f8739b3dd42e95	docs/audits/terminal-wait-leading-blank/reproduce.mjs
 config	5325	f0adb93a4c4612025ddddf9d3922d3191561e66aa2518a530a457fc1384eb8f1	docs/audits/terminal-wait-leading-blank/results.json
@@ -1526,6 +1579,16 @@ config	1159	e7c823ef55ced4aeb4ffc51d9b6a5716f1f38a503d43dd5b1479ebee35c5aed4	doc
 documentation	3323	166d3345cae5cdc623b13404911d2cbb23af03400bcb3db6ce0d7f649354e3b1	docs/audits/webgl-empty-glyph-retention/README.md
 source	7836	806e02588764f4ac0ed6f7d1e9bc816e4de7a72208e4908a449076a251e4aa70	docs/audits/webgl-empty-glyph-retention/reproduce.mjs
 config	14780	b2926c2e7688e6001c9992b96994be15e08d69741d6062a4a0e2981aca24440c	docs/audits/webgl-empty-glyph-retention/results.json
+documentation	6661	957aba92b8cd3f5380c36772b4261889086aae9746540c84b9354c5046f3313e	docs/audits/working-directory-wait-retention/README.md
+source	706	8ac01da5ba29b62b518f438e0d8edd96b6ea6edacf61c993024ca5be55e46505	docs/audits/working-directory-wait-retention/before.config.mjs
+config	35220	8ed19699c329ccfb343181646c5a18f0354c19a718f3953df738c84eb9b76359	docs/audits/working-directory-wait-retention/electron-results.json
+asset-or-other	2467	d80df55608fa74a24d61d5f4fba4b5aeb4668f41bac0ca1792a77925649fb6e1	docs/audits/working-directory-wait-retention/fix.patch
+config	35170	dfe100a33575941d95ffb84134779ebadf1e3c29207bb55b83aaefdd719a9975	docs/audits/working-directory-wait-retention/node-results.json
+source	4178	b6b6b4d44b20b57bcb01740e68af241ca14dbc450b868c7c16aa098b1cf69954	docs/audits/working-directory-wait-retention/reproduce.cjs
+source	7150	1d37231a539f992154136e3c410eaced9902a728f8bfa323130cde3e441fc7fd	docs/audits/working-directory-wait-retention/scenario.cjs
+config	3495	9044de9aa8ba691206bebdeae1dfb61cc777e4a7468d5734a30dd197eed8b9f3	docs/audits/working-directory-wait-retention/source-versions.json
+source	4247	699a908c64cbe22168df162e222a767fa9b7618a9d8f68bf971ed631f3f9622a	docs/audits/working-directory-wait-retention/sources.cjs
+config	3580	596db12f1a5b739bc3caab46cc801e28bd327f44e636ea793ea058f7555f51cb	docs/audits/working-directory-wait-retention/validation.json
 documentation	11704	9b10a5bb4a88b649c75f832c2b86f1a56c3b16d201f98fe36f9922a0df5cf136	docs/audits/xterm-reflow-retention/README.md
 source	3888	9ef79e23d3bb21fb50a2d92ca14f1bca460ac8ac9c40715967cc3e8609da5ccd	docs/audits/xterm-reflow-retention/child.cjs
 source	1859	0c6c5b9f1c46c4b66951a20db857a87e84848a876a7a181147b1821f73eb2e49	docs/audits/xterm-reflow-retention/install-candidate.cjs
@@ -6949,7 +7012,8 @@ source	31563	3a9a642e6f9f55401be484813212d3959f08b29a300262fcbd89f06efe576f5a	sr
 source	13571	23cfd9c6317db30edd48a0c8bd7c54658206654703461cf12295274b23fb8844	src/main/daemon/terminal-host.ts
 source	1743	922d2533cc78adae2d93850507925426e17f456ea3cfb98bbc03b454b7d766ca	src/main/daemon/terminal-mode-rehydrate-sequences.ts
 source	372	1722bab985866dee2091d1c392335b49786b992a83c68368786bb24d493be0f6	src/main/daemon/terminal-modes.ts
-source	4036	5bf8a94ad7ec3fdd151ba7559f49a229b2156818aba88f7b562bef258048acf1	src/main/daemon/terminal-mouse-mode-mirror.ts
+source	4143	e8f4888dabee5c4cc50b0f15584b3b1b5e2da4db1ba25695dd5762ef9c4a6fb3	src/main/daemon/terminal-mouse-mode-mirror.ts
+source	1521	3f3221dee43f123803defe32445bc591921ddbcbff96ef1aab28d7e5f40026c1	src/main/daemon/terminal-mouse-tail-retention.test.ts
 source	2163	77145544a185fd5a6007e415ed4c9b7f7bb3f6009c96391a72253f3550b2ea6d	src/main/daemon/terminal-osc-cwd-title-scanner.ts
 source	6463	ac70f2aa88f7b029a060d4f61758e029189481bc6dc62747017b2952155e7bbd	src/main/daemon/terminal-session-teardown.test.ts
 source	6379	10ef803e563d8fdafcd3981ba8e01ed8e832cb43c1ee4891b68139d2559a7cc1	src/main/daemon/terminal-session-teardown.ts
@@ -8994,8 +9058,9 @@ source	650	9344b1593bf91a49a6e1d2fb9604e2890939eb1b1f0cadbbdae7194db57a8080	src/
 source	1228	8f25a4da1d41fce64c14ea53beb5592067ffb58320590db6f4947fe1793d7253	src/main/native-chat/agent-session-journal/journal-write-guards.ts
 source	2329	46d1b05b043df8c498117955ca4ce009491363b490adf2f00b8f0b33f57f73a9	src/main/native-chat/agent-session-wire/agent-session-delta-coalescer-protected.test.ts
 source	7467	60dfbb514252e6fff0015a4507557e0c5158e94fceb18fcc28f2b4a2deb1e97d	src/main/native-chat/agent-session-wire/agent-session-delta-coalescer.test.ts
-source	8835	48828e4ee21858075cbb87ec1caa4a82991a55f80928482615d1df7ec5dc0fb2	src/main/native-chat/agent-session-wire/agent-session-delta-coalescer.ts
+source	8871	7caf0f24250b42e0ac4fe99e93bcbe0a4acb7cb3465fdde6b248d8bf6ba0d2d0	src/main/native-chat/agent-session-wire/agent-session-delta-coalescer.ts
 source	432	4c16dd336e32e18a4e29d83024e4017fd259de1587b9ff2627067488acbc63c6	src/main/native-chat/agent-session-wire/agent-session-empty-batch.ts
+source	4452	2e4ed51b8c205e650cd0d3d4fcb968fdf8f509be4c4013ca1dc6e70b59703a55	src/main/native-chat/agent-session-wire/agent-session-empty-delta-retention.test.ts
 source	3021	00dad522f9d0a219886d19d66a4cc59f5f35c7783884d30771939b6ec791ff4f	src/main/native-chat/agent-session-wire/agent-session-history-byte-accounting.test.ts
 source	7901	617a5eafe66ea5cbe3d6b2d83fd262141251c8e11722d1ca358a2512c37a4757	src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts
 source	4272	57e49a0ea59cdccf4a4fc1532d43d2c127b077233602139b2d36d79fd547fc9d	src/main/native-chat/agent-session-wire/agent-session-history-page-bounds.ts
@@ -9782,7 +9847,8 @@ source	1543	fec2b1710cd37e47384b81976113835236be0da1a07fdf462c737a5fd24207da	src
 source	12525	84b35d993c8011179e62c44d7a756010b2518a8cd8ab65bb6fe8cc165b5ba330	src/main/plugins/plugin-worker-manager.test.ts
 source	11022	b95bfac2b674b6ecf6da6ba0d08b98596e67f05bf0dff02e8133049b4d5a1e70	src/main/plugins/plugin-worker-manager.ts
 source	739	2a8ae8a391f6324d5070646e68d6e96aa31c579644fcd5cc1abcecc284e30450	src/main/plugins/plugin-worker-output-buffer.test.ts
-source	1879	969daeddb4f4fde9d53e80b008438aa2942526af940ae9eb4f08cd9440a0f914	src/main/plugins/plugin-worker-output-buffer.ts
+source	2037	4c7fd9e66d1b2aa948dab72196c3e6fd9df7c646dcf0a15279ee5520bb0a2a7b	src/main/plugins/plugin-worker-output-buffer.ts
+source	2989	072e0ac8cb47041264c850a8b15f4e279a680846a9f9fecd8bd5ffeb1a8452a1	src/main/plugins/plugin-worker-output-retention.test.ts
 source	910	43bb77565c86a2e209195aa3f55b7cf5bd78f668009318a0894508707b1769bc	src/main/plugins/plugin-worker-reconciliation.ts
 source	1403	76cb5df1de7122b42dda29a418674394412b64da1ddccf2501b4a5eb0b2284cc	src/main/plugins/plugin-worker-restart-loop.ts
 source	2761	e8cbcc0d409f5afb24b90341e6e0cb8628a98cf56b0568d155adf57f13c73f8b	src/main/plugins/plugin-worker-slot-pool.ts
@@ -10030,8 +10096,9 @@ source	10216	c8edb01bb6c39bfb7efef73b1623d4d11c424be60060e35693ef47149648427d	sr
 source	3094	1aec691122eeffc9fc9cb1cc34dbdd307f3701f776aa08f0c1fa299987d06461	src/main/providers/windows-shell-fallback-chain.test.ts
 source	2485	c0a38c7901f4b5f64cdfba2a1c982d3f07b189524f2967858cbfb82648dc26b8	src/main/providers/windows-shell-fallback-chain.ts
 source	6565	0b55b69e5ee58b6f38f8651ff2d8a9c90d82fb9b4f49b16da80010a6fbae7ec0	src/main/providers/windows-shell-preflight-runtime.windows.test.ts
+source	7371	b61fbd37e39cc8af40d9374c85409c37bf00cebb5cba9505b446e45fec140e6c	src/main/providers/working-directory-validation-retention.test.ts
 source	9723	2acd950b5589c7d36f11add94985a1efde2df4f8cf836d8e0120f718938db525	src/main/providers/working-directory-validation.test.ts
-source	7156	197bcb7ab254d2bca8cdcc7d7f0214dedca825bbb0dc4f0d2dcbb41df4cec043	src/main/providers/working-directory-validation.ts
+source	8144	0ef75b5d5242ad7e5423bde2cb7fe633a8f437fc545f22ca04612782fc2de212	src/main/providers/working-directory-validation.ts
 source	13764	6d4b7016656311c5469a5dadcde6e03111846381782b340c856ec392c09ea779	src/main/provisioned-root-ssh-adoption.test.ts
 source	9334	d8ec76f4d188e186d8a99913f1bd6f0f3c5c73fb56d67637a60c815420fbe473	src/main/provisioned-root-ssh-adoption.ts
 source	6264	e1d7226915c1cabc095ef619fef0a3f7146359e3475cc49fe8ecbd6b380e4419	src/main/proxy-guarded-fetch-call-site-audit.test.ts
@@ -12749,7 +12816,8 @@ source	8697	9609c3ff91d5c2694343d4648bd60ab78dda00ed6b0aab303e56f13ebd0e8d70	src
 source	9453	3c6cb2122f48b1b72972822326d360c466af474bd6ebd26661ffe653304802e1	src/main/ssh/ssh-multi-key-authentication.test.ts
 source	10294	545e20dfd7aa8317eaf89b6b24213eb73e87de7b85597316be8626bee96c55b4	src/main/ssh/ssh-multiplexer-transport-writer.test.ts
 source	10256	433a2cc400b5ed9743871ca03aac06d31a079ef23c42c2a2759f78967312d071	src/main/ssh/ssh-multiplexer-transport-writer.ts
-source	1844	3e5fe7a1e3537505baf42869449193fc0448339d851254a49527ec2a1c7cbb50	src/main/ssh/ssh-multiplexer-writer-lane-scheduler.ts
+source	2050	6173ddd6640a930d0fa586fed91c1adc0d865a33f81af9a1ed5a0817c08e90cc	src/main/ssh/ssh-multiplexer-writer-lane-scheduler.ts
+source	5219	dfa8b86fcc33e0780fe0977097cc5db9bcf1b4cc2bbffae63b68be804d9903b3	src/main/ssh/ssh-multiplexer-writer-retention.test.ts
 source	11444	a242313733caef8c41d71cc55fe6739b4fa62fa752c8d4274e930eabf88eb09b	src/main/ssh/ssh-orphan-relay-pty-sweep.test.ts
 source	7830	d592e26e70aa0520ff1deae5c283b87ea0f11af5c63011d440ca09278a26b42e	src/main/ssh/ssh-orphan-relay-pty-sweep.ts
 source	16382	6be8e5f16d2d6497f682fb69eca8e4ea943c6206abe28cf68f733b00173b2197	src/main/ssh/ssh-orphan-sweep-pane-state-verdicts.test.ts
@@ -26013,7 +26081,8 @@ source	4767	743758ec27a44f5fc3083679cfb4ba15b2e35c806a7d5b6baef905e6e10b9780	src
 source	2444	c9f96645d40c7922e51c0fc373cc0d89f737674aa41851c20c0cab0e930985d3	src/shared/terminal-input.ts
 source	1150	ee8ca63afdca8356fa12878e74973ff92d807aa8d99750b2415b42f4bccb0225	src/shared/terminal-kitty-keyboard-flags.ts
 source	11342	35d462399f1e0372e32f2f1fd615b6a7e8d0976b860ef016ee38428b81e5fc7d	src/shared/terminal-kitty-keyboard-mode-tracker.test.ts
-source	11974	2ee0bad47d4575046f71c16e0334a8ae8be531f0cfc67133abc287f8ae5aa403	src/shared/terminal-kitty-keyboard-mode-tracker.ts
+source	12051	a8da704564b9ab97aa344f380940021d3fa98f80af817751824d14271acb8a84	src/shared/terminal-kitty-keyboard-mode-tracker.ts
+source	1498	570824fbc189b6f6dcba031c746db1aaa21a9a38e49490ef5b1e582da51c0f12	src/shared/terminal-kitty-keyboard-tail-retention.test.ts
 source	1997	fefaeeb8ff70829bc546f72900f92578083a8b629725b85523ead4ae8b36fc45	src/shared/terminal-ligatures.ts
 source	565	be04e0dfcb263f5d7668f559a63693b0d23348d6a3455cc6e79d83391049104c	src/shared/terminal-line-height-settings.test.ts
 source	483	490e459cf4ca7f7a07c0e4884630768485fe6afcdebe466ec2fd04f3e96a4df2	src/shared/terminal-line-height-settings.ts
@@ -37,61 +37,64 @@ alive for a scenario were reviewed separately from application code.

