feat(win32): taskbar jump lists with recent directories and profiles (#126)

[amanthanvi]

Summary Adds a native Windows taskbar jump list. Right-clicking the noctty taskbar button (pinned or running) offers a Recent category of recently used working directories and a Profiles category of the detected shell profiles; clicking an entry launches noctty into that directory or profile. Recents survive restarts. This is roadmap entry C12 and the first half of PRODUCT.md design principle 6 ("compete on every path into a terminal"). Fixes #126 ## Changes - New src/apprt/win32_jump_list.zig: ICustomDestinationList + IObjectCollection / IObjectArray / IShellLinkW / IPropertyStore over hand-written COM vtables, in the same raw style as win32_taskbar_progress.zig. No COM framework was introduced. - Every link carries System.AppUserModel.ID = io.github.amanthanvi.noctty (matching win32_aumid.zig) so the list attaches to the pinned taskbar button, plus PKEY_Title, the current exe as target, and the exe as icon. - Recent: drive-absolute local paths observed from the pwd stream that OSC 7 / OSC 9;9 already feed into surfaces, Unicode case-insensitively deduped via CompareStringOrdinal, newest first, capped at 10, persisted atomically at %LOCALAPPDATA%\noctty\jump-list-recents.json through the existing win32_session_persistence helpers (no new store; that module only gains a pub on its existing bounded reader). - Profiles: the same windows_shell.Profile list the in-app picker uses; links pass --command= / --initial-command= with the profile's argv, so no new CLI flag or config key was added. - Rebuilds run at startup and after real model changes, behind a 500 ms debounce on the existing WM_TIMER path. Profile discovery is deliberately deferred until after the message loop is pumping so a slow wsl.exe enumeration cannot stall startup. - The shell's removed-destination list is honored each cycle; transient COM failures keep the model dirty and retry under a bounded budget, CO_E_NOTINITIALIZED disables rebuilds for the process, and an incomplete removed-list read aborts the transaction rather than publishing an empty list. Every HRESULT failure degrades silently to a debug/warn log. - src/apprt/win32.zig gains only additive hooks: one field, init/deinit, a WM_TIMER branch, and pwd / profile-refresh notifications. - Docs: docs/status.md row, a "Launch topology" section in docs/windows.md (categories, storage path, how to clear), docs/windows-capability-matrix.md row. - A comment marks where named layouts (C17, #133) will add a third category and points at win32_layouts.listNamesAlloc / launchArgvAlloc from #186 so the follow-up consumes that hook instead of enumerating layouts here. No code for it in this PR. ## Validation Run in the team worktree at this commit: - zig fmt --check src → only src/build/uucode_tables.zig, a generated file that is unformatted at baseline on main; every touched file is clean. - zig build -Demit-exe=true → pass. - zig build test -Dtest-filter=jump_list → 41/41 build steps, 76/77 tests passed, 1 skipped (the pre-existing baseline skip). - zig build test -Dtest-filter=session → 41/41 build steps, 108/109 tests passed, 1 skipped. - Rebased onto main @ 5220df4 and squashed to one commit. Re-validated there: zig build -Demit-exe=true pass, zig build test -Dtest-filter=jump_list 77/78 passed, zig build test -Dtest-filter=session 109/110 passed. - The one conflict with #177 was the WM_TIMER → c.WM_TIMER rename. While resolving it I also converted this module's duplicated CoCreateInstance / GetCurrentProcessId / SetTimer / KillTimer externs into const X = sys.X; aliases against src/apprt/win32/sys.zig, so it follows the post-#177 convention and cannot drift. CompareStringOrdinal is not in sys.zig and stays local. - pwsh -NoProfile -File scripts/check-source-format.ps1 → pass. - Full suite zig build test -Demit-test-exe=true on the issues/127-explorer-context-menu tip (which contains both PRs) → 41/41 build steps, 3790/3860 tests passed, 70 skipped, 0 failed. - pwsh -NoProfile -File test/windows/flagship/Test-VerificationContracts.ps1 → Windows x64 baseline checker probes: PASS, flagship verification contracts: PASS (2 scenarios). Unit tests cover recent ordering/dedupe/cap and non-local rejection, JSON round-trip plus corrupt and oversized state, encoded-size limit and tombstone eviction, argument construction and Windows argv boundaries, slot budgeting, the retry cap, and vtable/PROPERTYKEY/PROPVARIANT field offsets. An independent read-only review of this diff found no double-release, use-after-release, leak, ABI mismatch, or CLI-injection path, and confirmed the argument quoting round-trips through a live CommandLineToArgvW probe. Its four material findings (pre-message-loop