Nine review rounds over the same rule: the composer may only offer what the
flow accepts, and an input it declines to edit must stay askable in the modal.
- The reasoning slider gains an off stop where a model disables by omission
(Claude 4.x), which had no off at all; `reasoningDisplay` gates it on
`canDisable` alone and reads an unset effort as already off there.
- `reasoning_effort` and `user_attachments` are promoted out of Configure
inputs only when the composer actually renders their control — a model that
cannot reason, a workspace with no object storage, or a target whose schema
cannot hold an s3 object all leave the field in the modal.
- Message chips run through `redactSecretArgs`/`redactFileArgs`, so a password
input no longer renders in cleartext under every user message.
- `FlowChat`'s init effect no longer tracks the open conversation: its teardown
is `cleanup()`, which was aborting the first turn of a fresh chat mid-send.
- `JobBackedStore` fetches six at a time instead of one request per row.
- `is_test` is required in the `FlowConversation` schema, matching the Rust
struct, so the deployed page's composer cannot lock on a missing field.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QN7VboDEm9HAB1t4sMxMdE
Guilhem LemouelandClaude Opus 5
f41174e8cc