 ## Findings ledger

-| ID     | Area/file                                                                                                                                                                           | Finding                                                                                                                                                                                                                                       | Action                                                                                                                                                                                                                                                                     | Validation                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-| ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| ML-001 | `src/renderer/src/components/editor/combined-diff/remember-view/combined-diff-view-memory.ts`                                                                                       | HMR re-evaluation accumulated an anonymous global listener and retained old module closures.                                                                                                                                                  | Named the handler and dispose it through `import.meta.hot.dispose`.                                                                                                                                                                                                        | `use-combined-diff-view-restore.test.tsx`: 3 passed; oxlint/oxfmt passed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
-| ML-003 | `src/main/window/*-request-relay.ts`                                                                                                                                                | Pending IPC requests retained response listeners and timers until timeout after renderer teardown.                                                                                                                                            | Unified settlement cleanup for response listeners, timers, and closed/destroyed/render-process-gone events; catch send failures.                                                                                                                                           | Focused main relay tests: 5 passed; oxlint passed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| ML-004 | `src/renderer/src/components/activity/activity-clear-completed.ts`                                                                                                                  | Module-level pagehide listener retained old HMR module closures.                                                                                                                                                                              | Added Vite HMR disposer.                                                                                                                                                                                                                                                   | oxlint/oxfmt passed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
-| ML-005 | `src/renderer/src/components/contextual-tours/ContextualTourOverlaySurface.tsx`                                                                                                     | Global Escape listener survived HMR and retained stale closure behind a window guard.                                                                                                                                                         | Added disposer that removes the listener and resets the guard.                                                                                                                                                                                                             | oxlint/oxfmt passed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
-| ML-006 | `src/renderer/src/lib/keyboard-layout/layout-base-character.ts`                                                                                                                     | HMR could duplicate the focus listener and API layout-change subscription after the module guard reset.                                                                                                                                       | Added disposer removing both hooks and resetting the installation guard.                                                                                                                                                                                                   | oxlint/oxfmt passed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
-| ML-007 | `src/renderer/src/lib/input-quiet-scheduler.ts`                                                                                                                                     | HMR could stack global capture listeners and stale `recordInput` closures.                                                                                                                                                                    | Added disposer removing listeners from the installed window.                                                                                                                                                                                                               | oxlint/oxfmt passed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
-| ML-009 | `src/renderer/src/components/terminal-pane/terminal-render-desync-trigger.ts`                                                                                                       | HMR could stack the opt-in mouseup listener and retain stale burst state.                                                                                                                                                                     | Added disposer removing the listener and stopping the active burst.                                                                                                                                                                                                        | oxlint/oxfmt passed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
-| ML-008 | `src/main/hang-watchdog/main-thread-hang-watchdog.ts`                                                                                                                               | Repeated watchdog lifecycles retained the app `will-quit` stop listener after manual stop/worker exit.                                                                                                                                        | Remove the app listener whenever the watchdog stops.                                                                                                                                                                                                                       | Hang watchdog tests: 8 passed; oxlint passed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| ML-002 | `src/preload/preload-runtime-support.ts`                                                                                                                                            | Installation functions could add duplicate global listeners if setup ran repeatedly, retaining closures and processing each drop more than once.                                                                                              | Added idempotent guards to native drop and browser-find listener installation.                                                                                                                                                                                             | Native chat drop scope test: 10 passed; oxlint passed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
-| ML-010 | `src/renderer/src/components/terminal-pane/terminal-parked-watcher-registry.ts`                                                                                                     | Parked panes bypass the normal close teardown; their keyed scroll-intent records stayed in strong Maps after tab close or worktree removal.                                                                                                   | Release captured leaf keys during parked-tab retirement and worktree pruning.                                                                                                                                                                                              | Parked-watcher reconciliation tests: 6 passed; PR #20924.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
-| ML-011 | `src/renderer/src/components/terminal-pane/terminal-hidden-worktree-retention.ts`, `terminal-eviction-exempt-tabs.ts`, `src/renderer/src/lib/pane-manager/pane-manager-registry.ts` | Fail-open, foreign-worktree, and capability-unknown PTYs are intentionally exempt from force-parking, so their mounted xterm panes can retain rows × columns of scrollback indefinitely; `pane-manager-registry` estimates 16 bytes per cell. | Kept as an unresolved safety tradeoff: force-unmounting these panes can orphan a live shell. The safe fix is to make the PTY classes reattachable or add authoritative capability resolution, then bound the exemption.                                                    | Source retaining-path review; existing eviction-exempt and pane-memory census instrumentation.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
-| ML-012 | `src/shared/process-table-index.ts`                                                                                                                                                 | A cyclic PID/parent relationship makes the descendant walk copy rows forever. A two-row cycle exhausted an isolated 32 MiB Node heap in about 0.15 seconds.                                                                                   | Independently verified existing open [#20715](https://github.com/stablyai/orca/pull/20715), avoiding a duplicate fix.                                                                                                                                                      | Exact production hunk passed cycle, self-cycle, root reuse, duplicate/shared-subtree fixtures and 500 acyclic parity cases; local evidence in `notes/process-table-cycle/`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| ML-013 | `src/main/stats/collector.ts`                                                                                                                                                       | The event cap was enforced only during serialization; stalled asynchronous persistence let the live event array grow without a bound.                                                                                                         | Enforce the existing 10,000-event cap on append, retaining newest events and lifetime totals; [#20941](https://github.com/stablyai/orca/pull/20941).                                                                                                                       | All 24 stats tests passed, including a blocked-write regression that fails before the fix.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-| ML-014 | `src/relay/pty-shell-utils.ts`                                                                                                                                                      | The SSH relay has an independent descendant walker; cyclic parent links cause repeated copying/allocation there too, so fixing only ML-012 leaves the relay exposed.                                                                          | Added a visited-PID guard to the existing walker; [#20946](https://github.com/stablyai/orca/pull/20946).                                                                                                                                                                   | 42 relay foreground tests passed; cyclic regression stops after 20 reads if the guard is removed, avoiding an OOM in the test worker.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| ML-015 | `src/main/daemon/daemon-stream-data-batcher.ts` and stream/PTY pause ownership                                                                                                      | The 32 MiB held-queue valve transfers excess output into an unbounded socket queue when a reader stalls; small writes bypassed the held-queue valve too.                                                                                      | Backpressure visible producers, preserve hidden keep-tail shedding, and fence attachment handoffs; [#20947](https://github.com/stablyai/orca/pull/20947).                                                                                                                  | 163 tests in 11 suites; real paused-reader experiments demonstrate producer pause, bounded queues and complete drain. [Artifacts](./daemon-stream-retention/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| ML-016 | `src/main/browser/cdp-client-response-writer.ts`, `cdp-debugger-channel.ts`                                                                                                         | CDP events and responses accumulate in WebSocket buffers behind an unread client. A 128 MiB experiment retained 133,177,280 queued bytes.                                                                                                     | Reuse the existing bounded outbound queue and terminate stalled clients on overflow, preserving single large healthy replies; [#20949](https://github.com/stablyai/orca/pull/20949).                                                                                       | 66 tests; real WebSocket before/after reproduction. [Artifacts](./cdp-stream-retention/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| ML-017 | `src/shared/terminal-osc-link-retirement.ts`, headless/renderer/mobile terminal integrations                                                                                        | OSC 8 link entries and marker listeners survive overwritten cells. 10,000 redraws retain about 20.5–20.9 MB after GC with only 24 rows.                                                                                                       | Collect entries unreferenced by either buffer or active attributes after registry growth; [#20955](https://github.com/stablyai/orca/pull/20955).                                                                                                                           | Real installed headless and renderer builds retain about 1.6–1.7 MB after the fix; snapshot/fidelity/pane regressions and 15 mobile tests pass. Private xterm fields and buffer-size-dependent sweep cost are explicit limitations. [Artifacts](./osc-link-retention/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| ML-018 | CI excerpts, main/relay recent output, terminal tails/error surfaces, and Claude background-task labels                                                                             | Capped V8 slices pin oversized inputs. Eight 16 KiB CI excerpts retained 16–32 MiB; eight 4,000-character errors retained 32 MiB; eight terminal tails reporting 4 MiB retained 32 MiB.                                                       | Reuse the existing shared and renderer string copiers at ten retention boundaries, including per-PTY URL/status carries and normalized Claude task text; [#20960](https://github.com/stablyai/orca/pull/20960).                                                            | Real-function after-GC measurements fall to about 0.1–0.15 MiB, 33 KiB, and 4 MiB respectively. CI/provider/content and retained state/queue tests pass. Follow-up: 32 normal 64 Ki-character inputs retain about 2.1 MB in each isolated detector baseline; owned tails reduce this to 41 KB (status), 204 KB (URL), or 575 KB (pre-bind), including owners. These last-input costs scale with PTY count and can share backing storage. [Tail artifacts](./retained-text-slices/README.md), [detector artifacts](./pty-detector-retention/README.md). Actual Claude tracker follow-up: eight JSON-parsed 4 Mi-character labels retain about 33.56 MB before and 7–12 KB after across live, settled and recently removed task owners; 112 focused tests and 36 proof cases pass. [Task artifacts](./claude-task-retention/README.md). |
-| ML-019 | `src/main/ai-vault/session-scanner-jsonl-reader.ts`                                                                                                                                 | Incremental JSONL framing retained an entire newline-free record and then allocated concatenated/decoded copies. A 64 MiB record peaks near 248 MiB RSS despite the scanner child’s 384 MiB V8 old-space setting.                             | Share the existing streamed remote 10 MiB record budget and reject before retaining/concatenating/decoding oversized records; [#20963](https://github.com/stablyai/orca/pull/20963).                                                                                       | Real-file reproduction peaks near 62 MiB RSS and stops at 10 MiB plus one input chunk; 71 reader/cache/WSL tests and ten reader/recovery tests pass (nine overlap). Valid larger records now produce a session scan issue; whole-document readers are outside this fix. [Artifacts](./transcript-record-retention/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| ML-020 | Vendored xterm WebGL `TextureAtlas`                                                                                                                                                 | Invisible glyph variants occupied no texture pixels but each added cache metadata, so page eviction never bounded them. 100,000 colored-space redraws retained 100,093 entries and about 13.5–13.7 MB of V8 heap growth on one texture page.  | Separate invisible caches with a shared 4,096-entry cap, preserving visible glyphs and pages; regenerated CJS/ESM/source maps and lockfile hashes in [#20965](https://github.com/stablyai/orca/pull/20965).                                                                | Actual installed CJS and ESM bundles retain 1,789 entries and about 0.2–0.4 MB heap growth; shared-terminal pixel hashes, cache hits, empty-only clear, 86 tests, and pinned regeneration checks pass. [Artifacts](./webgl-empty-glyph-retention/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| ML-021 | Legacy journal import and `native-chat/transcript-stream-lines.ts`                                                                                                                  | A stat-only 16 MiB quota could be bypassed by source growth before/during reading. A 149-byte file grown to 17 MiB was fully consumed and replaced the journal.                                                                               | Enforce the existing source-byte budget before framing each raw chunk and reject the whole import; [#20976](https://github.com/stablyai/orca/pull/20976).                                                                                                                  | 50 tests; actual-file proof refuses at 16 MiB plus one 64 KiB chunk, closes the stream and preserves the prior journal. [Artifacts](./legacy-import-source-budget/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| ML-022 | Structured session holds and RPC cleanup                                                                                                                                            | A surface releasing during provider acquisition leaves no timer when the child arrives. Overlapping failed holds could remove replacements or remove the last holder after another acquisition succeeded.                                     | Reuse release grace after acquisition/rollback, fence holder incarnations and RPC registrations, and guard disposal; [#20978](https://github.com/stablyai/orca/pull/20978).                                                                                                | 177 tests including cross-version and actual host/RPC stale-checkpoint refusal; independent review and actual-class before/after proof. Active turns and replacement holders survive. [Artifacts](./structured-hold-retention/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
-| ML-023 | `ai-vault/session-scanner-service-entry.ts`                                                                                                                                         | Late cancellation arrived after request cleanup and inserted an ID with no future owner to delete it.                                                                                                                                         | Admit cancellation only while the existing pending set owns the request; [#20980](https://github.com/stablyai/orca/pull/20980).                                                                                                                                            | 1,000 completed requests retain 1,000 IDs before and zero after; 26 service tests pass. This is small scanner-child metadata. [Artifacts](./scanner-late-cancel/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| ML-024 | Vendored xterm `ColorContrastCache`                                                                                                                                                 | Normal/dim contrast maps retain every distinct true-color pair, independent of glyph pages. 100,000 redraws retain over 100,000 entries and 4–5.5 MB heap growth even with periodic atlas clears.                                             | Bound each cache to 4,096 color/CSS entries and recalculate evicted values; [#20981](https://github.com/stablyai/orca/pull/20981), including a mobile-only generated patch.                                                                                                | 122 tests, six actual WebGL before/after runs and 12 DOM cases preserve corrected colors and pixels. Fixed desktop heap growth is about 0.3–0.4 MB. Mobile adds 23 engine/theme tests and eight actual before/after DOM cases; regeneration and 90 generator/cache/CI-contract tests pass. [Artifacts](./terminal-contrast-cache-retention/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
-| ML-025 | `ai-vault-search/session-search-index-writer.ts`                                                                                                                                    | A lifetime removal counter retained every retired transcript path after its database rows and reads were gone.                                                                                                                                | Track only active read lifetimes; release on commit/discard/error/incomplete read/close; [#20986](https://github.com/stablyai/orca/pull/20986).                                                                                                                            | Actual writer and SQLite: 1,000 retired paths before, zero after, stale commits still refused. 59 tests and independent review pass. Current-code scanner-child metadata, absent from v1.4.198. [Artifacts](./session-search-write-fences/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| ML-026 | Vendored xterm `BufferLine` in headless, desktop and mobile                                                                                                                         | Overwrite/erase leaves dead combined strings in sparse maps, invalid translation caches, or a shared scratch cell. Eight overwritten cells retain about 42.9 MiB.                                                                             | Release unused references while preserving live Unicode, protected/wide cells and moves; [#20992](https://github.com/stablyai/orca/pull/20992), stacked on #20981.                                                                                                         | Separate dead-text cases fall to about 0.1–0.2 MiB. 127 main tests, two generated mobile cases, 45 generator tests, 51 upstream tests, 25,000 semantic comparisons and 70 bundle cases pass. Emitted synthetic ASCII parsing costs about 5% more; no application-wide slope claim. [Artifacts](./terminal-cell-retention/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
-| ML-027 | Main runtime renderer/provider snapshot and seed paths                                                                                                                              | A retired/replaced headless model receives late async callbacks, recreating CWD/recent-output/title/hydration/generation metadata or deleting replacement bookkeeping.                                                                        | Guard the captured state and existing generation; clean up only the captured mode-tracker Set; [#20996](https://github.com/stablyai/orca/pull/20996).                                                                                                                      | Actual runtime: 16 failures before, all 22 pass after; 306 selected regressions and independent review pass. Ordinary live writes still drain; renderer wait remains bounded at 750 ms. Present in v1.4.198; size/frequency in the incidents unproven. [Artifacts](./headless-hydration-retention/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| ML-028 | PTY provider exit reconciliation after synthetic kill                                                                                                                               | A control reply overtakes final stream DATA/EXIT. DATA recreates a connected model; early duplicate suppression skips physical-exit cleanup even when fresh host inventory has proven exit.                                                   | Always reconcile the current incarnation in main; suppress only repeated renderer notification and match markers by incarnation; [#21000](https://github.com/stablyai/orca/pull/21000).                                                                                    | Real runtime/provider/server sockets: four before/after scenarios, 88 focused tests and independent 23-test review. Final output, one renderer notification, replacement state, and one-time SQLite dispatch settlement preserved. [Artifacts](./daemon-late-exit/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| ML-029 | Explicit split close while IPC connect is pending                                                                                                                                   | An unbound transport omits retirement and removes its saved leaf ID. Late reattach/cold-restore results remain protected, leaving a shell without a pane or kill request.                                                                     | Capture explicit intent, reuse local/direct-SSH retirement planning, and recheck ownership when the same-ID reply arrives; [#21001](https://github.com/stablyai/orca/pull/21001).                                                                                          | Actual hooks/transport plus daemon socket controls: before 14 failing assertions/10 controls, after 24 pass; 200 renderer regressions and independent 29-test review. Protects replacement/sibling owners, generic remounts, unresolved/paired routes; folder workspaces covered. [Artifacts](./pending-split-close/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
-| ML-030 | Structured TUI transcript catch-up after successful session close                                                                                                                   | Verified terminal close and durable lease release forgot the catch-up state and filesystem watcher; closed sessions retain seen-message IDs and keep observing the transcript.                                                                | Call the existing stop callback after durable owner release and before journal eviction; [#21002](https://github.com/stablyai/orca/pull/21002).                                                                                                                            | Four actual host/store/journal/watcher cases fail before and pass after; seven focused tests plus Node typecheck and independent review. Unverified stop or lease-write failure preserves retry; later journal failure cannot undo cleanup. Present in v1.4.198. [Artifacts](./tui-transcript-close/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
-| ML-031 | Scoped paired-runtime split closes while pane resolution is pending                                                                                                                 | Null transport ID hides an existing scoped remote handle; closing the viewer omits host retirement.                                                                                                                                           | Retire only the captured handle on its matching environment, rechecking pairing/current owners after compatibility; [#21005](https://github.com/stablyai/orca/pull/21005), stacked on #21001.                                                                              | Actual hook/transport/host RPC baseline 10 failures plus 5 controls becomes 15 passing cases. 255 selected renderer tests, independent 42-case review, full desktop typecheck and post-commit proof pass. Native hints/unscoped handles are excluded; stale handles cannot kill a new host incarnation. [Artifacts](./pending-runtime-pane-close/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| ML-032 | TUI transcript acquisition crosses host teardown                                                                                                                                    | Resolution/subscription/snapshot waits outlive stop; late setup retains a watcher or launches after shutdown. Naive cancellation can invoke replacement provider recovery after teardown.                                                     | Own cancellation before the first await; settle stopped preparation, release late subscriptions, and fence launch. Abandon unused reservations through existing durable transition without acquiring a replacement; [#21006](https://github.com/stablyai/orca/pull/21006). | Seven actual-host before/after cases: six fail before, all pass after; six additional replacement/ownership controls. Full desktop typecheck, post-commit proof, standalone React Doctor and changed-code gate pass. Ordinary errors retain native recovery; already-launched TUIs/admitted import I/O remain outside cancellation guarantee. Present in v1.4.198. [Artifacts](./tui-transcript-acquisition/README.md).                                                                                                                                                                                                                                                                                                                                                                                                               |