WSL stall, a dropped rebuild after transient COM failure, an unbounded 2 Hz retry loop, and a writer that could exceed its own reader's size limit) are fixed in the first commit. Greptile then flagged that the deferred startup tick looked for a host through primarySurface(), which is null under initial-window=false. It now reads hosts directly, and host creation re-arms the debounce (scheduleIfStartupPending) so a windowless launch is not stranded without a Profiles category. This PR deliberately does not consume #186's win32_layouts seam or stack on it — named layouts are C17/#133, out of scope here. The comment hook names the exact API so the follow-up plugs in without reimplementing anything. ### Adversarial review dispositions (R-126/127, verdict APPROVE) - LOW, OSC-forged recents — fixed as far as it can be. A program inside a session can emit OSC 7 for any path that passes isRecentLocalPath and seed a Recent entry; that is inherent to the data source and activating an entry only sets a cwd. buildTitleAlloc now strips Unicode bidi/isolate controls (U+061C, U+200E/F, U+202A–E, U+2066–9) so a seeded entry cannot render as a path it does not point at, with a test covering a U+202E spoof, ordinary CJK/emoji, and invalid UTF-8. The provenance caveat is now a module-doc paragraph. - LOW, WM_TIMER swallow — fixed. The debounce is a thread timer (SetTimer(null, ...)), so the swallow now requires @intFromPtr(msg.hwnd) == 0 and cannot eat a window timer whose numeric id collides. (msg.hwnd is non-optional HWND in sys.MSG, hence the @intFromPtr form rather than == null.) - TRIM — taken. The two pure alloc.dupe title wrappers are gone, replaced by the single buildTitleAlloc above; writeWindowsArg is gone and the four call sites use Command.writeDirectArg directly. - INFO, UI-thread fsync — unchanged, documented at persist(). Cross-process recent and profile mutations are serialized under a nonblocking file lock and reconciled by per-key nanosecond event order. ## Residuals / user steps - Not validated on a live desktop. The agent session had no interactive desktop (GetForegroundWindow() == 0, no Shell_TrayWnd), so CommitList was rejected and no screenshots could be produced. Someone should, in a normal interactive session: pin the built noctty.exe, cd around a couple of directories, restart it, right-click the taskbar button, and confirm both categories render and both kinds of entry launch correctly. - The debounced fsync and the COM commit run on the UI thread. This is deliberate — it matches how session state is already written, and moving it to a worker is more machinery than this feature warrants — but pathological storage or antivirus latency would be felt as UI stall. - Concurrent noctty processes serialize jump-list state updates through jump-list-recents.json.lock. Each writer reloads the latest snapshot under the lock and applies only its pending recent/profile events; explicit recent removals are persisted as bounded tombstones so another stale process cannot immediately resurrect them. - A jump list needs an AUMID-matching taskbar button; dev builds without the Start Menu shortcut rely on the explicit process AUMID, which is the same constraint the toast pipeline already has. ## Summary by Sourcery Add native Windows taskbar jump lists for launching noctty into recent working directories or detected shell profiles. New Features: - Add native Windows taskbar jump lists with Recent working directories and Profiles detected from the terminal's shell profiles, launching noctty with the selected destination. Bug Fixes: - Preserve explicit working-directory launches instead of replacing them with restored session state. - Handle jump-list persistence and COM update failures without publishing incomplete or stale destination lists. Enhancements: - Persist recent directories and profile visibility across restarts and concurrent noctty processes with bounded, atomic state management. - Update jump lists from terminal directory and profile activity using debounced refreshes and deferred profile discovery. - Honor Windows taskbar removal actions and protect displayed paths from Unicode bidi spoofing. Documentation: - Document jump-list behavior, persistence, clearing instructions, and Windows capability support. Tests: - Add coverage for recent ordering, deduplication, validation, persistence, argument construction, removal handling, concurrency ordering, slot budgets, retry limits, and Win32 ABI contracts. Chores: - Expose bounded file reading from the existing Windows session persistence module for jump-list state loading. ## Summary by Sourcery Add native Windows taskbar jump lists for launching noctty through recent directories and detected shell profiles. New