[Tom Gamble (gambtho)]

Flow-integration follow-up to merged #18, now targeting main. The flow integration diff is unchanged.

Summary

• Associate scoped document edits with an inspected active flow, pause competing progress, and count editor attempts against the same retained flow budget without refunds.
• After separate whole-proposal human acceptance, require an explicit first-step rerun using accepted bytes and the remaining budget. Document review, action approval and Continue remain fresh, distinct human gates.
• Persist exact resume/rerun continuation intents, park in-flight ordinary output, and preserve stale/generation/owner/native/effect fences through lost replies and restart.
• Include every ordinary and editor attempt plus accepted-edit restart checkpoints in aggregate replay; supported complete histories reconstruct without model or effect dispatch.

Shared recovery from 7a

Reuses #18's exact producer/publication/review recovery and read-back-only abandoned-editor settlement. This change applies those primitives to flow-associated attempts rather than introducing a second settlement path. Abandoned output is never revived; unknown native evidence keeps its fence. Concluded, effect-reserved and unrelated action records are preserved; only the edited flow's affected unexecuted handles are invalidated.

Verification

• Updated from main (d838ef5, merged Propose scoped document edits for human review #18; Go 1.27.3). Main's tree matches the reviewed Propose scoped document edits for human review #18 content already included here; the update records squash ancestry without changing files.

• umask 022; GOWORK=off GOFLAGS=-p=1 make test build passed: 343 Canvas tests plus 2 helper skips, 254 Node tests, 72 Python tests, Go race/vet/build.

• Retained 7a's standalone admission, maintenance-refusal, native-settlement and four document-only Chromium journeys alongside the flow cases. Six actual edit Chromium journeys passed; native scope/stale/Continue/budget/restart/replay passed; prior namespace-isolated lifecycle/CLI qualification is retained. Fresh browser smoke passed.

• go mod verify and GOWORK=off GOFLAGS=-p=1 govulncheck ./... passed; no vulnerabilities found. Configured Go diagnostics: zero. Independent affected review: SHIP.

• Carries Propose scoped document edits for human review #18's cleanup-fence and retained-command review fixes through a merge (no rebase/force push), including the real restart/reopen and no-replay regressions.

• Recovery follow-up: require qualified ordinary-attempt settlement before rerun, persist Resume release before acknowledging completion, and make completed exact commands mutation-free historical readback. All six reported orderings plus eleven native/filesystem boundary tests are committed regressions. No new state framework, persisted fields or public API; test-heavy coverage is deliberate for the requested fault matrix.

Limits

Native Cancel remains unavailable at the pinned Sessions version. Unresolved parked native work or effects can block rerun, later admission or retirement; local revocation is not native settlement. Multiple historical action handles remain conservatively incomplete in aggregate replay rather than silently dropping evidence.

No new agents, MCP, real actions, hosted identity or actual Copilot-app/live-model/Windows qualification. Local role labels are unverified attribution. Suite/Sessions pins and fresh-instance activation semantics are unchanged.

Diff relative to main: +817/-63 product lines, +1,857/-79 tests, +96/-57 docs.

[Copilot]

🟡 Changes recommended

Native-settlement fences and Resume/Rerun recovery defects can permit unsafe progress or leave flows blocked.

5 open issues

• Do not infer Exec dispatch from a non-empty session ID · New
• Require native settlement before rerun generation restart · New
• Validate completed Resume commands before mutable flow checks · New
• Mark Resume pending when restored-state persistence fails · New
• Recognize completed reruns before cancellation checks · New

What changed in this PR

Extends scoped document editing to active flows, building on #18’s recovery mechanisms while keeping acceptance, rerun, and action approval separate.

Changes:

• Associates edits with flows and charges editor attempts against the retained budget.
• Adds explicit Resume/Rerun controls, durable continuation, and output parking.
• Extends replay evidence, regression coverage, and documentation.

File	Description
scripts/​copilot-review.test.cjs	Tests bridge routing for flow-associated edits.
scripts/​copilot-flow-browser.test.cjs	Adds browser Resume/Rerun journeys.
scripts/​copilot-edit-browser.test.cjs	Tests flow binding and exact continuation.
internal/​canvas/​flow_runtime.go	Tracks edit checkpoints and durable pauses.
internal/​canvas/​flow_replay.go	Includes edits in aggregate replay.
internal/​canvas/​flow_recovery.go	Adds edit-aware recovery fences.
internal/​canvas/​edit.go	Associates edits with flows and budgets.
internal/​canvas/​edit_uncommitted_review_test.go	Tests cancellation during uncertain review.
internal/​canvas/​edit_review.go	Implements Resume/Rerun and handle invalidation.
internal/​canvas/​edit_rerun_recovery_test.go	Tests persisted rerun continuation.
internal/​canvas/​edit_replay.go	Validates edit replay evidence.
internal/​canvas/​edit_replay_test.go	Tests complete and corrupted histories.
internal/​canvas/​edit_pause_reopen_test.go	Tests pause preservation across restart.
internal/​canvas/​edit_park_test.go	Tests parking and explicit resumption.
internal/​canvas/​edit_outcome_replay_test.go	Covers rejected and failed edit replay.
internal/​canvas/​edit_maintenance_http_test.go	Tests unreserved maintenance refusal.
internal/​canvas/​edit_invalid_park_test.go	Tests invalid parked-output settlement.
internal/​canvas/​edit_idempotency_test.go	Tests reconciliation after rerun.
internal/​canvas/​edit_http.go	Exposes flow context and continuation routes.
internal/​canvas/​edit_http_test.go	Extends local-only route checks.
internal/​canvas/​edit_flow_refusal_test.go	Tests invalid flow associations.
internal/​canvas/​edit_empty_attempt_test.go	Tests refusal before ordinary admission.
internal/​canvas/​edit_budget_test.go	Tests shared budgets and recovery.
internal/​canvas/​edit_action_boundary_test.go	Tests selective handle invalidation.
internal/​canvas/​edit_abandon_test.go	Tests stale abandonment safety.
internal/​canvas/​canvas.go	Parks ordinary output behind edit fences.
docs/​flow-runtime.md	Documents flow editing and replay boundaries.
docs/​copilot-review.md	Documents panel controls and recovery.
.github/​extensions/​northwind-review/​server.mjs	Forwards new routes and flow context.
.github/​extensions/​northwind-review/​index.html	Adds Resume/Rerun controls and guidance.
.github/​extensions/​northwind-review/​flow.js	Updates cancellation controls and messaging.
.github/​extensions/​northwind-review/​edit.js	Binds requests to inspected flows.
.github/​extensions/​northwind-review/​app.js	Connects selected flows to edit controls.

_{Review effort: Balanced}