-| ML-033 | Main log-tail watcher acquisition and renderer lifetime                                                                                                                             | Async authorization installs a native watcher after renderer destruction; process loss and document replacement leave installed watchers alive.                                                                                               | One existing renderer-lifetime owner per sender invalidates pending admission, closes installed watches and releases listeners; exact identity protects newer requests/watchers. [#21009](https://github.com/stablyai/orca/pull/21009).                                    | Twenty real watchers retained before and zero after. Portable actual-handler baseline 10 failures/9 controls becomes 19 passing cases; 29 focused regressions, independent root lifecycle run, Node typecheck and quality gate pass. Present in v1.4.198; watcher/metadata, no file-content retention or incident-scale claim. [Artifacts](./local-log-tail-lifetime/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| ML-034 | Main browser page callbacks after native guest destruction                                                                                                                          | Policy-only cleanup deletes the primary index but leaves four per-page callback maps capturing dead guests; later unregisterAll cannot find them.                                                                                             | Call existing full unregister only for the exact primary guest; retain policy-only cleanup for popups and replaced guests. [#21010](https://github.com/stablyai/orca/pull/21010).                                                                                          | A thousand real-manager registration/destruction cycles retain 1,000 entries per affected map before and zero after. Nine-case portable proof has three failures before; 64 selected tests, Node typecheck and independent ownership review pass. Present in v1.4.198; no native-byte magnitude measured. [Artifacts](./browser-destroyed-guest-retention/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| ML-035 | Queued renderer graph after host-certified PTY exit                                                                                                                                 | A delayed graph restores a dead owner and can conflict with a successor in the same pane; weak inventory absence also discards the exit certificate.                                                                                          | Preserve existing exited authority through graph publication and weak absence, including exits after archive pruning. [#21011](https://github.com/stablyai/orca/pull/21011).                                                                                               | Actual publisher, Store and daemon sockets; 15 cases across three source variants, including real sleeping-pane preservation. 87 regression tests, independent review, post-commit reproduction and desktop typecheck pass. Certificates retain their existing bounded lifetime. [Artifacts](./queued-terminal-graph-exit/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| ML-036 | Browser registration replies after renderer ownership changes                                                                                                                       | Late IPC replies recreate removed guest-ID entries or mutate replacement annotation/recovery state.                                                                                                                                           | Fence admission and continuations using the existing disposed state, registry/ref identity and captured guest ID. [#21012](https://github.com/stablyai/orca/pull/21012).                                                                                                   | 1,000 closed pages retain 1,000 stale entries before and zero after. Ten failing cases plus six controls become 16 passing tests; 196 host-guest regressions, independent review and post-commit desktop typecheck/proof pass. Present in v1.4.198; small renderer metadata, no native-byte attribution. [Artifacts](./browser-registration-reply-retention/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| ML-037 | Provider inventory crosses spawn, registration or exit                                                                                                                              | A delayed process list can reconnect an exited record, overwrite a successor incarnation and invalidate its handle. Stale absence can also act on a newly admitted PTY.                                                                       | Reuse existing provider inventory generations to reject the whole stale census before mutation; retain host isolation and the existing bounded retry. [#21014](https://github.com/stablyai/orca/pull/21014).                                                               | Actual runtime proof: twelve failures plus six controls before, all 18 pass after. 59 regression tests, independent 42-test review, post-commit proof, desktop typecheck and the changed-code gate pass. Present in v1.4.198; no incident magnitude attribution. [Artifacts](./stale-pty-inventory/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
-| ML-038 | Terminal nonblank-tail backward cursor                                                                                                                                              | A leading newline and insufficient nonblank rows revisit offset zero forever.                                                                                                                                                                 | Stop at the first row and return the existing short-tail offset. [#21018](https://github.com/stablyai/orca/pull/21018).                                                                                                                                                    | Five isolated child deadlines before become returns after; two controls per variant, 50 helper/detector tests and full desktop typecheck pass. Byte-identical in v1.4.198. Actual ordinary producers filter blanks; full application trigger unproven. Loop allocates no growing collection and does not explain the OOM incidents. [Artifacts](./terminal-wait-leading-blank/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                             |
-| ML-039 | Physical EXIT precedes failed aggregate stop verification                                                                                                                           | Unrelated unavailable legacy endpoint makes stop return false after owning daemon physical EXIT; fallback kill replaces operator_close with stop_unverified and emits duplicate renderer exit.                                                | Preserve earned exited verdict only for the captured current stamped incarnation. [#21019](https://github.com/stablyai/orca/pull/21019), stacked on #21000.                                                                                                                | Eight scenarios per before/after phase use actual runtime/controller/router and two daemon sockets. 66 selected tests, independent eight-test review, post-commit proof and desktop typecheck pass. Replacement/unstamped/throwing paths preserve prior behavior; source present in v1.4.197. Exact-owner stop selection remains separate. [Artifacts](./terminal-close-observed-exit/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| ML-040 | Acknowledged renderer terminal-tab close crosses delayed graph removal                                                                                                              | Store rebasing preserves an omitted row after renderer flush; host close returns success before canonical retirement.                                                                                                                         | Capture exact persisted identity and original process incarnations, recheck host/generation/bindings/current pin, then reuse host retirement transaction. [#21020](https://github.com/stablyai/orca/pull/21020).                                                           | Actual renderer/Store/runtime proof: 28 failures plus three controls become 31 passes. 37 selected regressions, three independent ownership controls, root proof and post-commit proof pass. Direct renderer-only never-bound tabs, unified-only metadata and existing failed-flush rollback remain separate. [Artifacts](./acknowledged-tab-retirement/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
-| ML-041 | Claude restart history reader quota check precedes unrestricted read                                                                                                                | A file can grow beyond its checked 16 MiB quota before readFile allocates and accepts it.                                                                                                                                                     | Reuse readNodeFileWithinLimit to enforce the existing quota during reading; overflow remains inconsistent history. [#21021](https://github.com/stablyai/orca/pull/21021).                                                                                                  | Real-file 305-byte to 17 MiB race reads 17,825,792 bytes before; fixed read stops at 16,777,217 and rejects. Six controls and independent 28-test review pass, with full desktop typecheck and post-commit proof. Reader absent from v1.4.198; cannot explain #19768/#19831. [Artifacts](./claude-history-window-budget/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
-| ML-042 | Nested-repository BFS queue retains consumed directory records                                                                                                                      | Completed paths and inherited ignore rules stay reachable until scan completion.                                                                                                                                                              | Clear each consumed slot and compact an at-least-half-consumed prefix in batches, preserving traversal semantics. [#21022](https://github.com/stablyai/orca/pull/21022).                                                                                                   | At a controlled pause, 94 completed records and rule arrays survive GC before and zero after; slot-only control isolates retention. All variants visit the same 193 directories; 37 selected tests, independent review, Node typecheck, quality gate and post-commit proof pass. Byte-identical baseline in v1.4.198; temporary input-sized retention without incident attribution. [Artifacts](./nested-repo-processed-queue/README.md).                                                                                                                                                                                                                                                                                                                                                                                             |
-| ML-043 | Claude full transcript ancestry proof retains all message bodies during parsing                                                                                                     | Whole-file read/split keeps the full transcript alive while building a metadata-only proof.                                                                                                                                                   | Stream the same open file's finite initial prefix through the existing splitter and shared validator; [#21024](https://github.com/stablyai/orca/pull/21024).                                                                                                               | 32 MiB fixture sampled live heap 34.64 MB before to 1.12 MB after; 51 parity, 24 file/growth and 10 actual verifier controls pass under Node 26 and Electron Node 24. 98 affected tests, 204 comparative regressions, independent review, full desktop typecheck, quality gate and post-commit proof pass. Largest record and UUID graph remain input-sized. Reader present in v1.4.198; transient allocation, no incident attribution. [Artifacts](./claude-branch-proof-streaming/README.md).                                                                                                                                                                                                                                                                                                                                       |
-| ML-044 | xterm reflow insertion writes before logical row zero                                                                                                                               | Narrowing a wrapped buffer writes negative array properties and can overwrite valid retained rows.                                                                                                                                            | Stop the final insertion loop at destination zero; regenerate headless, renderer and mobile engines. [#21112](https://github.com/stablyai/orca/pull/21112), stacked on #20992.                                                                                             | 999 surplus properties before become zero after at 1,000-row capacity; retained text is corrected. 92 root and 24 mobile tests, 9 bounded memory children, 28 parity and 8 lifecycle cases, independent review and post-commit proof pass. Capacity-minus-one bound remains; temporary reflow allocation algorithm unchanged. Relevant source present in v1.4.198; no incident attribution. [Artifacts](./xterm-reflow-retention/README.md).                                                                                                                                                                                                                                                                                                                                                                                          |
-| ML-045 | Direct renderer close of a local never-bound terminal tab                                                                                                                           | Ordinary renderer save cannot retire host-owned membership, so closed empty rows reappear after restart.                                                                                                                                      | Optional desktop-local explicit action rechecks original identity and every current owner, then synchronously retires and flushes positive-epoch membership. [#21113](https://github.com/stablyai/orca/pull/21113).                                                        | Actual renderer/preload/IPC/Store/runtime/disk: 2 failures and 8 controls before become 10 passes. 29 focused and 43 existing regressions, 47 main-base overlay cases, independent review, desktop typechecks and post-commit proof pass. Epoch 0, SSH/paired, mounted/bound/structured/history rows are excluded. Addresses one #17344 mechanism; small metadata does not explain gigabyte incidents. [Artifacts](./local-empty-tab-retirement/README.md).                                                                                                                                                                                                                                                                                                                                                                           |
-| ML-046 | Crashpad file-size check precedes unrestricted read                                                                                                                                 | A growing dump can pass the existing 64 MiB stat check and then allocate a larger buffer.                                                                                                                                                     | Reuse the bounded reader during acquisition, skip only oversized candidates and report actual bytes. [#21128](https://github.com/stablyai/orca/pull/21128).                                                                                                                | Real-file proof: 65 MiB reaches the parser before; fixed reader selects the next valid dump. Three failures/four controls/one fixed-only skip become eight passes. Same-open growth, exact quota, descriptor release and reservation reuse covered. 51 tests, independent review, full desktop typecheck, quality and post-commit proof pass. Transient crash-time allocation; no incident attribution or aggregate RSS cap. [Artifacts](./crashpad-read-limit/README.md).                                                                                                                                                                                                                                                                                                                                                            |
-| ML-047 | Local speech worker retains transferred audio during slow/stalled recognition                                                                                                       | Feed RPC completion precedes decoding, so the worker queue can grow while main heap appears stable.                                                                                                                                           | Admit at most 8 MiB backing storage or 1,024 pending frames across current/predecessor workers; consumption ACKs and actual termination release credit. Explicit overload error stops dictation. [#21129](https://github.com/stablyai/orca/pull/21129).                    | Six actual-worker before/after cases pass on Node 26 and Electron Node 24; 16 MiB baseline becomes 8 MiB admitted, and tiny-frame count is bounded. 50 tests, independent accounting/lifecycle review, full desktop typecheck, quality and post-commit proof pass. New overload policy may lose pending transcript through existing error handling. Native models, replacement overlap and renderer IPC are separate. Trigger unproven in the incidents; normal audio rates do not match reported growth estimates. [Artifacts](./speech-worker-audio-budget/README.md).                                                                                                                                                                                                                                                              |
-| ML-048 | Consumed runtime RPC queue records retain completed payloads                                                                                                                        | Advancing a lane head leaves its completed records reachable while other calls keep the selector active.                                                                                                                                      | Clear consumed slots in both lanes; active calls remain owned by their completion closure. [#21131](https://github.com/stablyai/orca/pull/21131).                                                                                                                          | Eight completed 1 MiB input payloads before become zero after on Node 26 and Electron 43.7. Rolling cross-lane, cancellation, synchronous failure, active ownership and ordering controls pass, with 14 tests, Node/Web typechecks, quality and post-commit proof. Electron response retention differs from Node and is independently controlled. Record count remains bounded by existing compaction/admission. Remote/paired reachability does not explain local-only #19831. [Artifacts](./runtime-rpc-consumed-queue/README.md).                                                                                                                                                                                                                                                                                                  |
-| ML-049 | Aborted quota polls retain races on a shared filesystem operation                                                                                                                   | Removing the abort listener leaves the native result's Promise.race reactions; Electron retains each expired rejection reason until raw settlement.                                                                                           | Reuse detachable PromiseSettlementWaiters with auth-only deferred abort scheduling to preserve prior ordering. [#21135](https://github.com/stablyai/orca/pull/21135).                                                                                                      | Electron plain Errors retained128→1; the existing cancellation reason releases with the owner. Node already retains only one. All24 ordering comparisons match;50 auth/registry tests,39 existing consumer tests, full desktop typecheck, quality, root and post-commit proofs pass. Synthetic payload amplification is separate; actual native stall and incident magnitude unproven. [Artifacts](./auth-filesystem-wait-retention/README.md).                                                                                                                                                                                                                                                                                                                                                                                       |
-| ML-050 | GitLab successful host cache retains obsolete SSH generations                                                                                                                       | Every reconnect can leave another completed host-list array; delayed probes can also republish after reset or replacement.                                                                                                                    | Keep one successful generation per execution identity and fence publication with existing coalescer ownership plus current generation. [#21136](https://github.com/stablyai/orca/pull/21136).                                                                              | 128 successful arrays→1,16 remembered arrays→1 on Node/Electron; explicit reset→0.32 tests, Node typecheck, quality, root and post-commit proof pass. Native/WSL/other-connection isolation and remembered hosts preserved. Distinct identity lifetime and list bytes remain separate; small SSH metadata cannot explain all-local #19831. [Artifacts](./gitlab-known-host-retirement/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| ML-051 | Codex confirmed-cancel claims survive lookup eviction and exact completion                                                                                                          | Turn cleanup enumerated only lookup maps, leaving evicted/replaced prompts in the claims map until session clear.                                                                                                                             | Include claim keys in existing exact-thread/turn cleanup; retain identity-checked replacement protection. [#21138](https://github.com/stablyai/orca/pull/21138).                                                                                                           | Actual cancellation/translator proof:32 stale prompts→0 on Node/Electron, replacement1→0; wrong-turn/thread, refused lifecycle and active replacement controls pass.71 tests, desktop typechecks, independent review, root and post-commit proofs pass. Injected small-prompt ordering, no incident attribution. [Artifacts](./codex-prompt-claim-retention/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| ML-052 | Live terminal sessions retain completed spawn requests and consumed seed arrays                                                                                                     | Session-exit and foreground callbacks capture whole request/dependency contexts after creation finishes.                                                                                                                                      | Project exit identity, bind the unchanged host exit handler and capture foreground subprocess directly. [#21139](https://github.com/stablyai/orca/pull/21139).                                                                                                             | Three original request/env/history sets retained before→0after on Node/Electron; actual admission confirms release while attached, preparation/signal only after detach. Pending inputs, seeded snapshot, foreground receiver and exact exit/generation controls pass.67tests, desktop typechecks, independent review and post-commit proof pass. Native copied environment remains separate; no incident-byte claim. [Artifacts](./terminal-completed-spawn-inputs/README.md).                                                                                                                                                                                                                                                                                                                                                       |
-| ML-053 | Native PTY exit callback retains merged spawn environment                                                                                                                           | Reading one exit-status boolean through the full spawn argument object keeps its environment reachable while the handle lives.                                                                                                                | Capture the immutable spawn-time boolean before callback registration. [#21140](https://github.com/stablyai/orca/pull/21140).                                                                                                                                              | Actual wrapper and node-pty emitter proof: live arguments/environment1/1→0/0 on Node/Electron; owner drop0/0 both.114 tests pass, four platform skips; Node typecheck, independent review, root and post-commit proofs pass. PATH, foreground, early exit/data and disposal preserved. Shared environment strings/native bytes/incident magnitude are unmeasured. [Artifacts](./native-pty-spawn-env-retention/README.md).                                                                                                                                                                                                                                                                                                                                                                                                            |