Features: - Add native Windows taskbar jump lists that launch noctty into recent working directories or detected shell profiles. Bug Fixes: - Preserve explicitly requested startup working directories instead of replacing them with restored session state. - Handle taskbar removal updates, transient COM failures, incomplete destination data, and concurrent persistence without publishing stale or incomplete lists. Enhancements: - Persist bounded recent-directory and profile visibility state across restarts and concurrent processes. - Refresh jump-list contents from shell activity with debounced updates and deferred, bounded profile discovery. - Protect displayed recent paths from Unicode bidirectional spoofing and enforce Windows jump-list slot budgets. Documentation: - Document jump-list categories, persistence and clearing behavior, and Windows capability support. Tests: - Add coverage for recent-directory validation, ordering, deduplication, persistence, argument construction, removal handling, concurrency ordering, retry limits, slot budgets, and Win32 ABI contracts. Chores: - Expose bounded file reading from the existing Windows session persistence module for jump-list state loading. ## Summary by Sourcery Add native Windows taskbar jump lists for launching noctty through recent directories and detected shell profiles. New Features: - Add native Windows taskbar jump lists with Recent working directories and Profiles categories that launch noctty with the selected destination. Bug Fixes: - Preserve explicitly requested working directories instead of replacing them with restored session state. - Handle taskbar removals, transient failures, invalid persisted events, and incomplete destination data without publishing stale or incomplete lists. - Prevent slow WSL profile enumeration from stalling startup. Enhancements: - Persist bounded recent-directory and profile visibility state across restarts and concurrent processes. - Refresh jump lists from shell activity with debounced updates and deferred profile discovery. - Validate and normalize recent paths, protect displayed titles from Unicode bidirectional spoofing, and respect taskbar slot budgets. Documentation: - Document taskbar jump-list categories, persistence and clearing behavior, and Windows capability support. Tests: - Add coverage for recent-directory validation, ordering, deduplication, persistence, argument construction, removal handling, concurrency ordering, retry limits, slot budgets, and Win32 ABI contracts. Chores: - Expose bounded file reading from the existing Windows session persistence module for jump-list state loading. ## Summary by Sourcery Add Windows taskbar jump lists that provide launch paths for recent working directories and detected shell profiles. New Features: - Add native Windows taskbar jump lists with Recent working directories and Profiles categories that launch noctty with the selected destination. Bug Fixes: - Preserve explicitly requested working directories during startup instead of replacing them with restored session state. - Handle taskbar removals, transient failures, invalid persisted state, and incomplete destination data without publishing stale or incomplete lists. - Prevent slow WSL profile enumeration from blocking startup. Enhancements: - Persist bounded recent directories and profile visibility across restarts and concurrent processes with debounced, atomic state updates. - Refresh jump-list contents from shell activity and profile changes while respecting removal actions, slot budgets, and Unicode bidirectional-text safety. Documentation: - Document taskbar jump-list categories, persistence and clearing behavior, and Windows capability support. Tests: - Add coverage for recent-directory validation, ordering, deduplication, persistence, argument construction, removal handling, concurrency ordering, retry limits, slot budgets, and Win32 ABI contracts. Chores: - Expose bounded file reading from the existing Windows session persistence module for jump-list state loading. ## Summary by Sourcery Add Windows taskbar jump lists that provide launch paths for recent working directories and detected shell profiles. New Features: - Add native Windows taskbar jump lists with Recent working directories and Profiles categories that launch noctty with the selected destination. Bug Fixes: - Ensure explicit working-directory launches bypass session restoration and preserve their requested destination. - Handle taskbar removals, transient failures, invalid persisted state, and incomplete destination data without publishing stale or incomplete lists. - Prevent slow WSL profile enumeration from blocking startup. Enhancements: - Persist bounded recent directories and profile visibility across