+| ID     | Area/file                                                                                                                                                                           | Finding                                                                                                                                                                                                                                       | Action                                                                                                                                                                                                                                                                     | Validation                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| ML-001 | `src/renderer/src/components/editor/combined-diff/remember-view/combined-diff-view-memory.ts`                                                                                       | HMR re-evaluation accumulated an anonymous global listener and retained old module closures.                                                                                                                                                  | Named the handler and dispose it through `import.meta.hot.dispose`.                                                                                                                                                                                                        | `use-combined-diff-view-restore.test.tsx`: 3 passed; oxlint/oxfmt passed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| ML-003 | `src/main/window/*-request-relay.ts`                                                                                                                                                | Pending IPC requests retained response listeners and timers until timeout after renderer teardown.                                                                                                                                            | Unified settlement cleanup for response listeners, timers, and closed/destroyed/render-process-gone events; catch send failures.                                                                                                                                           | Focused main relay tests: 5 passed; oxlint passed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| ML-004 | `src/renderer/src/components/activity/activity-clear-completed.ts`                                                                                                                  | Module-level pagehide listener retained old HMR module closures.                                                                                                                                                                              | Added Vite HMR disposer.                                                                                                                                                                                                                                                   | oxlint/oxfmt passed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| ML-005 | `src/renderer/src/components/contextual-tours/ContextualTourOverlaySurface.tsx`                                                                                                     | Global Escape listener survived HMR and retained stale closure behind a window guard.                                                                                                                                                         | Added disposer that removes the listener and resets the guard.                                                                                                                                                                                                             | oxlint/oxfmt passed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| ML-006 | `src/renderer/src/lib/keyboard-layout/layout-base-character.ts`                                                                                                                     | HMR could duplicate the focus listener and API layout-change subscription after the module guard reset.                                                                                                                                       | Added disposer removing both hooks and resetting the installation guard.                                                                                                                                                                                                   | oxlint/oxfmt passed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| ML-007 | `src/renderer/src/lib/input-quiet-scheduler.ts`                                                                                                                                     | HMR could stack global capture listeners and stale `recordInput` closures.                                                                                                                                                                    | Added disposer removing listeners from the installed window.                                                                                                                                                                                                               | oxlint/oxfmt passed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| ML-009 | `src/renderer/src/components/terminal-pane/terminal-render-desync-trigger.ts`                                                                                                       | HMR could stack the opt-in mouseup listener and retain stale burst state.                                                                                                                                                                     | Added disposer removing the listener and stopping the active burst.                                                                                                                                                                                                        | oxlint/oxfmt passed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| ML-008 | `src/main/hang-watchdog/main-thread-hang-watchdog.ts`                                                                                                                               | Repeated watchdog lifecycles retained the app `will-quit` stop listener after manual stop/worker exit.                                                                                                                                        | Remove the app listener whenever the watchdog stops.                                                                                                                                                                                                                       | Hang watchdog tests: 8 passed; oxlint passed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| ML-002 | `src/preload/preload-runtime-support.ts`                                                                                                                                            | Installation functions could add duplicate global listeners if setup ran repeatedly, retaining closures and processing each drop more than once.                                                                                              | Added idempotent guards to native drop and browser-find listener installation.                                                                                                                                                                                             | Native chat drop scope test: 10 passed; oxlint passed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| ML-010 | `src/renderer/src/components/terminal-pane/terminal-parked-watcher-registry.ts`                                                                                                     | Parked panes bypass the normal close teardown; their keyed scroll-intent records stayed in strong Maps after tab close or worktree removal.                                                                                                   | Release captured leaf keys during parked-tab retirement and worktree pruning.                                                                                                                                                                                              | Parked-watcher reconciliation tests: 6 passed; PR #20924.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| ML-011 | `src/renderer/src/components/terminal-pane/terminal-hidden-worktree-retention.ts`, `terminal-eviction-exempt-tabs.ts`, `src/renderer/src/lib/pane-manager/pane-manager-registry.ts` | Fail-open, foreign-worktree, and capability-unknown PTYs are intentionally exempt from force-parking, so their mounted xterm panes can retain rows × columns of scrollback indefinitely; `pane-manager-registry` estimates 16 bytes per cell. | Kept as an unresolved safety tradeoff: force-unmounting these panes can orphan a live shell. The safe fix is to make the PTY classes reattachable or add authoritative capability resolution, then bound the exemption.                                                    | Source retaining-path review; existing eviction-exempt and pane-memory census instrumentation.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| ML-012 | `src/shared/process-table-index.ts`                                                                                                                                                 | A cyclic PID/parent relationship makes the descendant walk copy rows forever. A two-row cycle exhausted an isolated 32 MiB Node heap in about 0.15 seconds.                                                                                   | Independently verified existing open [#20715](https://github.com/stablyai/orca/pull/20715), avoiding a duplicate fix.                                                                                                                                                      | Exact production hunk passed cycle, self-cycle, root reuse, duplicate/shared-subtree fixtures and 500 acyclic parity cases; local evidence in `notes/process-table-cycle/`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| ML-013 | `src/main/stats/collector.ts`                                                                                                                                                       | The event cap was enforced only during serialization; stalled asynchronous persistence let the live event array grow without a bound.                                                                                                         | Enforce the existing 10,000-event cap on append, retaining newest events and lifetime totals; [#20941](https://github.com/stablyai/orca/pull/20941).                                                                                                                       | All 24 stats tests passed, including a blocked-write regression that fails before the fix.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| ML-014 | `src/relay/pty-shell-utils.ts`                                                                                                                                                      | The SSH relay has an independent descendant walker; cyclic parent links cause repeated copying/allocation there too, so fixing only ML-012 leaves the relay exposed.                                                                          | Added a visited-PID guard to the existing walker; [#20946](https://github.com/stablyai/orca/pull/20946).                                                                                                                                                                   | 42 relay foreground tests passed; cyclic regression stops after 20 reads if the guard is removed, avoiding an OOM in the test worker.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| ML-015 | `src/main/daemon/daemon-stream-data-batcher.ts` and stream/PTY pause ownership                                                                                                      | The 32 MiB held-queue valve transfers excess output into an unbounded socket queue when a reader stalls; small writes bypassed the held-queue valve too.                                                                                      | Backpressure visible producers, preserve hidden keep-tail shedding, and fence attachment handoffs; [#20947](https://github.com/stablyai/orca/pull/20947).                                                                                                                  | 163 tests in 11 suites; real paused-reader experiments demonstrate producer pause, bounded queues and complete drain. [Artifacts](./daemon-stream-retention/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| ML-016 | `src/main/browser/cdp-client-response-writer.ts`, `cdp-debugger-channel.ts`                                                                                                         | CDP events and responses accumulate in WebSocket buffers behind an unread client. A 128 MiB experiment retained 133,177,280 queued bytes.                                                                                                     | Reuse the existing bounded outbound queue and terminate stalled clients on overflow, preserving single large healthy replies; [#20949](https://github.com/stablyai/orca/pull/20949).                                                                                       | 66 tests; real WebSocket before/after reproduction. [Artifacts](./cdp-stream-retention/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| ML-017 | `src/shared/terminal-osc-link-retirement.ts`, headless/renderer/mobile terminal integrations                                                                                        | OSC 8 link entries and marker listeners survive overwritten cells. 10,000 redraws retain about 20.5–20.9 MB after GC with only 24 rows.                                                                                                       | Collect entries unreferenced by either buffer or active attributes after registry growth; [#20955](https://github.com/stablyai/orca/pull/20955).                                                                                                                           | Real installed headless and renderer builds retain about 1.6–1.7 MB after the fix; snapshot/fidelity/pane regressions and 15 mobile tests pass. Private xterm fields and buffer-size-dependent sweep cost are explicit limitations. [Artifacts](./osc-link-retention/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| ML-018 | CI excerpts, main/relay recent output, terminal tails/error surfaces, and Claude background-task labels                                                                             | Capped V8 slices pin oversized inputs. Eight 16 KiB CI excerpts retained 16–32 MiB; eight 4,000-character errors retained 32 MiB; eight terminal tails reporting 4 MiB retained 32 MiB.                                                       | Reuse the existing shared and renderer string copiers at fourteen retention boundaries, including per-PTY URL/status carries and normalized Claude task text; [#20960](https://github.com/stablyai/orca/pull/20960).                                                       | Real-function after-GC measurements fall to about 0.1–0.15 MiB, 33 KiB, and 4 MiB respectively. CI/provider/content and retained state/queue tests pass. Follow-up: 32 normal 64 Ki-character inputs retain about 2.1 MB in each isolated detector baseline; owned tails reduce this to 41 KB (status), 204 KB (URL), or 575 KB (pre-bind), including owners. These last-input costs scale with PTY count and can share backing storage. [Tail artifacts](./retained-text-slices/README.md), [detector artifacts](./pty-detector-retention/README.md). Actual Claude tracker follow-up: eight JSON-parsed 4 Mi-character labels retain about 33.56 MB before and 7–12 KB after across live, settled and recently removed task owners; 112 focused tests and 36 proof cases pass. [Task artifacts](./claude-task-retention/README.md). Terminal-mode follow-up: kitty live/replay and headless mouse mirrors retain about 2.1 MB for 32 normal 64 Ki-character inputs, or 33.56 MB for eight amplified 4 Mi-character inputs; copied 18-character tails reduce this to owner-scale kilobytes. All 98 focused tests and 84 Node/Electron cases pass, including Bufferless copying and mode completion/reset. This remains a per-owner last-input cost, and the proof isolates V8 legacy regexp statics. [Mode-tail artifacts](./terminal-mode-tail-retention/README.md). Plugin stdio tails and emitted bounded lines now detach their inputs: 200 short ring rows from 64 KiB chunks retain about 13.15 MB before and 43 KB after, while truncated rows retain legitimate capped text. 20 tests and 48 Node/Electron controls pass independently; feature-gated and bounded for fixed plugin count/chunk size. [Plugin artifacts](./plugin-worker-output-retention/README.md). |
+| ML-019 | `src/main/ai-vault/session-scanner-jsonl-reader.ts`                                                                                                                                 | Incremental JSONL framing retained an entire newline-free record and then allocated concatenated/decoded copies. A 64 MiB record peaks near 248 MiB RSS despite the scanner child’s 384 MiB V8 old-space setting.                             | Share the existing streamed remote 10 MiB record budget and reject before retaining/concatenating/decoding oversized records; [#20963](https://github.com/stablyai/orca/pull/20963).                                                                                       | Real-file reproduction peaks near 62 MiB RSS and stops at 10 MiB plus one input chunk; 71 reader/cache/WSL tests and ten reader/recovery tests pass (nine overlap). Valid larger records now produce a session scan issue; whole-document readers are outside this fix. [Artifacts](./transcript-record-retention/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| ML-020 | Vendored xterm WebGL `TextureAtlas`                                                                                                                                                 | Invisible glyph variants occupied no texture pixels but each added cache metadata, so page eviction never bounded them. 100,000 colored-space redraws retained 100,093 entries and about 13.5–13.7 MB of V8 heap growth on one texture page.  | Separate invisible caches with a shared 4,096-entry cap, preserving visible glyphs and pages; regenerated CJS/ESM/source maps and lockfile hashes in [#20965](https://github.com/stablyai/orca/pull/20965).                                                                | Actual installed CJS and ESM bundles retain 1,789 entries and about 0.2–0.4 MB heap growth; shared-terminal pixel hashes, cache hits, empty-only clear, 86 tests, and pinned regeneration checks pass. [Artifacts](./webgl-empty-glyph-retention/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| ML-021 | Legacy journal import and `native-chat/transcript-stream-lines.ts`                                                                                                                  | A stat-only 16 MiB quota could be bypassed by source growth before/during reading. A 149-byte file grown to 17 MiB was fully consumed and replaced the journal.                                                                               | Enforce the existing source-byte budget before framing each raw chunk and reject the whole import; [#20976](https://github.com/stablyai/orca/pull/20976).                                                                                                                  | 50 tests; actual-file proof refuses at 16 MiB plus one 64 KiB chunk, closes the stream and preserves the prior journal. [Artifacts](./legacy-import-source-budget/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| ML-022 | Structured session holds and RPC cleanup                                                                                                                                            | A surface releasing during provider acquisition leaves no timer when the child arrives. Overlapping failed holds could remove replacements or remove the last holder after another acquisition succeeded.                                     | Reuse release grace after acquisition/rollback, fence holder incarnations and RPC registrations, and guard disposal; [#20978](https://github.com/stablyai/orca/pull/20978).                                                                                                | 177 tests including cross-version and actual host/RPC stale-checkpoint refusal; independent review and actual-class before/after proof. Active turns and replacement holders survive. [Artifacts](./structured-hold-retention/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| ML-023 | `ai-vault/session-scanner-service-entry.ts`                                                                                                                                         | Late cancellation arrived after request cleanup and inserted an ID with no future owner to delete it.                                                                                                                                         | Admit cancellation only while the existing pending set owns the request; [#20980](https://github.com/stablyai/orca/pull/20980).                                                                                                                                            | 1,000 completed requests retain 1,000 IDs before and zero after; 26 service tests pass. This is small scanner-child metadata. [Artifacts](./scanner-late-cancel/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| ML-024 | Vendored xterm `ColorContrastCache`                                                                                                                                                 | Normal/dim contrast maps retain every distinct true-color pair, independent of glyph pages. 100,000 redraws retain over 100,000 entries and 4–5.5 MB heap growth even with periodic atlas clears.                                             | Bound each cache to 4,096 color/CSS entries and recalculate evicted values; [#20981](https://github.com/stablyai/orca/pull/20981), including a mobile-only generated patch.                                                                                                | 122 tests, six actual WebGL before/after runs and 12 DOM cases preserve corrected colors and pixels. Fixed desktop heap growth is about 0.3–0.4 MB. Mobile adds 23 engine/theme tests and eight actual before/after DOM cases; regeneration and 90 generator/cache/CI-contract tests pass. [Artifacts](./terminal-contrast-cache-retention/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| ML-025 | `ai-vault-search/session-search-index-writer.ts`                                                                                                                                    | A lifetime removal counter retained every retired transcript path after its database rows and reads were gone.                                                                                                                                | Track only active read lifetimes; release on commit/discard/error/incomplete read/close; [#20986](https://github.com/stablyai/orca/pull/20986).                                                                                                                            | Actual writer and SQLite: 1,000 retired paths before, zero after, stale commits still refused. 59 tests and independent review pass. Current-code scanner-child metadata, absent from v1.4.198. [Artifacts](./session-search-write-fences/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| ML-026 | Vendored xterm `BufferLine` in headless, desktop and mobile                                                                                                                         | Overwrite/erase leaves dead combined strings in sparse maps, invalid translation caches, or a shared scratch cell. Eight overwritten cells retain about 42.9 MiB.                                                                             | Release unused references while preserving live Unicode, protected/wide cells and moves; [#20992](https://github.com/stablyai/orca/pull/20992), stacked on #20981.                                                                                                         | Separate dead-text cases fall to about 0.1–0.2 MiB. 127 main tests, two generated mobile cases, 45 generator tests, 51 upstream tests, 25,000 semantic comparisons and 70 bundle cases pass. Emitted synthetic ASCII parsing costs about 5% more; no application-wide slope claim. [Artifacts](./terminal-cell-retention/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| ML-027 | Main runtime renderer/provider snapshot and seed paths                                                                                                                              | A retired/replaced headless model receives late async callbacks, recreating CWD/recent-output/title/hydration/generation metadata or deleting replacement bookkeeping.                                                                        | Guard the captured state and existing generation; clean up only the captured mode-tracker Set; [#20996](https://github.com/stablyai/orca/pull/20996).                                                                                                                      | Actual runtime: 16 failures before, all 22 pass after; 306 selected regressions and independent review pass. Ordinary live writes still drain; renderer wait remains bounded at 750 ms. Present in v1.4.198; size/frequency in the incidents unproven. [Artifacts](./headless-hydration-retention/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| ML-028 | PTY provider exit reconciliation after synthetic kill                                                                                                                               | A control reply overtakes final stream DATA/EXIT. DATA recreates a connected model; early duplicate suppression skips physical-exit cleanup even when fresh host inventory has proven exit.                                                   | Always reconcile the current incarnation in main; suppress only repeated renderer notification and match markers by incarnation; [#21000](https://github.com/stablyai/orca/pull/21000).                                                                                    | Real runtime/provider/server sockets: four before/after scenarios, 88 focused tests and independent 23-test review. Final output, one renderer notification, replacement state, and one-time SQLite dispatch settlement preserved. [Artifacts](./daemon-late-exit/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| ML-029 | Explicit split close while IPC connect is pending                                                                                                                                   | An unbound transport omits retirement and removes its saved leaf ID. Late reattach/cold-restore results remain protected, leaving a shell without a pane or kill request.                                                                     | Capture explicit intent, reuse local/direct-SSH retirement planning, and recheck ownership when the same-ID reply arrives; [#21001](https://github.com/stablyai/orca/pull/21001).                                                                                          | Actual hooks/transport plus daemon socket controls: before 14 failing assertions/10 controls, after 24 pass; 200 renderer regressions and independent 29-test review. Protects replacement/sibling owners, generic remounts, unresolved/paired routes; folder workspaces covered. [Artifacts](./pending-split-close/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| ML-030 | Structured TUI transcript catch-up after successful session close                                                                                                                   | Verified terminal close and durable lease release forgot the catch-up state and filesystem watcher; closed sessions retain seen-message IDs and keep observing the transcript.                                                                | Call the existing stop callback after durable owner release and before journal eviction; [#21002](https://github.com/stablyai/orca/pull/21002).                                                                                                                            | Four actual host/store/journal/watcher cases fail before and pass after; seven focused tests plus Node typecheck and independent review. Unverified stop or lease-write failure preserves retry; later journal failure cannot undo cleanup. Present in v1.4.198. [Artifacts](./tui-transcript-close/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| ML-031 | Scoped paired-runtime split closes while pane resolution is pending                                                                                                                 | Null transport ID hides an existing scoped remote handle; closing the viewer omits host retirement.                                                                                                                                           | Retire only the captured handle on its matching environment, rechecking pairing/current owners after compatibility; [#21005](https://github.com/stablyai/orca/pull/21005), stacked on #21001.                                                                              | Actual hook/transport/host RPC baseline 10 failures plus 5 controls becomes 15 passing cases. 255 selected renderer tests, independent 42-case review, full desktop typecheck and post-commit proof pass. Native hints/unscoped handles are excluded; stale handles cannot kill a new host incarnation. [Artifacts](./pending-runtime-pane-close/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| ML-032 | TUI transcript acquisition crosses host teardown                                                                                                                                    | Resolution/subscription/snapshot waits outlive stop; late setup retains a watcher or launches after shutdown. Naive cancellation can invoke replacement provider recovery after teardown.                                                     | Own cancellation before the first await; settle stopped preparation, release late subscriptions, and fence launch. Abandon unused reservations through existing durable transition without acquiring a replacement; [#21006](https://github.com/stablyai/orca/pull/21006). | Seven actual-host before/after cases: six fail before, all pass after; six additional replacement/ownership controls. Full desktop typecheck, post-commit proof, standalone React Doctor and changed-code gate pass. Ordinary errors retain native recovery; already-launched TUIs/admitted import I/O remain outside cancellation guarantee. Present in v1.4.198. [Artifacts](./tui-transcript-acquisition/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| ML-033 | Main log-tail watcher acquisition and renderer lifetime                                                                                                                             | Async authorization installs a native watcher after renderer destruction; process loss and document replacement leave installed watchers alive.                                                                                               | One existing renderer-lifetime owner per sender invalidates pending admission, closes installed watches and releases listeners; exact identity protects newer requests/watchers. [#21009](https://github.com/stablyai/orca/pull/21009).                                    | Twenty real watchers retained before and zero after. Portable actual-handler baseline 10 failures/9 controls becomes 19 passing cases; 29 focused regressions, independent root lifecycle run, Node typecheck and quality gate pass. Present in v1.4.198; watcher/metadata, no file-content retention or incident-scale claim. [Artifacts](./local-log-tail-lifetime/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| ML-034 | Main browser page callbacks after native guest destruction                                                                                                                          | Policy-only cleanup deletes the primary index but leaves four per-page callback maps capturing dead guests; later unregisterAll cannot find them.                                                                                             | Call existing full unregister only for the exact primary guest; retain policy-only cleanup for popups and replaced guests. [#21010](https://github.com/stablyai/orca/pull/21010).                                                                                          | A thousand real-manager registration/destruction cycles retain 1,000 entries per affected map before and zero after. Nine-case portable proof has three failures before; 64 selected tests, Node typecheck and independent ownership review pass. Present in v1.4.198; no native-byte magnitude measured. [Artifacts](./browser-destroyed-guest-retention/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| ML-035 | Queued renderer graph after host-certified PTY exit                                                                                                                                 | A delayed graph restores a dead owner and can conflict with a successor in the same pane; weak inventory absence also discards the exit certificate.                                                                                          | Preserve existing exited authority through graph publication and weak absence, including exits after archive pruning. [#21011](https://github.com/stablyai/orca/pull/21011).                                                                                               | Actual publisher, Store and daemon sockets; 15 cases across three source variants, including real sleeping-pane preservation. 87 regression tests, independent review, post-commit reproduction and desktop typecheck pass. Certificates retain their existing bounded lifetime. [Artifacts](./queued-terminal-graph-exit/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| ML-036 | Browser registration replies after renderer ownership changes                                                                                                                       | Late IPC replies recreate removed guest-ID entries or mutate replacement annotation/recovery state.                                                                                                                                           | Fence admission and continuations using the existing disposed state, registry/ref identity and captured guest ID. [#21012](https://github.com/stablyai/orca/pull/21012).                                                                                                   | 1,000 closed pages retain 1,000 stale entries before and zero after. Ten failing cases plus six controls become 16 passing tests; 196 host-guest regressions, independent review and post-commit desktop typecheck/proof pass. Present in v1.4.198; small renderer metadata, no native-byte attribution. [Artifacts](./browser-registration-reply-retention/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| ML-037 | Provider inventory crosses spawn, registration or exit                                                                                                                              | A delayed process list can reconnect an exited record, overwrite a successor incarnation and invalidate its handle. Stale absence can also act on a newly admitted PTY.                                                                       | Reuse existing provider inventory generations to reject the whole stale census before mutation; retain host isolation and the existing bounded retry. [#21014](https://github.com/stablyai/orca/pull/21014).                                                               | Actual runtime proof: twelve failures plus six controls before, all 18 pass after. 59 regression tests, independent 42-test review, post-commit proof, desktop typecheck and the changed-code gate pass. Present in v1.4.198; no incident magnitude attribution. [Artifacts](./stale-pty-inventory/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| ML-038 | Terminal nonblank-tail backward cursor                                                                                                                                              | A leading newline and insufficient nonblank rows revisit offset zero forever.                                                                                                                                                                 | Stop at the first row and return the existing short-tail offset. [#21018](https://github.com/stablyai/orca/pull/21018).                                                                                                                                                    | Five isolated child deadlines before become returns after; two controls per variant, 50 helper/detector tests and full desktop typecheck pass. Byte-identical in v1.4.198. Actual ordinary producers filter blanks; full application trigger unproven. Loop allocates no growing collection and does not explain the OOM incidents. [Artifacts](./terminal-wait-leading-blank/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| ML-039 | Physical EXIT precedes failed aggregate stop verification                                                                                                                           | Unrelated unavailable legacy endpoint makes stop return false after owning daemon physical EXIT; fallback kill replaces operator_close with stop_unverified and emits duplicate renderer exit.                                                | Preserve earned exited verdict only for the captured current stamped incarnation. [#21019](https://github.com/stablyai/orca/pull/21019), stacked on #21000.                                                                                                                | Eight scenarios per before/after phase use actual runtime/controller/router and two daemon sockets. 66 selected tests, independent eight-test review, post-commit proof and desktop typecheck pass. Replacement/unstamped/throwing paths preserve prior behavior; source present in v1.4.197. Exact-owner stop selection remains separate. [Artifacts](./terminal-close-observed-exit/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| ML-040 | Acknowledged renderer terminal-tab close crosses delayed graph removal                                                                                                              | Store rebasing preserves an omitted row after renderer flush; host close returns success before canonical retirement.                                                                                                                         | Capture exact persisted identity and original process incarnations, recheck host/generation/bindings/current pin, then reuse host retirement transaction. [#21020](https://github.com/stablyai/orca/pull/21020).                                                           | Actual renderer/Store/runtime proof: 28 failures plus three controls become 31 passes. 37 selected regressions, three independent ownership controls, root proof and post-commit proof pass. Direct renderer-only never-bound tabs, unified-only metadata and existing failed-flush rollback remain separate. [Artifacts](./acknowledged-tab-retirement/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| ML-041 | Claude restart history reader quota check precedes unrestricted read                                                                                                                | A file can grow beyond its checked 16 MiB quota before readFile allocates and accepts it.                                                                                                                                                     | Reuse readNodeFileWithinLimit to enforce the existing quota during reading; overflow remains inconsistent history. [#21021](https://github.com/stablyai/orca/pull/21021).                                                                                                  | Real-file 305-byte to 17 MiB race reads 17,825,792 bytes before; fixed read stops at 16,777,217 and rejects. Six controls and independent 28-test review pass, with full desktop typecheck and post-commit proof. Reader absent from v1.4.198; cannot explain #19768/#19831. [Artifacts](./claude-history-window-budget/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| ML-042 | Nested-repository BFS queue retains consumed directory records                                                                                                                      | Completed paths and inherited ignore rules stay reachable until scan completion.                                                                                                                                                              | Clear each consumed slot and compact an at-least-half-consumed prefix in batches, preserving traversal semantics. [#21022](https://github.com/stablyai/orca/pull/21022).                                                                                                   | At a controlled pause, 94 completed records and rule arrays survive GC before and zero after; slot-only control isolates retention. All variants visit the same 193 directories; 37 selected tests, independent review, Node typecheck, quality gate and post-commit proof pass. Byte-identical baseline in v1.4.198; temporary input-sized retention without incident attribution. [Artifacts](./nested-repo-processed-queue/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| ML-043 | Claude full transcript ancestry proof retains all message bodies during parsing                                                                                                     | Whole-file read/split keeps the full transcript alive while building a metadata-only proof.                                                                                                                                                   | Stream the same open file's finite initial prefix through the existing splitter and shared validator; [#21024](https://github.com/stablyai/orca/pull/21024).                                                                                                               | 32 MiB fixture sampled live heap 34.64 MB before to 1.12 MB after; 51 parity, 24 file/growth and 10 actual verifier controls pass under Node 26 and Electron Node 24. 98 affected tests, 204 comparative regressions, independent review, full desktop typecheck, quality gate and post-commit proof pass. Largest record and UUID graph remain input-sized. Reader present in v1.4.198; transient allocation, no incident attribution. [Artifacts](./claude-branch-proof-streaming/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| ML-044 | xterm reflow insertion writes before logical row zero                                                                                                                               | Narrowing a wrapped buffer writes negative array properties and can overwrite valid retained rows.                                                                                                                                            | Stop the final insertion loop at destination zero; regenerate headless, renderer and mobile engines. [#21112](https://github.com/stablyai/orca/pull/21112), stacked on #20992.                                                                                             | 999 surplus properties before become zero after at 1,000-row capacity; retained text is corrected. 92 root and 24 mobile tests, 9 bounded memory children, 28 parity and 8 lifecycle cases, independent review and post-commit proof pass. Capacity-minus-one bound remains; temporary reflow allocation algorithm unchanged. Relevant source present in v1.4.198; no incident attribution. [Artifacts](./xterm-reflow-retention/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| ML-045 | Direct renderer close of a local never-bound terminal tab                                                                                                                           | Ordinary renderer save cannot retire host-owned membership, so closed empty rows reappear after restart.                                                                                                                                      | Optional desktop-local explicit action rechecks original identity and every current owner, then synchronously retires and flushes positive-epoch membership. [#21113](https://github.com/stablyai/orca/pull/21113).                                                        | Actual renderer/preload/IPC/Store/runtime/disk: 2 failures and 8 controls before become 10 passes. 29 focused and 43 existing regressions, 47 main-base overlay cases, independent review, desktop typechecks and post-commit proof pass. Epoch 0, SSH/paired, mounted/bound/structured/history rows are excluded. Addresses one #17344 mechanism; small metadata does not explain gigabyte incidents. [Artifacts](./local-empty-tab-retirement/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| ML-046 | Crashpad file-size check precedes unrestricted read                                                                                                                                 | A growing dump can pass the existing 64 MiB stat check and then allocate a larger buffer.                                                                                                                                                     | Reuse the bounded reader during acquisition, skip only oversized candidates and report actual bytes. [#21128](https://github.com/stablyai/orca/pull/21128).                                                                                                                | Real-file proof: 65 MiB reaches the parser before; fixed reader selects the next valid dump. Three failures/four controls/one fixed-only skip become eight passes. Same-open growth, exact quota, descriptor release and reservation reuse covered. 51 tests, independent review, full desktop typecheck, quality and post-commit proof pass. Transient crash-time allocation; no incident attribution or aggregate RSS cap. [Artifacts](./crashpad-read-limit/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| ML-047 | Local speech worker retains transferred audio during slow/stalled recognition                                                                                                       | Feed RPC completion precedes decoding, so the worker queue can grow while main heap appears stable.                                                                                                                                           | Admit at most 8 MiB backing storage or 1,024 pending frames across current/predecessor workers; consumption ACKs and actual termination release credit. Explicit overload error stops dictation. [#21129](https://github.com/stablyai/orca/pull/21129).                    | Six actual-worker before/after cases pass on Node 26 and Electron Node 24; 16 MiB baseline becomes 8 MiB admitted, and tiny-frame count is bounded. 50 tests, independent accounting/lifecycle review, full desktop typecheck, quality and post-commit proof pass. New overload policy may lose pending transcript through existing error handling. Native models, replacement overlap and renderer IPC are separate. Trigger unproven in the incidents; normal audio rates do not match reported growth estimates. [Artifacts](./speech-worker-audio-budget/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| ML-048 | Consumed runtime RPC queue records retain completed payloads                                                                                                                        | Advancing a lane head leaves its completed records reachable while other calls keep the selector active.                                                                                                                                      | Clear consumed slots in both lanes; active calls remain owned by their completion closure. [#21131](https://github.com/stablyai/orca/pull/21131).                                                                                                                          | Eight completed 1 MiB input payloads before become zero after on Node 26 and Electron 43.7. Rolling cross-lane, cancellation, synchronous failure, active ownership and ordering controls pass, with 14 tests, Node/Web typechecks, quality and post-commit proof. Electron response retention differs from Node and is independently controlled. Record count remains bounded by existing compaction/admission. Remote/paired reachability does not explain local-only #19831. [Artifacts](./runtime-rpc-consumed-queue/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| ML-049 | Aborted quota polls retain races on a shared filesystem operation                                                                                                                   | Removing the abort listener leaves the native result's Promise.race reactions; Electron retains each expired rejection reason until raw settlement.                                                                                           | Reuse detachable PromiseSettlementWaiters with auth-only deferred abort scheduling to preserve prior ordering. [#21135](https://github.com/stablyai/orca/pull/21135).                                                                                                      | Electron plain Errors retained128→1; the existing cancellation reason releases with the owner. Node already retains only one. All24 ordering comparisons match;50 auth/registry tests,39 existing consumer tests, full desktop typecheck, quality, root and post-commit proofs pass. Synthetic payload amplification is separate; actual native stall and incident magnitude unproven. [Artifacts](./auth-filesystem-wait-retention/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| ML-050 | GitLab successful host cache retains obsolete SSH generations                                                                                                                       | Every reconnect can leave another completed host-list array; delayed probes can also republish after reset or replacement.                                                                                                                    | Keep one successful generation per execution identity and fence publication with existing coalescer ownership plus current generation. [#21136](https://github.com/stablyai/orca/pull/21136).                                                                              | 128 successful arrays→1,16 remembered arrays→1 on Node/Electron; explicit reset→0.32 tests, Node typecheck, quality, root and post-commit proof pass. Native/WSL/other-connection isolation and remembered hosts preserved. Distinct identity lifetime and list bytes remain separate; small SSH metadata cannot explain all-local #19831. [Artifacts](./gitlab-known-host-retirement/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| ML-051 | Codex confirmed-cancel claims survive lookup eviction and exact completion                                                                                                          | Turn cleanup enumerated only lookup maps, leaving evicted/replaced prompts in the claims map until session clear.                                                                                                                             | Include claim keys in existing exact-thread/turn cleanup; retain identity-checked replacement protection. [#21138](https://github.com/stablyai/orca/pull/21138).                                                                                                           | Actual cancellation/translator proof:32 stale prompts→0 on Node/Electron, replacement1→0; wrong-turn/thread, refused lifecycle and active replacement controls pass.71 tests, desktop typechecks, independent review, root and post-commit proofs pass. Injected small-prompt ordering, no incident attribution. [Artifacts](./codex-prompt-claim-retention/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| ML-052 | Live terminal sessions retain completed spawn requests and consumed seed arrays                                                                                                     | Session-exit and foreground callbacks capture whole request/dependency contexts after creation finishes.                                                                                                                                      | Project exit identity, bind the unchanged host exit handler and capture foreground subprocess directly. [#21139](https://github.com/stablyai/orca/pull/21139).                                                                                                             | Three original request/env/history sets retained before→0after on Node/Electron; actual admission confirms release while attached, preparation/signal only after detach. Pending inputs, seeded snapshot, foreground receiver and exact exit/generation controls pass.67tests, desktop typechecks, independent review and post-commit proof pass. Native copied environment remains separate; no incident-byte claim. [Artifacts](./terminal-completed-spawn-inputs/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| ML-053 | Native PTY exit callback retains merged spawn environment                                                                                                                           | Reading one exit-status boolean through the full spawn argument object keeps its environment reachable while the handle lives.                                                                                                                | Capture the immutable spawn-time boolean before callback registration. [#21140](https://github.com/stablyai/orca/pull/21140).                                                                                                                                              | Actual wrapper and node-pty emitter proof: live arguments/environment1/1→0/0 on Node/Electron; owner drop0/0 both.114 tests pass, four platform skips; Node typecheck, independent review, root and post-commit proofs pass. PATH, foreground, early exit/data and disposal preserved. Shared environment strings/native bytes/incident magnitude are unmeasured. [Artifacts](./native-pty-spawn-env-retention/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| ML-054 | Empty streamed agent deltas retain array slots                                                                                                                                      | Codex accepts empty deltas; each appends a slot while charging zero bytes, and flush does not remove slots.                                                                                                                                   | Skip only the empty append, preserving stream creation, timers, publication and backpressure. [#21142](https://github.com/stablyai/orca/pull/21142).                                                                                                                       | Four batches retain 65,536 slots before and zero after on Node/Electron; current and v1.4.198 module overlays preserve publication records. 64 author tests, 43 root tests and 15 independent tests pass (overlapping). Counts are entries, not heap/RSS; ordinary Claude filters empty text. [Artifacts](./empty-streamed-delta-retention/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| ML-055 | Canceled working-directory validation waiters                                                                                                                                       | Per-caller native-promise cleanup and first-caller scope keep aborted signals reachable until native stat completes.                                                                                                                          | Clear caller holders/listeners while preserving per-call reaction order, raw promise identity and native/UNC custody. [#21144](https://github.com/stablyai/orca/pull/21144).                                                                                               | 31 tests pass independently; Node/Electron retain 32 signals before and 0 after with one native operation unchanged. 48 schedules plus 6 external-observer controls per runtime; small empty reaction/holder metadata still remains until settlement. No byte or incident attribution. [Artifacts](./working-directory-wait-retention/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| ML-056 | SSH multiplexer completed write entries                                                                                                                                             | A continuously nonempty lane keeps selected entries behind its head cursor after byte/frame accounting releases them.                                                                                                                         | Clear selected slots and amortize prefix compaction using the existing relay-buffer pattern. [#21150](https://github.com/stablyai/orca/pull/21150).                                                                                                                        | 2,048 completed buffers/callbacks become collectible while the same two live frames stay queued. Real Node Writable preserves one in-flight buffer; 31 tests, both 12-case runtime proofs and independent FIFO/liveness/randomized scheduling controls pass. Scheduler matches v1.4.198; supporting-source differences disclosed. No affected-host RSS attribution. [Artifacts](./ssh-writer-consumed-prefix/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |

 ## GitHub memory-issue correlation

@@ -101,10 +104,12 @@ the same as resident child processes, and a child workload OOM is not evidence o
 an Orca heap leak.

 The [issue-search index](./memory-issue-index-2026-09-15.json) preserves 58 original
-title matches for `memory`, `oom`, `leak`, `orphan`, `RAM`, and `growth`, plus three
-later reports, with explicit unrelated exclusions. The latest batched recheck
-found 60 open matches; #9141 remains absent. All six `hasNextPage` flags were
-false. Broader body searches supplied additional reports.
+title matches for `memory`, `oom`, `leak`, `orphan`, `RAM`, and `growth`, plus nine
+later reports, with explicit unrelated exclusions. The expanded batched recheck
+adds `heap`, `RSS` and `swap` and found 66 open matches; #9141 remains absent.
+All nine `hasNextPage` flags were false. Broader body searches supplied additional reports.
+
+The [expanded search review](./expanded-memory-issue-review/README.md) accounts for six further title matches. #13852 has a direct code explanation: the build-hash endpoint and exact-version handshake strand older relay sessions, while discovery/GC preserve live owners. Seven current isolation/handshake tests pass. A comment reports 19 relay processes and 839 MB RSS; those are field measurements from the commenter, not this audit. This remote path does not explain #19831’s all-local workload. #10382’s [reported-version telemetry review](./renderer-exit5-telemetry/README.md) passes 89 current tests and five historical actual-source controls. Minute-only heap sampling and survivor-only process metrics cannot identify or exclude memory failure. Its recovery breaker naturally permits all eight reported intervals; the concrete crash cause remains unresolved. Four other new matches concern layout, configuration or archive swaps rather than reported retained RAM.

 The new [#21121](https://github.com/stablyai/orca/issues/21121)/[#21122](https://github.com/stablyai/orca/issues/21122) reports have identical bodies. Four [actual-source baseline controls](./editor-duplicate-issue-review/README.md) reproduce duplicate serialization, a surviving same-document sibling after close, acceptance of a missing active-file ID, and focus-derived tab ownership. Existing open [#21124](https://github.com/stablyai/orca/pull/21124)/[#21125](https://github.com/stablyai/orca/pull/21125) address persistence/close and restore healing. Their authors' application evidence is distinguished from this audit's independently run store controls.

@@ -382,6 +387,9 @@ Windows creator-PID reuse can admit a numeric cycle after a parent exits and its
 - [#21138 — release completed Codex prompt claims](https://github.com/stablyai/orca/pull/21138)
 - [#21139 — release completed terminal spawn inputs](https://github.com/stablyai/orca/pull/21139)
 - [#21140 — release native PTY spawn environment](https://github.com/stablyai/orca/pull/21140)
+- [#21142 — skip empty streamed text chunks](https://github.com/stablyai/orca/pull/21142)
+- [#21144 — release canceled working-directory waiters](https://github.com/stablyai/orca/pull/21144)
+- [#21150 — release completed SSH writer queue entries](https://github.com/stablyai/orca/pull/21150)

 Validation: the initial lifecycle pass ran 27 focused tests. Subsequent fixes ran
 24 stats tests, 42 relay foreground tests, 163 daemon stream tests, and 66 CDP tests.
@@ -409,7 +417,7 @@ window was opened.