restarts and concurrent processes with debounced, atomic state updates. - Refresh jump-list contents from shell activity and profile changes while respecting removal actions, slot budgets, and Unicode bidirectional-text safety. Documentation: - Document taskbar jump-list categories, persistence and clearing behavior, and Windows capability support. Tests: - Add coverage for recent-directory validation, ordering, deduplication, persistence, argument construction, removal handling, concurrency ordering, retry limits, slot budgets, and Win32 ABI contracts. Chores: - Expose bounded file reading from the existing Windows session persistence module for jump-list state loading. ## Summary by Sourcery Add Windows taskbar jump lists that provide launch paths for recent working directories and detected shell profiles. New Features: - Add native Windows taskbar jump lists with Recent working directories and Profiles categories that launch noctty with the selected destination. Bug Fixes: - Preserve explicitly requested working directories during startup instead of replacing them with restored session state. - Handle taskbar removals, transient failures, invalid persisted state, and incomplete destination data without publishing stale or incomplete lists. - Prevent slow WSL profile enumeration from blocking startup. Enhancements: - Persist bounded recent directories and profile visibility across restarts and concurrent processes with debounced, atomic state updates. - Refresh jump-list contents from shell activity and profile changes while respecting removal actions, slot budgets, and Unicode bidirectional-text safety. Documentation: - Document taskbar jump-list categories, persistence and clearing behavior, and Windows capability support. Tests: - Add coverage for recent-directory validation, ordering, deduplication, persistence, argument construction, removal handling, concurrency ordering, retry limits, slot budgets, and Win32 ABI contracts. Chores: - Expose bounded file reading from the existing Windows session persistence module for jump-list state loading. ## Summary by Sourcery Add Windows taskbar jump lists that provide launch paths for recent working directories and detected shell profiles. New Features: - Add native Windows taskbar jump lists with Recent working directories and Profiles categories that launch noctty with the selected destination. Bug Fixes: - Preserve explicitly requested working directories during startup instead of allowing session restoration to replace them. - Handle taskbar removals, transient failures, invalid persisted state, and incomplete destination data without publishing stale or incomplete lists. - Prevent slow WSL profile enumeration from blocking startup. Enhancements: - Persist bounded recent directories and profile visibility across restarts and concurrent processes with debounced, atomic state updates. - Refresh jump-list contents from shell activity and profile changes while respecting removal actions, slot budgets, and Unicode bidirectional-text safety. Documentation: - Document taskbar jump-list categories, persistence and clearing behavior, and Windows capability support. Tests: - Add coverage for recent-directory validation, ordering, deduplication, persistence, argument construction, removal handling, concurrency ordering, retry limits, slot budgets, and Win32 ABI contracts. Chores: - Expose bounded file reading from the existing Windows session persistence module for jump-list state loading. ## Summary by Sourcery Add Windows taskbar jump lists that provide launch paths for recent working directories and detected shell profiles. New Features: - Add native Windows taskbar jump lists with Recent working directories and Profiles categories that launch noctty with the selected destination. Bug Fixes: - Preserve explicitly requested working directories during startup without disabling subsequent session saves. - Handle taskbar removals, transient failures, invalid persisted state, and incomplete destination data without publishing stale or incomplete lists. - Prevent slow WSL profile enumeration from blocking startup. Enhancements: - Persist bounded recent directories and profile visibility across restarts and concurrent processes with debounced, atomic state updates. - Refresh jump-list contents from shell activity and profile changes while respecting removal actions, slot budgets, and Unicode bidirectional-text safety. Documentation: - Document taskbar jump-list categories, persistence and clearing behavior, and Windows capability support. Tests: - Add coverage for recent-directory validation, ordering, deduplication, persistence, argument construction, removal handling, concurrency ordering, retry limits, slot budgets, and Win32 ABI contracts. Chores: - Expose bounded file reading from the existing Windows session persistence module for jump-list state loading. ## Summary by Sourcery Add Windows taskbar jump lists that provide launch paths for recent working directories and detected shell profiles. New Features: - Add native Windows taskbar jump lists with Recent working directories and Profiles categories that launch noctty with the selected destination. Bug Fixes: - Preserve explicitly requested working directories during startup without allowing session restoration to replace them. - Handle taskbar removals, transient failures, invalid persisted state, and incomplete destination data without publishing stale or incomplete lists. - Prevent WSL profile enumeration failures or slow output from blocking startup and ensure retries remain bounded. Enhancements: - Persist bounded recent directories and profile visibility across restarts and concurrent processes with debounced, atomic state updates. - Refresh jump-list contents from shell activity and profile changes while respecting removal actions, slot budgets, and Unicode bidirectional-text safety. Documentation: - Document taskbar jump-list categories, persistence and clearing behavior, and Windows capability support. Tests: - Add coverage for recent-directory validation, ordering, deduplication, persistence, argument construction, removal handling, concurrency ordering, retry limits, slot budgets, and Win32 ABI contracts. Chores: - Expose bounded file reading from the existing Windows session persistence module for jump-list state loading. ## Summary by Sourcery Add Windows taskbar jump lists that provide reliable launch paths for recent working directories and detected shell profiles. New Features: - Add native Windows taskbar jump-list categories for recently used local working directories and detected shell profiles. - Launch noctty with the selected directory or profile from pinned or running taskbar buttons. Bug Fixes: - Preserve explicitly requested startup working directories without allowing session restoration to replace them. - Handle taskbar removals, invalid or incomplete persisted state, transient COM failures, and slow or failing WSL discovery without publishing stale lists or blocking startup. - Preserve session saving behavior after startup-only restore bypasses. Enhancements: - Persist bounded recent-directory and profile visibility state across restarts and concurrent processes with debounced, atomic updates. - Refresh destinations from shell directory and profile activity while enforcing slot budgets and protecting displayed paths from Unicode bidirectional spoofing. - Bound and safely drain WSL profile enumeration. Documentation: - Document taskbar jump-list categories, persistence and clearing behavior, and Windows capability support. Tests: - Add coverage for recent-directory validation, ordering, deduplication, persistence, argument construction, removal handling, concurrency ordering, retry limits, slot budgets, and Win32 ABI contracts. Chores: - Expose bounded file reading from the existing Windows session persistence module for jump-list state loading. ## Summary by Sourcery Add reliable Windows taskbar jump lists for launching noctty through recent working directories and detected shell profiles. New Features: - Add native Windows taskbar jump-list categories for recently used local working directories and detected shell profiles, with entries that launch noctty into the selected destination. Bug Fixes: - Preserve explicitly requested startup working directories without allowing session restoration to replace them. - Handle taskbar removals, invalid or incomplete persisted state, transient COM failures, and WSL discovery failures without publishing stale lists or blocking startup. - Preserve session saving behavior when startup-only session restoration is bypassed. Enhancements: - Persist bounded recent-directory and profile visibility state across restarts and concurrent processes with debounced, atomic updates. - Refresh jump-list contents from shell activity and profile changes while respecting removal actions, slot budgets, and Unicode bidirectional-text safety. - Bound WSL profile discovery and allow deferred startup discovery to recover after transient failures. Documentation: - Document jump-list categories, persistence and clearing behavior, and Windows capability support. Tests: - Add coverage for recent-directory validation, ordering, deduplication, persistence, argument construction, removal handling, concurrent event ordering, retry limits, slot budgets, profile discovery, and Win32 ABI contracts. Chores: - Expose bounded file reading from the existing Windows session persistence module for jump-list state loading.