 The first daemon-idle cleanup proposal (#20925) was closed and reverted after a
 race review showed that pre-v24 `listSessions` followed by `shutdown` could kill
-new live work. It is not counted among the 49 published fixes. Fan-out was used
+new live work. It is not counted among the 52 published fixes. Fan-out was used
 for the initial audit and issue passes. Agents temporarily hit the service
 usage limit, so the hyperlink, retained-string, transcript, and WebGL work was
 reviewed and validated locally. The resumed pass again used three parallel
@@ -29,13 +29,13 @@
    ".tsx",
    ".vbs"
  ],
-  "sourceFilesSearched": 25659,
-  "matchingFiles": 7877,
+  "sourceFilesSearched": 25685,
+  "matchingFiles": 7888,
  "counts": {
-    "addEventListener": 1554,
+    "addEventListener": 1555,
    "removeEventListener": 1203,
-    "setTimeout": 3956,
-    "clearTimeout": 1855,
+    "setTimeout": 3961,
+    "clearTimeout": 1857,
    "setInterval": 383,
    "clearInterval": 218,
    "requestAnimationFrame": 586,
@@ -46,11 +46,11 @@
    "MutableDisposable": 1,
    "onWillDispose": 1,
    "onDidDispose": 17,
-    "new Map": 7598,
-    "new Set": 7274,
+    "new Map": 7604,
+    "new Set": 7276,
    "Buffer.concat": 277,
    "Promise.race": 215,
-    "Promise.withResolvers": 147
+    "Promise.withResolvers": 157
  },
  "files": {
    ".github/actions/cloud-sql-rollout-lease/renew.mjs": {
@@ -1320,6 +1320,9 @@
    "docs/audits/daemon-stream-retention/reproduce.mjs": {
      "setTimeout": 1
    },
+    "docs/audits/empty-streamed-delta-retention/scenario.cjs": {
+      "new Set": 1
+    },
    "docs/audits/gitlab-known-host-retirement/reproduce.cjs": {
      "Promise.withResolvers": 4,
      "setTimeout": 1
@@ -1358,6 +1361,9 @@
    "docs/audits/pending-split-close/daemon-proof.test.ts": {
      "Promise.withResolvers": 2
    },
+    "docs/audits/plugin-worker-output-retention/reproduce.cjs": {
+      "setTimeout": 1
+    },
    "docs/audits/posix-command-row-framing/reproduce.cjs": {
      "setTimeout": 1
    },
@@ -1388,6 +1394,11 @@
    "docs/audits/relay-replay-overflow/replay-fixture.test.ts": {
      "Buffer.concat": 1
    },
+    "docs/audits/rpc-inflight-admission-review/fixture.test.mjs": {
+      "addEventListener": 1,
+      "new Map": 1,
+      "setTimeout": 1
+    },
    "docs/audits/runtime-rpc-consumed-queue/extended-controls.cjs": {
      "Promise.withResolvers": 2,
      "new Set": 1,
@@ -1409,6 +1420,13 @@
    "docs/audits/speech-worker-audio-queue/reproduce.cjs": {
      "setTimeout": 1
    },
+    "docs/audits/ssh-writer-consumed-prefix/reproduce.cjs": {
+      "clearTimeout": 1,
+      "setTimeout": 1
+    },
+    "docs/audits/ssh-writer-consumed-prefix/sources.cjs": {
+      "new Map": 3
+    },
    "docs/audits/structured-hold-retention/reproduce.mjs": {
      "Promise.withResolvers": 1,
      "setTimeout": 1
@@ -1440,9 +1458,22 @@
    "docs/audits/terminal-contrast-cache-retention/reproduce.mjs": {
      "requestAnimationFrame": 1
    },
+    "docs/audits/terminal-mode-tail-retention/reproduce.cjs": {
+      "setTimeout": 1
+    },
    "docs/audits/webgl-empty-glyph-retention/reproduce.mjs": {
      "requestAnimationFrame": 1
    },
+    "docs/audits/working-directory-wait-retention/reproduce.cjs": {
+      "clearTimeout": 1,
+      "setTimeout": 1
+    },
+    "docs/audits/working-directory-wait-retention/scenario.cjs": {
+      "Promise.withResolvers": 8
+    },
+    "docs/audits/working-directory-wait-retention/sources.cjs": {
+      "new Map": 2
+    },
    "docs/audits/xterm-reflow-retention/child.cjs": {
      "setTimeout": 2
    },
@@ -8759,6 +8790,9 @@
      "new Set": 1,
      "setTimeout": 1
    },
+    "src/main/native-chat/agent-session-wire/agent-session-empty-delta-retention.test.ts": {
+      "new Set": 1
+    },
    "src/main/native-chat/agent-session-wire/agent-session-history-page-bounds.ts": {
      "new Map": 1
    },
@@ -9976,6 +10010,9 @@
      "clearTimeout": 1,
      "setTimeout": 2
    },
+    "src/main/providers/working-directory-validation-retention.test.ts": {
+      "Promise.withResolvers": 2
+    },
    "src/main/providers/working-directory-validation.ts": {
      "addEventListener": 1,
      "new Map": 2,
@@ -7,7 +7,7 @@
    "jobUrl": "https://github.com/stablyai/orca/actions/runs/35175767178/job/105057094035",
    "failure": "Untouched browser-history-match.performance.test.ts cold corpus p95 was 2.584757 ms against a 2 ms threshold; 10157 other tests in that shard passed.",
    "testBlobOnMainAndTopic": "7a99c2ad49df25f4ebd4cca6fa2c1812f345b959",
-    "interpretation": "No browser source or timing threshold changes in this PR. This log establishes a missed performance threshold, not why it occurred. One failed-job rerun requested."
+    "interpretation": "No browser source or timing threshold changes in this PR. This log establishes a missed performance threshold, not why it occurred. One failed-job rerun passed on the same head; no product or threshold change was made."
  },
  "runtimeRpcColdCacheCi": {
    "pullRequest": 21131,
@@ -25,343 +25,364 @@
      "base": "main",
      "head": "86cd9f2ee1ad92ecc559993fdf92e08407c31c75",
      "state": "SUCCESS",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 20904,
      "base": "main",
      "head": "0a2a06068c0e7a1dda3fd053396cd2764edbfc1c",
      "state": "SUCCESS",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 20905,
      "base": "main",
      "head": "42a1b16c3c49403735b6656435bb6eb6a4f31fbe",
      "state": "SUCCESS",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 20906,
      "base": "main",
      "head": "dcc4338a4221017b215a3f0f8fc0ae62825c16d3",
      "state": "FAILURE",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 20908,
      "base": "main",
      "head": "04a81de660dba6595c047b152f4da97a660f031c",
      "state": "FAILURE",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 20909,
      "base": "main",
      "head": "c2e588e985b139995538e3e57cd48915357e9eea",
      "state": "FAILURE",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 20910,
      "base": "main",
      "head": "4b3a336ffb004d090ce8faa8966cfee067df7ab7",
      "state": "FAILURE",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 20924,
      "base": "main",
      "head": "0c4809b96920df62ec64cd1ff0549bc01916d9d2",
      "state": "SUCCESS",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 20941,
      "base": "main",
      "head": "b34a5d921a66f9a26388fe32273732d48303dcf7",
      "state": "FAILURE",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 20946,
      "base": "main",
      "head": "47a50b69344148ad965a4334ce4f10124bbeeda6",
      "state": "SUCCESS",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 20947,
      "base": "main",
      "head": "ca5aea1a056bcf38ff989907071e6beea003c5de",
      "state": "SUCCESS",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 20949,
      "base": "main",
      "head": "d12d1e0a06f3ced9425e98f3593e0864ef16830b",
      "state": "SUCCESS",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 20955,
      "base": "main",
      "head": "5e984fd09326c41a596863a3dee6607d3a1024ad",
      "state": "FAILURE",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 20960,
      "base": "main",
-      "head": "8d599520e44654a5c28e9930e3070c00d6499931",
-      "state": "FAILURE",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "head": "d15b6d63f7c13e8afb5555d26691c68150c67723",
+      "state": "PENDING",
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 20963,
      "base": "main",
      "head": "4beab0c60cdb9c80c124b37d4b43c3863b1a38c8",
      "state": "SUCCESS",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 20965,
      "base": "main",
      "head": "2a48cae631b81b4b58c8dfd7f8379cfad7b6365f",
      "state": "SUCCESS",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 20976,
      "base": "main",
      "head": "8138b484eaf2e3efa656d1066eb24be63e40435c",
      "state": "SUCCESS",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 20978,
      "base": "main",
      "head": "1b739a95c949cbbfa52de7bd7e217854ef1aaa6a",
      "state": "FAILURE",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 20980,
      "base": "main",
      "head": "87b2d00025337e5d7e5fac0a72245a89702853ec",
      "state": "SUCCESS",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 20981,
      "base": "main",
      "head": "05caeb6df18ef319fe9e9437e86e39e99cd02bf4",
      "state": "FAILURE",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 20986,
      "base": "main",
      "head": "03270639f008359752ba0b4c5a45339ac39eeeb7",
      "state": "FAILURE",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 20992,
      "base": "np-oom-scan-contrast-cache",
      "head": "ccac7bb908ef74856a9f51973faffc9204f085ff",
      "state": "SUCCESS",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 20996,
      "base": "main",
      "head": "a664619361bcf6cf4409d0b50480c87830ed1ce5",
      "state": "FAILURE",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 21000,
      "base": "main",
      "head": "827dabf9582a92820d340c58452b66468f5e2199",
      "state": "FAILURE",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 21001,
      "base": "main",
      "head": "ff9cdbc498ebc1d7d41d9e0463d01ab3e25a3415",
      "state": "FAILURE",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 21002,
      "base": "main",
      "head": "bbab979c73c81c90a6096626195ae244a1dedd9c",
      "state": "FAILURE",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 21005,
      "base": "np-oom-scan-pending-split-close",
      "head": "9effc47aacec86d2be4a44c94249073ac5adda09",
      "state": "FAILURE",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 21006,
      "base": "main",
      "head": "5333f0f4e1d8be5bceefc467a9e28feb5a422554",
      "state": "FAILURE",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 21009,
      "base": "main",
      "head": "8da602c7e3a74655f98039705bbfede174078e79",
      "state": "FAILURE",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 21010,
      "base": "main",
      "head": "c8f5623aa7768f9dcb6b26303d4af7dba375c04f",
      "state": "FAILURE",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 21011,
      "base": "np-oom-scan-daemon-late-exit",
      "head": "dc5418efc2f3257d3b07b01ea6df1aecbbbc2187",
      "state": "FAILURE",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 21012,
      "base": "main",
      "head": "1ee3295630baf2e7c10e17d51978ef7fc02d22bc",
      "state": "FAILURE",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 21014,
      "base": "main",
      "head": "099f3396524554fc6725a7f0b727434dc7369527",
      "state": "FAILURE",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 21018,
      "base": "main",
      "head": "cdbf8609e7bed60f38c0ba68cd678824e5b6ab68",
      "state": "FAILURE",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 21019,
      "base": "np-oom-scan-daemon-late-exit",
      "head": "d60b74976e7b6bd78f8fabf1e1411058ce0ef2e1",
      "state": "FAILURE",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 21020,
      "base": "main",
      "head": "ee8d1c0c4a4fd87e09d24895c0525497006dc5a9",
      "state": "FAILURE",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 21021,
      "base": "main",
      "head": "840f32b645882b70fdecee0a25e4971e70b6f0f5",
      "state": "FAILURE",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 21022,
      "base": "main",
      "head": "97338c35d95151b744cc653f328a1180f17dd182",
      "state": "FAILURE",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 21024,
      "base": "main",
      "head": "ff8411085a4b588ca313672a53957c1d7e9a7aa5",
      "state": "SUCCESS",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 21112,
      "base": "np-oom-scan-terminal-cell-retention",
      "head": "f893dc4a7598e77944b53f644a874d838a080ce6",
      "state": "SUCCESS",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 21113,
      "base": "main",
      "head": "718ead7ea9f6296d69ceb7d1460a3579116fe85f",
      "state": "SUCCESS",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 21128,
      "base": "main",
      "head": "fa06e08229e677e69592e6f68ea4f9e5a96ffc2b",
      "state": "SUCCESS",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 21129,
      "base": "main",
      "head": "1f231d6147852a729fcbe4d2b5ad7262391fee27",
      "state": "SUCCESS",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 21131,
      "base": "main",
      "head": "671bf4c3a0fad1140a6c37c1f026fc96a4b17a1d",
      "state": "SUCCESS",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 21135,
      "base": "main",
      "head": "90162ad9b45d2d52c353ad8788cf9a4b80f13e8b",
      "state": "SUCCESS",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 21136,
      "base": "main",
      "head": "967357866c1ce8c2b805a1675198dc0f722fd04e",
      "state": "SUCCESS",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 21138,
      "base": "main",
      "head": "86bb5899725ccceedac0537e2d68f61d5149bbed",
-      "state": "PENDING",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "state": "SUCCESS",
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 21139,
      "base": "main",
      "head": "66d12af6a54cc928f269dae02c399db7d8431f03",
-      "state": "PENDING",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "state": "SUCCESS",
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    },
    {
      "number": 21140,
      "base": "main",
      "head": "b11197c371f6e0e75d6096004b39a5d18829ee52",
+      "state": "SUCCESS",
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
+    },
+    {
+      "number": 21142,
+      "base": "main",
+      "head": "0c87f12809329eb76f77c9ebaba7fc821c404db7",
+      "state": "SUCCESS",
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
+    },
+    {
+      "number": 21144,
+      "base": "main",
+      "head": "ac2316d6c7ea975a2646c064492c17f98e4307c6",
      "state": "PENDING",
-      "observedAt": "2026-09-17T03:06:47.720115+00:00"
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
+    },
+    {
+      "number": 21150,
+      "base": "main",
+      "head": "5c00d5d2acfce6ddea7f5281d8cd1fcb452eff7a",
+      "state": "PENDING",
+      "observedAt": "2026-09-17T04:13:04.522337+00:00"
    }
  ],
  "correctedPatchFailures": [
@@ -379,6 +400,15 @@
      "prs": [20978, 20992],
      "cause": "Proof scripts loaded locally bundled code with new Function, rejected by standalone React Doctor.",
      "action": "Normal isolated CommonJS module loading with cleanup; proof results/source hashes unchanged; standalone React Doctor passes locally."
+    },
+    {
+      "prs": [21142],
+      "cause": "Durable proof scenario.cjs had an unbraced if; local quality had covered only product files. CI static analysis correctly rejected the artifact.",
+      "action": "Added braces and reran both Node/Electron proof reports plus all five quality configurations over all six publication code files with --no-ignore; all pass.",
+      "failedHead": "9ed7c4f5c880ab64dda8a1a8a04ca8455af42b5d",
+      "correctedHead": "0c87f12809329eb76f77c9ebaba7fc821c404db7",
+      "jobUrl": "https://github.com/stablyai/orca/actions/runs/35178713175/job/105066129816",
+      "productChanged": false
    }
  ],
  "inheritedMainFailure": {
@@ -468,12 +498,12 @@
              },
              {
                "path": "src/main/native-chat/transcript-watch.test.ts",
-                "message": "AssertionError: expected 1 to be +0 // Object.is equality\n\n- Expected\n+ Received\n\n- 0\n+ 1\n\n \u276f src/main/native-chat/transcript-watch.test.ts:724:47\n\n",
+                "message": "AssertionError: expected 1 to be +0 // Object.is equality\n\n- Expected\n+ Received\n\n- 0\n+ 1\n\n ❯ src/main/native-chat/transcript-watch.test.ts:724:47\n\n",
                "annotationLevel": "FAILURE"
              },
              {
                "path": "src/main/native-chat/transcript-watch.test.ts",
-                "message": "Error: timed out waiting for condition\n \u276f waitFor src/main/native-chat/transcript-watch.test.ts:76:13\n \u276f src/main/native-chat/transcript-watch.test.ts:602:5\n\n",
+                "message": "Error: timed out waiting for condition\n ❯ waitFor src/main/native-chat/transcript-watch.test.ts:76:13\n ❯ src/main/native-chat/transcript-watch.test.ts:602:5\n\n",
                "annotationLevel": "FAILURE"
              }
            ]
@@ -3079,7 +3109,7 @@
                {
                  "path": "src/main/native-chat/transcript-watch-liveness.test.ts",
                  "title": "src/main/native-chat/transcript-watch-liveness.test.ts > native chat transcript watcher liveness > replaces a same-size prefix rewrite with an unchanged trailing boundary",
-                  "message": "AssertionError: expected \"vi.fn()\" to be called once, but got 2 times\n \u276f src/main/native-chat/transcript-watch-liveness.test.ts:183:26\n\n",
+                  "message": "AssertionError: expected \"vi.fn()\" to be called once, but got 2 times\n ❯ src/main/native-chat/transcript-watch-liveness.test.ts:183:26\n\n",
                  "annotationLevel": "FAILURE"
                }
              ]
@@ -3100,7 +3130,7 @@
                {
                  "path": "src/renderer/src/lib/browser-history-match.performance.test.ts",
                  "title": "src/renderer/src/lib/browser-history-match.performance.test.ts > browser history match performance budget > prepares a cold corpus within budget",
-                  "message": "AssertionError: expected 2.711498000000006 to be less than 2\n \u276f src/renderer/src/lib/browser-history-match.performance.test.ts:50:35\n\n",
+                  "message": "AssertionError: expected 2.711498000000006 to be less than 2\n ❯ src/renderer/src/lib/browser-history-match.performance.test.ts:50:35\n\n",
                  "annotationLevel": "FAILURE"
                }
              ]
@@ -0,0 +1,74 @@
+# Renderer exit 5 and low sampled heap: #10382
+
+The source explains the telemetry limits and repeated recovery in
+[#10382](https://github.com/stablyai/orca/issues/10382). It does not identify the
+allocation, native failure or application action that caused the eight deaths.
+
+## Reported-version behavior
+
+The reported v1.4.152 tag resolves to source commit
+`ea2d3e05d664ab21ba35b5272004398daf2884cd`. Its annotated tag object is a different
+Git object; the manifest records the source commit explicitly.
+
+- The renderer samples `performance.memory` at startup and every 60 seconds.
+  It does not read heap at the instant main receives process-gone. The latest
+  25 MB sample is neither renderer RSS nor a crash-instant heap measurement.
+- The same legacy API supplies the 3586 MB reported limit. It is not a process
+  footprint ceiling. The comment's quantizer buckets and approximately 20-minute
+  cache duration were not independently reproduced; minute sampling and heap-only
+  scope already prevent ruling out memory pressure from these values.