Summary by Sourcery

Add reliable Windows taskbar jump lists for launching noctty through recent working directories and detected shell profiles.

New Features:

• Add native Windows taskbar jump-list categories for recently used local working directories and detected shell profiles, with entries that launch noctty into the selected destination.

Bug Fixes:

• Preserve explicitly requested startup working directories without allowing session restoration to replace them.
• Handle taskbar removals, invalid or incomplete persisted state, transient COM failures, and WSL discovery failures without publishing stale lists or blocking startup.
• Preserve session saving behavior when startup-only session restoration is bypassed.

Enhancements:

• Persist bounded recent-directory and profile visibility state across restarts and concurrent processes with debounced, atomic updates.
• Refresh jump-list contents from shell activity and profile changes while respecting removal actions, slot budgets, and Unicode bidirectional-text safety.
• Bound WSL profile discovery and allow deferred startup discovery to recover after transient failures.

Documentation:

• Document taskbar jump-list categories, persistence and clearing behavior, and Windows capability support.

Tests:

• Add coverage for recent-directory validation, ordering, deduplication, persistence, argument construction, removal handling, concurrent event ordering, retry limits, slot budgets, profile discovery, and Win32 ABI contracts.

Chores:

• Expose bounded file reading from the existing Windows session persistence module for jump-list state loading.

## Summary by CodeRabbit ## New Features - Added native Windows taskbar jump lists for quickly launching recent working directories and detected shell profiles. - Jump-list entries are available from pinned or running taskbar buttons and persist across sessions. - Removed destinations are tracked and can be cleared when no longer available. ## Bug Fixes - Improved Windows Subsystem for Linux distribution detection to avoid hangs and handle timeouts safely. - Explicit working-directory launches no longer restore previous sessions unexpectedly. ## Documentation - Documented jump-list availability, behavior, persistence, and clearing instructions.

Final review-cycle validation

• Exact pushed head: 7b152d1deff45cc42f7d0eaaf680796701d5e5b1 on current main base dae792245e77b3aa45e5248a4dba5fd91971b39d.
• zig fmt --check src/apprt/win32.zig src/config/windows_shell.zig and git diff --check pass.
• zig build test -Dtest-filter=WSL, zig build test -Dtest-filter=jump_list, and the full zig build test -Demit-test-exe=true suite pass; emitted access-denied and file-lock traces are expected negative-test diagnostics.
• Final review fixes keep incomplete config-change profile refreshes pending, treat non-successful WSL enumeration exits as incomplete, and propagate transient SSH discovery failures into the existing bounded retry lifecycle.
• The three matching review threads were replied to and resolved; CodeRabbit, Greptile, and Codex were retriggered on this exact head.

[coderabbitai]

Warning

Review limit reached

Next included review available in 29 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: 557cd100-03bf-45a4-a5ac-fbf7cd72afd8

📥 Commits

Reviewing files that changed from the base of the PR and between c7b2b24 and cb1dfc9.

📒 Files selected for processing (6)

• docs/status.md
• docs/windows-capability-matrix.md
• docs/windows.md
• src/apprt/win32.zig
• src/apprt/win32_jump_list.zig
• src/config/windows_shell.zig

📝 Walkthrough

Walkthrough

Adds native Windows taskbar jump lists for recent working directories and detected shell profiles. The implementation persists bounded state, builds shell links, integrates with Win32 startup and profile events, and documents the behavior. It also adds timeout-safe WSL distribution enumeration.

Changes

Windows taskbar jump lists

Layer / File(s)	Summary
Jump-list state and shell-link implementation src/apprt/win32_jump_list.zig, src/apprt/win32_session_persistence.zig	Adds bounded persistence, path and title handling, shell-link construction, COM integration, retry handling, validation, and tests. Exports bounded file reading for shared persistence use.
Win32 runtime integration src/apprt/win32.zig	Initializes and deinitializes the jump list, processes timer-driven profile discovery, records recent directories and profile events, and excludes explicit working-directory launches from session restoration.
Windows capability documentation docs/windows.md, docs/status.md, docs/windows-capability-matrix.md	Documents taskbar jump-list categories, persistence, clearing, and supported Windows behavior.

WSL distribution enumeration

Layer / File(s)	Summary
Timeout-safe WSL enumeration src/config/windows_shell.zig	Drains WSL output concurrently, applies a 1500 ms process timeout, terminates timed-out processes, and propagates wait or read errors.

Estimated code review effort: 5 (Critical) | ~90 minutes

Merge Risk: 🔵 Low · up to c7b2b

This PR adds Windows taskbar launches for recent directories and shell profiles. A profile-discovery failure could leave a small number of process-related handles open, while the accompanying documentation needs minor navigation and metadata updates; the PR remains mergeable with owner awareness of these bounded follow-ups.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The implementation satisfies issue #126 by adding native Windows taskbar jump lists with recent directories, pinned shell profiles, persistence, and the required future named-layout extension point. N…
Out of Scope Changes check	✅ Passed	The changes are within scope for issue #126. The WSL profile-discovery timeout, session-persistence reader visibility, Win32 hooks, tests, and documentation directly support the jump-list feature and …
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Description check	✅ Passed	The description clearly explains the feature, implementation, validation, risks, follow-ups, scope, and review outcomes. It includes the required Summary and Validation content, while Residuals / user…
Title check	✅ Passed	The title clearly and concisely identifies the main change: adding Win32 taskbar jump lists for recent directories and profiles.

Full details: Linked Issues check

Explanation

The implementation satisfies issue #126 by adding native Windows taskbar jump lists with recent directories, pinned shell profiles, persistence, and the required future named-layout extension point. Named layouts remain correctly out of scope.

Full details: Out of Scope Changes check

Explanation

The changes are within scope for issue #126. The WSL profile-discovery timeout, session-persistence reader visibility, Win32 hooks, tests, and documentation directly support the jump-list feature and its startup behavior.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (7 skipped: 7 unsupported.)

Full details: Description check

Explanation

The description clearly explains the feature, implementation, validation, risks, follow-ups, scope, and review outcomes. It includes the required Summary and Validation content, while Residuals / user steps covers the Risks / Follow-ups section. Some stale text says live desktop validation was not completed, but the objectives report that live Windows 11 verification passed.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch issues/126-jump-lists

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sourcery-ai]

Reviewer's Guide

Adds a Windows-native taskbar jump list with persisted recent directories and detected shell profiles, integrating raw COM shell-link construction and removed-destination handling into debounced Win32 lifecycle updates.

Sequence diagram for taskbar jump list updates and launches

sequenceDiagram
    participant App as Win32 App
    participant JumpList
    participant Persistence
    participant Shell as Windows Shell
    participant User
    participant Noctty

    App->>JumpList: startup()
    JumpList->>Persistence: readFileBoundedAlloc()
    JumpList->>JumpList: schedule()
    JumpList->>App: takeStartupProfileDiscovery()
    App->>App: ensureProfiles()
    App->>JumpList: updateProfiles()
    JumpList->>JumpList: schedule()
    App->>JumpList: noteRecent(path)
    JumpList->>JumpList: schedule()
    JumpList->>JumpList: handleTimer(timer_id)
    JumpList->>Shell: BeginList()
    Shell-->>JumpList: removed destinations and slot budget
    JumpList->>Shell: AppendCategory(Recent)
    JumpList->>Shell: AppendCategory(Profiles)
    JumpList->>Shell: CommitList()
    JumpList->>Persistence: writeFileAtomic()
    User->>Shell: Select jump-list entry
    Shell->>Noctty: Launch exe with working-directory or profile arguments