+- Main calls `getAppMetrics()` after process-gone. The returned surviving main,
+  GPU and utility rows do not reconstruct the dead renderer's memory. A zero
+  renderer count means no returned row, not zero pre-crash footprint.
+- The crash recorder preserves Electron's reason and exit code. Current POSIX
+  decoding displays raw 5 as SIGTRAP; that label does not distinguish a V8 OOM,
+  a native CHECK or another fault. Missing JS error/rejection breadcrumbs cannot
+  exclude native failure. The historical ring holds 30 global entries without
+  renderer-generation identity.
+- Recovery permits three reloads per 60 seconds. Every reported interval is at
+  least 84 seconds, so each previous recovery ages out and all eight are allowed.
+  This explains continued recovery, not the crash trigger or recurrence cadence.
+
+Exact historical anchors: [sampler](https://github.com/stablyai/orca/blob/ea2d3e05d664ab21ba35b5272004398daf2884cd/src/renderer/src/lib/crash-diagnostics.ts#L24),
+[process metrics](https://github.com/stablyai/orca/blob/ea2d3e05d664ab21ba35b5272004398daf2884cd/src/main/crash-reporting/process-gone-diagnostics.ts#L65),
+[classification](https://github.com/stablyai/orca/blob/ea2d3e05d664ab21ba35b5272004398daf2884cd/src/main/crash-reporting/process-gone-classification.ts#L63),
+[recovery caller](https://github.com/stablyai/orca/blob/ea2d3e05d664ab21ba35b5272004398daf2884cd/src/main/window/createMainWindow.ts#L498).
+
+## Later improvements and remaining limits
+
+[#10683](https://github.com/stablyai/orca/pull/10683) adds direct preload V8 heap
+statistics and a `heapSource` tag, with legacy fallback.
+[#16449](https://github.com/stablyai/orca/pull/16449) adds asynchronous renderer
+private-memory sampling. Current sampling publishes the previous completed
+footprint while requesting the next one. Its `outsideHeapMB` is a lagged,
+rounded and clamped residual; it is not an exact simultaneous attribution of
+native allocations. Reset fencing and one in-flight read prevent stale settlement
+from reviving old sampler state. These changes improve measurement; they are
+not established fixes for the reported deaths.
+
+The issue comments' aggregate bundle analysis remains reported evidence. The raw
+dataset was unavailable to this audit. Neither its low-heap cohort nor its
+near-limit cohort establishes a common causal mechanism.
+
+## Verification
+
+The agent passed 89 existing tests covering heap/process readers, diagnostics,
+classification, process metrics, recovery and signal decoding. Five additional
+controls execute six hash-checked v1.4.152 source modules with controlled telemetry
+and time: minute sampling, crashed/5 classification, the eight recovery intervals,
+survivor-only metrics and the global breadcrumb ring. Root independently reran
+all five controls. No historical application binary or Chromium quantizer was run.
+
+`source-hashes.json` records 25 current repository files matching named main
+`291b4ddd6f1c1af480169885e0fda7f9c78ff053`, installed Electron API declarations,
+and ten targeted historical sources. `probe-results.json` records the five
+controls and runner/source-manifest identities. The local runner, exact source
+exports, complete review and test report remain in
+`notes/issue-10382-telemetry/`; they are not bundled into this durable summary.
+
+```sh
+ORCA_BACKGROUND_LAUNCH=1 node notes/issue-10382-telemetry/probe.cjs
+```
+
+No product change, host diagnostic request, application launch or affected-host
+root-cause attribution is made here. The concrete crash cause remains open.
@@ -0,0 +1,127 @@
+{
+  "node": "v26.6.0",
+  "reportedCommit": "ea2d3e05d664ab21ba35b5272004398daf2884cd",
+  "passed": 5,
+  "sourcePaths": [
+    "src/main/crash-reporting/crash-breadcrumb-store.ts",
+    "src/main/crash-reporting/process-gone-classification.ts",
+    "src/main/crash-reporting/process-gone-diagnostics.ts",
+    "src/main/crash-reporting/renderer-recovery-circuit-breaker.ts",
+    "src/renderer/src/lib/crash-diagnostics.ts",
+    "src/shared/crash-reporting.ts"
+  ],
+  "cases": [
+    {
+      "name": "historical sampler reads startup and interval, without exact bridge or crash hook",
+      "samples": [25, 25, 25, 1297],
+      "intervalMs": 60000,
+      "exactReads": 0,
+      "limit": "A controlled performance.memory source; this does not reproduce Blink cache duration or an actual crash.",
+      "passed": true
+    },
+    {
+      "name": "historical crash classification preserves crashed/5 without inferring OOM",
+      "crashed5Recorded": true,
+      "crashed5Recoverable": true,
+      "killed15Recorded": false,
+      "oomRecordedSeparately": true,
+      "passed": true
+    },
+    {
+      "name": "all eight reported recovery intervals pass the historical circuit breaker",
+      "intervalsSeconds": [0, 331, 1293, 115, 211, 116, 164, 84],
+      "decisions": [
+        {
+          "allowed": true,
+          "recentRecoveryCount": 1
+        },
+        {
+          "allowed": true,
+          "recentRecoveryCount": 1
+        },
+        {
+          "allowed": true,
+          "recentRecoveryCount": 1
+        },
+        {
+          "allowed": true,
+          "recentRecoveryCount": 1
+        },
+        {
+          "allowed": true,
+          "recentRecoveryCount": 1
+        },
+        {
+          "allowed": true,
+          "recentRecoveryCount": 1
+        },
+        {
+          "allowed": true,
+          "recentRecoveryCount": 1
+        },
+        {
+          "allowed": true,
+          "recentRecoveryCount": 1
+        }
+      ],
+      "fastFourthAllowed": false,
+      "passed": true
+    },
+    {
+      "name": "historical survivor metrics cannot reconstruct the absent renderer footprint",
+      "metrics": {
+        "processMetricsCount": 3,
+        "processMetricsBrowserCount": 1,
+        "processMetricsBrowserWorkingSetMB": 1200,
+        "processMetricsRendererCount": 0,
+        "processMetricsRendererWorkingSetMB": 0,
+        "processMetricsGpuCount": 1,
+        "processMetricsGpuWorkingSetMB": 154,
+        "processMetricsUtilityCount": 1,
+        "processMetricsUtilityWorkingSetMB": 110,
+        "processMetricsOtherCount": 0,
+        "processMetricsOtherWorkingSetMB": 0,
+        "processMetricsLargestPid": 1,
+        "processMetricsLargestType": "Browser",
+        "processMetricsLargestWorkingSetMB": 1200
+      },
+      "limit": "Supplied survivor inventory; zero absent-renderer bucket means no row, not zero pre-death memory.",
+      "passed": true
+    },
+    {
+      "name": "historical breadcrumb ring has no renderer generation boundary",
+      "beforeEviction": [
+        {
+          "createdAt": "2026-09-17T03:58:20.134Z",
+          "name": "renderer_memory",
+          "data": {
+            "reason": "interval",
+            "usedHeapMB": 1297
+          }
+        },
+        {
+          "createdAt": "2026-09-17T03:58:20.136Z",
+          "name": "renderer_recovery_reload"
+        },
+        {
+          "createdAt": "2026-09-17T03:58:20.136Z",
+          "name": "renderer_memory",
+          "data": {
+            "reason": "startup",
+            "usedHeapMB": 25
+          }
+        }
+      ],
+      "afterEvictionCount": 30,
+      "limit": "Controlled breadcrumb sequence establishes store semantics, not actual attribution of the issue report.",
+      "passed": true
+    }
+  ],
+  "exclusions": [
+    "No UI, native process, affected-host trace replay, heap allocation measurement, or actual Blink quantization run."
+  ],
+  "artifactHashes": {
+    "probe.cjs": "466370e37af0aeba2a53d7c9746e16f1749a58f5106bd5f076577e47a0e81764",
+    "source-hashes.json": "92cf5ff5f8e5f819b24ce0a4e19f0ae03f248670c28ec125a3025b2f9ac65da4"
+  }
+}
@@ -0,0 +1,184 @@
+{
+  "workingHead": "2e83de3154c4ee1bbeea816734b892c34500a5cc",
+  "reportedTag": "v1.4.152",
+  "reportedCommit": "ea2d3e05d664ab21ba35b5272004398daf2884cd",
+  "hashNormalization": "CRLF to LF",
+  "historical": {
+    "src/renderer/src/lib/crash-diagnostics.ts": {
+      "sha256": "184ce457e798820f12b054c24dc4cba60975bd025320e617255b82ffba43c289",
+      "sourceUrl": "https://github.com/stablyai/orca/blob/ea2d3e05d664ab21ba35b5272004398daf2884cd/src/renderer/src/lib/crash-diagnostics.ts"
+    },
+    "src/main/crash-reporting/process-gone-classification.ts": {
+      "sha256": "31dd6f14c829118d9db71e26084a412262d3f5d9a6665c15a245544d9c1a040d",
+      "sourceUrl": "https://github.com/stablyai/orca/blob/ea2d3e05d664ab21ba35b5272004398daf2884cd/src/main/crash-reporting/process-gone-classification.ts"
+    },
+    "src/main/crash-reporting/renderer-recovery-circuit-breaker.ts": {
+      "sha256": "7f13a94bd051bd24554105dd1effc09e12b83d334e1ec44af9266d39f2a5ea7d",
+      "sourceUrl": "https://github.com/stablyai/orca/blob/ea2d3e05d664ab21ba35b5272004398daf2884cd/src/main/crash-reporting/renderer-recovery-circuit-breaker.ts"
+    },
+    "src/main/crash-reporting/process-gone-diagnostics.ts": {
+      "sha256": "989ddf66c854e1e3b3f3bc09c6f154b2d5aca6603ebd72a41b4f391bf13d131e",
+      "sourceUrl": "https://github.com/stablyai/orca/blob/ea2d3e05d664ab21ba35b5272004398daf2884cd/src/main/crash-reporting/process-gone-diagnostics.ts"
+    },
+    "src/main/crash-reporting/crash-breadcrumb-store.ts": {
+      "sha256": "e33e89e1f26c577022cd53426223da2882c8928f39a678e5427a11ab5bc57ee8",
+      "sourceUrl": "https://github.com/stablyai/orca/blob/ea2d3e05d664ab21ba35b5272004398daf2884cd/src/main/crash-reporting/crash-breadcrumb-store.ts"
+    },
+    "src/main/crash-reporting/process-gone-recorder.ts": {
+      "sha256": "563fdf03b107162c6f2042589ebe7557517082662b4084fc33dd4d85fb2f4aee",
+      "sourceUrl": "https://github.com/stablyai/orca/blob/ea2d3e05d664ab21ba35b5272004398daf2884cd/src/main/crash-reporting/process-gone-recorder.ts"
+    },
+    "src/main/window/createMainWindow.ts": {
+      "sha256": "8660c40ced21339395f3b7b73533bc7a2981439a4ca080f407e8c48c008264b4",
+      "sourceUrl": "https://github.com/stablyai/orca/blob/ea2d3e05d664ab21ba35b5272004398daf2884cd/src/main/window/createMainWindow.ts"
+    },
+    "src/main/ipc/crash-reporting.ts": {
+      "sha256": "b61b74c35b7e482eb08a8ee69a150a5a02e754f63d856d0f0b52e59a8faa24e5",
+      "sourceUrl": "https://github.com/stablyai/orca/blob/ea2d3e05d664ab21ba35b5272004398daf2884cd/src/main/ipc/crash-reporting.ts"
+    },
+    "src/main/startup/renderer-heap-headroom.ts": {
+      "sha256": "0cda8b8e052590895aec51db82b040540c368b15818884c3013a013de18df662",
+      "sourceUrl": "https://github.com/stablyai/orca/blob/ea2d3e05d664ab21ba35b5272004398daf2884cd/src/main/startup/renderer-heap-headroom.ts"
+    },
+    "src/shared/crash-reporting.ts": {
+      "sha256": "a924107691fbccd55e084f582e575a08a1718f855361d061308dad3d53b5074e",
+      "sourceUrl": "https://github.com/stablyai/orca/blob/ea2d3e05d664ab21ba35b5272004398daf2884cd/src/shared/crash-reporting.ts"
+    }
+  },
+  "working": {
+    "src/renderer/src/lib/crash-diagnostics.ts": {
+      "sha256": "5666a72a6e60078c1f50ef3c6f253268fdf7c9925c74534525dbb82541003039",
+      "main291bIdentical": true,
+      "sourceUrl": "https://github.com/stablyai/orca/blob/291b4ddd6f1c1af480169885e0fda7f9c78ff053/src/renderer/src/lib/crash-diagnostics.ts"
+    },
+    "src/renderer/src/lib/renderer-memory-sampling.ts": {
+      "sha256": "ce57781a3c0f3c9e0e7e1dd9e3124c8a5da48f9383d47a0123b2e6f074efee0b",
+      "main291bIdentical": true,
+      "sourceUrl": "https://github.com/stablyai/orca/blob/291b4ddd6f1c1af480169885e0fda7f9c78ff053/src/renderer/src/lib/renderer-memory-sampling.ts"
+    },
+    "src/shared/renderer-heap-statistics.ts": {
+      "sha256": "b0aad747c0e34e9ef93df1047078b54c8419bf43dad348d9d0420e36516e80a8",
+      "main291bIdentical": true,
+      "sourceUrl": "https://github.com/stablyai/orca/blob/291b4ddd6f1c1af480169885e0fda7f9c78ff053/src/shared/renderer-heap-statistics.ts"
+    },
+    "src/shared/renderer-process-memory.ts": {
+      "sha256": "3a1e39ed4d6f3e671363cad7ab4028aeb081d3e2d222ab9273481c4aca494ac7",
+      "main291bIdentical": true,
+      "sourceUrl": "https://github.com/stablyai/orca/blob/291b4ddd6f1c1af480169885e0fda7f9c78ff053/src/shared/renderer-process-memory.ts"
+    },
+    "src/preload/renderer-heap-statistics-reader.ts": {
+      "sha256": "3f533f4065b858f20206483af54522c8a1c1aa31c75c8cd3dbfba79e5eae43bd",
+      "main291bIdentical": true,
+      "sourceUrl": "https://github.com/stablyai/orca/blob/291b4ddd6f1c1af480169885e0fda7f9c78ff053/src/preload/renderer-heap-statistics-reader.ts"
+    },
+    "src/preload/renderer-process-memory-reader.ts": {
+      "sha256": "323525e4c476110b2a5d3a416e988c408b93af743874885e45846f10a53f4dad",
+      "main291bIdentical": true,
+      "sourceUrl": "https://github.com/stablyai/orca/blob/291b4ddd6f1c1af480169885e0fda7f9c78ff053/src/preload/renderer-process-memory-reader.ts"
+    },
+    "src/preload/api/crash-reports-bridge.ts": {
+      "sha256": "74c795bfbb4df687a43d6d878fd58d3d408836c866ca0a6c3086ad1654a6dacf",
+      "main291bIdentical": true,
+      "sourceUrl": "https://github.com/stablyai/orca/blob/291b4ddd6f1c1af480169885e0fda7f9c78ff053/src/preload/api/crash-reports-bridge.ts"
+    },
+    "src/main/crash-reporting/process-gone-classification.ts": {
+      "sha256": "a12753cb05a7a10173fc12be828d1d78d9d20c5db185054dbafaf5141b512a98",
+      "main291bIdentical": true,
+      "sourceUrl": "https://github.com/stablyai/orca/blob/291b4ddd6f1c1af480169885e0fda7f9c78ff053/src/main/crash-reporting/process-gone-classification.ts"
+    },
+    "src/main/crash-reporting/process-gone-recorder.ts": {
+      "sha256": "82391c653f0f895278eab085e8d5af8b7d25b1ae95e33120b2b9e44f07a65a5d",
+      "main291bIdentical": true,
+      "sourceUrl": "https://github.com/stablyai/orca/blob/291b4ddd6f1c1af480169885e0fda7f9c78ff053/src/main/crash-reporting/process-gone-recorder.ts"
+    },
+    "src/main/crash-reporting/process-gone-diagnostics.ts": {
+      "sha256": "e1f2e007ccd8c92227dcb1348a6a671876afe919fa1d2aabea598402b472e77d",
+      "main291bIdentical": true,
+      "sourceUrl": "https://github.com/stablyai/orca/blob/291b4ddd6f1c1af480169885e0fda7f9c78ff053/src/main/crash-reporting/process-gone-diagnostics.ts"
+    },
+    "src/main/crash-reporting/crash-breadcrumb-store.ts": {
+      "sha256": "8848be8a897e0d1a214dbbaf87a0377d493ee83358763c0fc286e693889b2cb9",
+      "main291bIdentical": true,
+      "sourceUrl": "https://github.com/stablyai/orca/blob/291b4ddd6f1c1af480169885e0fda7f9c78ff053/src/main/crash-reporting/crash-breadcrumb-store.ts"
+    },
+    "src/main/crash-reporting/renderer-recovery-circuit-breaker.ts": {
+      "sha256": "7f13a94bd051bd24554105dd1effc09e12b83d334e1ec44af9266d39f2a5ea7d",
+      "main291bIdentical": true,
+      "sourceUrl": "https://github.com/stablyai/orca/blob/291b4ddd6f1c1af480169885e0fda7f9c78ff053/src/main/crash-reporting/renderer-recovery-circuit-breaker.ts"
+    },
+    "src/main/window/main-window-focus-lifecycle.ts": {
+      "sha256": "3f8c1d7399dcda6cbf20f908214984654ac50b56aec11136c111b68aa7da7b33",
+      "main291bIdentical": true,
+      "sourceUrl": "https://github.com/stablyai/orca/blob/291b4ddd6f1c1af480169885e0fda7f9c78ff053/src/main/window/main-window-focus-lifecycle.ts"
+    },
+    "src/main/ipc/crash-reporting.ts": {
+      "sha256": "9ac5d8ae121e00285a9afe53dc5df721825d684b919e5337cb36c8608846d79e",
+      "main291bIdentical": true,
+      "sourceUrl": "https://github.com/stablyai/orca/blob/291b4ddd6f1c1af480169885e0fda7f9c78ff053/src/main/ipc/crash-reporting.ts"
+    },
+    "src/shared/crash-breadcrumb-origin.ts": {
+      "sha256": "290e06fc1df006ccdb7ee420d69cea18fac90c1dbe3370aabd2e6540d3aa98a7",
+      "main291bIdentical": true,
+      "sourceUrl": "https://github.com/stablyai/orca/blob/291b4ddd6f1c1af480169885e0fda7f9c78ff053/src/shared/crash-breadcrumb-origin.ts"
+    },
+    "src/shared/posix-wait-status.ts": {
+      "sha256": "1eb72525881baa2815548d31d2b83aaecf88e5dfd0258dbcaa5cda1e8fdcd69f",
+      "main291bIdentical": true,
+      "sourceUrl": "https://github.com/stablyai/orca/blob/291b4ddd6f1c1af480169885e0fda7f9c78ff053/src/shared/posix-wait-status.ts"
+    },
+    "src/main/crash-reporting/minidump-crash-signature.ts": {
+      "sha256": "91a87850fd5b303cc1607825886f8ee43c68b15e5367d19632726fa93aa48c8d",
+      "main291bIdentical": true,
+      "sourceUrl": "https://github.com/stablyai/orca/blob/291b4ddd6f1c1af480169885e0fda7f9c78ff053/src/main/crash-reporting/minidump-crash-signature.ts"
+    },
+    "src/main/startup/renderer-heap-headroom.ts": {
+      "sha256": "0cda8b8e052590895aec51db82b040540c368b15818884c3013a013de18df662",
+      "main291bIdentical": true,
+      "sourceUrl": "https://github.com/stablyai/orca/blob/291b4ddd6f1c1af480169885e0fda7f9c78ff053/src/main/startup/renderer-heap-headroom.ts"
+    },
+    "src/preload/renderer-heap-statistics-reader.test.ts": {
+      "sha256": "61ef775987edd3f0f0aa6e9ce695d89a42dfd23aead29436dd73e80dc3e64e8e",
+      "main291bIdentical": true,
+      "sourceUrl": "https://github.com/stablyai/orca/blob/291b4ddd6f1c1af480169885e0fda7f9c78ff053/src/preload/renderer-heap-statistics-reader.test.ts"
+    },
+    "src/preload/renderer-process-memory-reader.test.ts": {
+      "sha256": "06fde1c28de68ebd8cb11662282c367f286080e4b733fcc70d7e7b95059274d2",
+      "main291bIdentical": true,
+      "sourceUrl": "https://github.com/stablyai/orca/blob/291b4ddd6f1c1af480169885e0fda7f9c78ff053/src/preload/renderer-process-memory-reader.test.ts"
+    },
+    "src/renderer/src/lib/crash-diagnostics.test.ts": {
+      "sha256": "d5f705d890ca708c613c988108c9cdcd6c9ff928bc48d9a63378db8fe9859266",
+      "main291bIdentical": true,
+      "sourceUrl": "https://github.com/stablyai/orca/blob/291b4ddd6f1c1af480169885e0fda7f9c78ff053/src/renderer/src/lib/crash-diagnostics.test.ts"
+    },
+    "src/main/crash-reporting/process-gone-classification.test.ts": {
+      "sha256": "c8e9fcf96743247ee5ca301e9492594ca7ec6dfee14776e7fea86378e711f86e",
+      "main291bIdentical": true,
+      "sourceUrl": "https://github.com/stablyai/orca/blob/291b4ddd6f1c1af480169885e0fda7f9c78ff053/src/main/crash-reporting/process-gone-classification.test.ts"
+    },
+    "src/main/crash-reporting/process-gone-diagnostics.test.ts": {
+      "sha256": "28c09f131cd3194391c4e45293d36006c91ed2b98c7715bd3d73de32d32be00b",
+      "main291bIdentical": true,
+      "sourceUrl": "https://github.com/stablyai/orca/blob/291b4ddd6f1c1af480169885e0fda7f9c78ff053/src/main/crash-reporting/process-gone-diagnostics.test.ts"
+    },
+    "src/main/crash-reporting/renderer-recovery-circuit-breaker.test.ts": {
+      "sha256": "eef1e4f1e5a8f91609cce350c8ef1928422c38627f5a00f411dc1f62e504513a",
+      "main291bIdentical": true,
+      "sourceUrl": "https://github.com/stablyai/orca/blob/291b4ddd6f1c1af480169885e0fda7f9c78ff053/src/main/crash-reporting/renderer-recovery-circuit-breaker.test.ts"
+    },
+    "src/shared/posix-wait-status.test.ts": {
+      "sha256": "39e3de62a520b26befd0f481d0b4d2f5b09925e2d69837c011befafe1e81dc47",
+      "main291bIdentical": true,
+      "sourceUrl": "https://github.com/stablyai/orca/blob/291b4ddd6f1c1af480169885e0fda7f9c78ff053/src/shared/posix-wait-status.test.ts"
+    },
+    "node_modules/electron/electron.d.ts": {
+      "sha256": "aef153c11d8cba6ee95dfe169b59859cde24267e72a56d6de1ca611ef9d89f40"
+    }
+  },
+  "landings": {
+    "c67aadbc1894e1dc58ea53748ff1d1f16705d733": "2026-07-25 fix(crash-reporting): record exact V8 heap sizes, not Blink's quantized ones (#10683)",
+    "91a500712c45c2ecfce4e04bf73c052fcae685df": "2026-08-25 fix(crash-reporting): see the renderer memory the heap counters never report (#16449)"
+  },
+  "reportedTagObject": "47fb5764841444d1f7c7064b735e2fc415125a7b",
+  "mainReference": "291b4ddd6f1c1af480169885e0fda7f9c78ff053"
+}
@@ -0,0 +1,38 @@
+# Ordinary RPC admission under a pending provider
+
+The local socket transport limits input bytes and connections, while the request
+admission layer counts long polls separately. This bounded diagnostic checks
+what those limits mean for ordinary calls whose provider has not settled.
+
+```sh
+ORCA_BACKGROUND_LAUNCH=1 node node_modules/vitest/vitest.mjs run --config docs/audits/rpc-inflight-admission-review/vitest.config.mjs
+```
+
+The fixture invokes actual socket parsing, authentication, request admission,
+dispatcher and `worktree.list` / `terminal.wait` handlers. It uses an inert socket
+and delayed runtime methods. To avoid application initialization, it constructs
+the admission object from its actual prototype with explicitly supplied counters
+and limits, including a 16-call long-poll limit. It does not start a host or use
+an actual filesystem/network stall.
+
+| Observation                                               | Result       |
+| --------------------------------------------------------- | ------------ |
+| Ordinary calls offered through one socket                 | 128          |
+| Ordinary calls started / still pending after socket close | 128 / 128    |
+| Ordinary provider calls after deliberate settlement       | 0            |
+| Abort signals forwarded to ordinary dispatcher calls      | 0            |
+| Long polls offered / admitted / rejected                  | 32 / 16 / 16 |
+| Long polls and active sockets after socket close          | 0 / 0        |
+
+Socket close aborts transport-owned signals. Ordinary requests have already
+passed admission without forwarding that signal to the dispatcher, so they
+finish when the deliberately pending provider finishes. Long polls receive
+their abort signal and free their admission slots. Late replies do not write to
+the closed socket.
+
+This establishes a conditional pending-request capacity gap. It does not prove
+that an ordinary production provider stalls forever, measure retained bytes, or
+attribute an OOM to this route. Adding a universal concurrency limit can reject
+legitimate user operations, so no product policy change is proposed here.
+[Results](./results.json) record the fixture and seven selected source hashes;
+other imported dependencies are the current checkout, not a historical bundle.
@@ -0,0 +1,180 @@
+import { EventEmitter } from 'node:events'
+import { writeFileSync, readFileSync } from 'node:fs'
+import { createHash } from 'node:crypto'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { UnixSocketTransport } from '../../../src/main/runtime/rpc/unix-socket-transport'
+import { RuntimeRpcRequestAdmission } from '../../../src/main/runtime/runtime-rpc/runtime-rpc-request-admission'
+import { RpcDispatcher } from '../../../src/main/runtime/rpc/dispatcher'
+import { WORKTREE_CATALOG_METHODS } from '../../../src/main/runtime/rpc/methods/worktree-catalog-methods'
+import { TERMINAL_LIFECYCLE_METHODS } from '../../../src/main/runtime/rpc/methods/terminal/terminal-lifecycle-methods'
+
+class FakeSocket extends EventEmitter {
+  destroyed = false
+  writable = true
+  writes = []
+  setEncoding() {}
+  setNoDelay() {}
+  setTimeout(_ms, callback) {
+    this.expire = callback
+  }
+  write(value) {
+    this.writes.push(JSON.parse(value))
+    return true
+  }
+  end() {
+    this.destroy()
+  }
+  destroy() {
+    if (!this.destroyed) {
+      this.destroyed = true
+      this.writable = false
+      this.emit('close')
+    }
+    return this
+  }
+}
+
+describe('ordinary RPC admission capacity diagnostic', () => {
+  afterEach(() => vi.restoreAllMocks())
+
+  it('distinguishes ordinary pending calls from admitted long polls and verifies settlement', async () => {
+    expect(process.env.ORCA_BACKGROUND_LAUNCH).toBe('1')
+    const pending = []
+    let live = 0
+    let longPollStarted = 0
+    const runtime = {
+      getRuntimeId: () => 'fixture-runtime',
+      listManagedWorktrees: () => {
+        live += 1
+        return new Promise((resolve) =>
+          pending.push(() => {
+            live -= 1
+            resolve({ worktrees: [], totalCount: 0 })
+          })
+        )
+      },
+      waitForTerminal: (_terminal, { signal }) => {
+        longPollStarted += 1
+        return new Promise((_, reject) =>
+          signal.addEventListener('abort', () => reject(new Error('aborted')), { once: true })
+        )
+      }
+    }
+    const dispatcher = new RpcDispatcher({
+      runtime,
+      methods: [...WORKTREE_CATALOG_METHODS, ...TERMINAL_LIFECYCLE_METHODS]
+    })
+    const dispatch = dispatcher.dispatch.bind(dispatcher)
+    let shortSignals = 0
+    vi.spyOn(dispatcher, 'dispatch').mockImplementation((request, options) => {
+      if (request.method === 'worktree.list' && options.signal !== undefined) {
+        shortSignals += 1
+      }
+      return dispatch(request, options)
+    })
+    // Avoid constructor side effects; all auth, admission, dispatch and method code below is actual source.
+    const admission = Object.create(RuntimeRpcRequestAdmission.prototype)
+    Object.assign(admission, {
+      runtime,
+      dispatcher,
+      authToken: 'fixture-token',
+      activeLongPolls: 0,
+      activeAskLongPolls: 0,
+      activeBrowserHostLongPolls: 0,
+      activeBrowserHostLongPollsByDevice: new Map(),
+      longPollCap: 16,
+      askLongPollCap: 8,
+      browserHostLongPollCap: 8,
+      browserHostLongPollCapPerDevice: 4,
+      specializedLongPollCap: 12
+    })
+    const transport = new UnixSocketTransport({ endpoint: 'inert-fixture', kind: 'named-pipe' })
+    const calls = []
+    const signals = []
+    transport.onMessage((raw, reply, context) => {
+      signals.push(context.signal)
+      calls.push(
+        admission.handleMessage(raw, context).then((response) => reply(JSON.stringify(response)))
+      )
+    })
+    const send = (socket, id, method, params) =>
+      socket.emit('data', `${JSON.stringify({ id, method, params, authToken: 'fixture-token' })}\n`)
+    const socket = new FakeSocket()
+    transport.handleConnection(socket)
+    for (let i = 0; i < 128; i += 1) {
+      send(socket, `ordinary-${i}`, 'worktree.list', {})
+    }
+    await vi.waitFor(() => expect(live).toBe(128))
+    expect(admission.activeLongPolls).toBe(0)
+    expect(shortSignals).toBe(0)
+    expect(socket.writes).toHaveLength(0)
+    socket.destroy()
+    expect(signals.every((signal) => signal.aborted)).toBe(true)
+    expect(live).toBe(128)
+    for (const resolve of pending) {
+      resolve()
+    }
+    await Promise.all(calls)
+    expect(live).toBe(0)
+    expect(socket.writes).toHaveLength(0)
+    expect(transport.activeSockets.size).toBe(0)
+
+    const waits = new FakeSocket()
+    transport.handleConnection(waits)
+    for (let i = 0; i < 32; i += 1) {
+      send(waits, `long-${i}`, 'terminal.wait', { terminal: 'term', for: 'exit' })
+    }
+    await vi.waitFor(() => expect(longPollStarted).toBe(16))
+    expect(admission.activeLongPolls).toBe(16)
+    await vi.waitFor(() => expect(waits.writes).toHaveLength(16))
+    expect(waits.writes.every((frame) => frame.error?.code === 'runtime_busy')).toBe(true)
+    waits.destroy()
+    await Promise.all(calls)
+    expect(admission.activeLongPolls).toBe(0)
+    expect(transport.activeSockets.size).toBe(0)
+
+    const sources = [
+      'src/main/runtime/rpc/unix-socket-transport.ts',
+      'src/main/runtime/runtime-rpc/runtime-rpc-request-admission.ts',
+      'src/main/runtime/runtime-rpc/runtime-rpc-long-poll.ts',
+      'src/main/runtime/rpc/dispatcher.ts',
+      'src/main/runtime/rpc/dispatcher-unary-method-invocation.ts',
+      'src/main/runtime/rpc/methods/worktree-catalog-methods.ts',
+      'src/main/runtime/rpc/methods/terminal/terminal-lifecycle-methods.ts'
+    ]
+    const sha = (bytes) => createHash('sha256').update(bytes).digest('hex')
+    writeFileSync(
+      'docs/audits/rpc-inflight-admission-review/results.json',
+      `${JSON.stringify(
+        {
+          runtime: process.versions.node,
+          sourceHashes: Object.fromEntries(
+            sources.map((source) => [
+              source,
+              sha(readFileSync(source, 'utf8').replaceAll('\r\n', '\n'))
+            ])
+          ),
+          fixtureSha256: sha(readFileSync(import.meta.filename)),
+          observations: {
+            ordinaryCallsOnOneConnection: 128,
+            ordinarySignalsPassed: shortSignals,
+            ordinaryCallsAfterSocketClose: 128,
+            ordinaryCallsAfterProviderSettlement: live,
+            longPollsOffered: 32,
+            longPollsAdmitted: longPollStarted,
+            longPollsRejected: 16,
+            longPollsAfterSocketClose: admission.activeLongPolls
+          },
+          limits: [
+            'Fake socket; no real network, native process, filesystem stall or affected host.',
+            'Actual auth/admission, dispatcher and two production methods; runtime provider operations deliberately deferred.',
+            'Demonstrates conditional pending-request accumulation; does not establish a permanently pending production provider or retained bytes.',
+            'Ordinary operations settle and transport cleanup completes; long polls remain admitted and aborted as designed.'
+          ]
+        },
+        null,
+        2
+      )}\n`
+    )
+  })
+})
@@ -0,0 +1,29 @@
+{
+  "runtime": "26.6.0",
+  "sourceHashes": {
+    "src/main/runtime/rpc/unix-socket-transport.ts": "3052d9ac2777535480e1376ace4960d784fc1a37ce9e1a6cac0c7e1747e88377",
+    "src/main/runtime/runtime-rpc/runtime-rpc-request-admission.ts": "55701c215abd0def001f11d6c32cadadf1928d45ddcb6dd2fb6fc71c4744dc39",
+    "src/main/runtime/runtime-rpc/runtime-rpc-long-poll.ts": "211acfd93a56b3fba1ca211ff7138c78f17d3883e713faba705af45664c6ba6f",
+    "src/main/runtime/rpc/dispatcher.ts": "1753b9ab3244bc6a1441511c16632a341ec5617b2b73308ba0914d02c9f54fc2",
+    "src/main/runtime/rpc/dispatcher-unary-method-invocation.ts": "32f5a00d3ef58b6501851dae935f7e36dec96246e48b94e6a621125b8f638a2c",
+    "src/main/runtime/rpc/methods/worktree-catalog-methods.ts": "0205845ab6e44e2c4e2ff100860a3cc496c7e209de18f43ab6994f96550e6790",
+    "src/main/runtime/rpc/methods/terminal/terminal-lifecycle-methods.ts": "64e90871b23b2dab1c5e3eb58d98e1e128dd372312fb565df828d97e1050f0a3"
+  },
+  "fixtureSha256": "46c417fc4640f545cd640a77bd1404f6de5c57164c1805193e07c0f85b6eb3f8",
+  "observations": {
+    "ordinaryCallsOnOneConnection": 128,
+    "ordinarySignalsPassed": 0,
+    "ordinaryCallsAfterSocketClose": 128,
+    "ordinaryCallsAfterProviderSettlement": 0,
+    "longPollsOffered": 32,
+    "longPollsAdmitted": 16,
+    "longPollsRejected": 16,
+    "longPollsAfterSocketClose": 0
+  },
+  "limits": [
+    "Fake socket; no real network, native process, filesystem stall or affected host.",
+    "Actual auth/admission, dispatcher and two production methods; runtime provider operations deliberately deferred.",
+    "Demonstrates conditional pending-request accumulation; does not establish a permanently pending production provider or retained bytes.",
+    "Ordinary operations settle and transport cleanup completes; long polls remain admitted and aborted as designed."
+  ]
+}
@@ -0,0 +1,5 @@
+import base from '../../../config/vitest.config.ts'
+export default {
+  ...base,
+  test: { ...base.test, include: ['docs/audits/rpc-inflight-admission-review/fixture.test.mjs'] }
+}