Loading

File-Level Changes

Change	Details	Files
Implement native Windows taskbar jump-list generation through raw COM interfaces.	Create and populate Recent and Profiles categories with shell links targeting the executable. Set AUMID, title, icon, working directory, and launch arguments on each link. Honor Windows removed-destination feedback and safely abort incomplete transactions.	src/apprt/win32_jump_list.zig
Track, persist, and update jump-list model data from application activity.	Capture valid local directories from pwd events with Unicode-insensitive deduplication, newest-first ordering, and a ten-item cap. Persist recents and profile tombstones atomically in the existing Windows session persistence layer. Update profile entries and restore removed profiles when used.	src/apprt/win32_jump_list.zig src/apprt/win32_session_persistence.zig src/apprt/win32.zig
Integrate debounced jump-list rebuilds into the Win32 application lifecycle.	Initialize and tear down jump-list state with the app. Schedule rebuilds and persistence through the existing WM_TIMER message path. Defer profile discovery until the message loop is active and bound transient COM retries, disabling on uninitialized COM.	src/apprt/win32.zig src/apprt/win32_jump_list.zig
Add coverage and documentation for the Windows launch topology.	Test path validation, ordering, persistence, argument quoting, slot budgeting, tombstones, retry limits, and COM ABI layouts. Document categories, persistence location, clearing behavior, and capability status.	src/apprt/win32_jump_list.zig docs/windows.md docs/status.md docs/windows-capability-matrix.md

Assessment against linked issues

Issue	Objective	Addressed	Explanation
#126	Implement native Windows taskbar jump lists using ICustomDestinationList, attached to the application's taskbar identity.	✅
#126	Provide Recent jump-list entries for shell-reported working directories, with deduplication, ordering, persistence, and launching back into the selected directory.	✅
#126	Provide pinned or detected shell profile entries in the jump list that launch the application with the selected profile, while leaving room for later named-layout extensions.	✅

Possibly linked issues

• #C12: Direct implementation of C12: adds native jump lists with persisted recent directories and detected shell profiles.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[greptile-apps]

Greptile Summary

This change adds Windows taskbar Jump Lists with persisted recent directories, profile entries, and deferred profile discovery. The equal-timestamp ordering concern was not retained: focused execution confirmed that equal timestamps intentionally resolve by locked persistence sequence and that behavior is covered by the current test. One issue remains in src/apprt/win32_jump_list.zig: an old Shell removal observed late can be recorded as newer than another process's later directory use, causing the reused directory to disappear from Recent.

Confidence Score: 4/5

A cross-process ordering defect can remove a directory from the Recent Jump List after it was used again.

The reproduced failure occurs when a delayed Shell removal is timestamped at observation time and therefore overrides a later persisted use. amanthanvi stated that the earlier removal-timestamp issue was fixed, but the current code at src/apprt/win32_jump_list.zig:1503-1508 still creates the removal event with eventTimestamp() when rebuildCom observes it.

Files Needing Attention: src/apprt/win32_jump_list.zig

T-Rex Logs

What T-Rex did

• Submitted a proof for a posted P1 finding, including a harness that exercises late-removal ordering and causal-timestamp tests to verify the intended ordering semantics.
• Validated the contract behavior with a before-capture and after-capture run, confirming the candidate comparator’s locked-persistence ordering, and noted that a Zig-based test could not run on this Linux runner because Zig was not found.
• Submitted a second finding-proof for a posted P1 finding.
• Analyzed how eventTimestamp() is invoked during removal observation and how the pending removal and persisted event influence causal ordering, comparing to the prior causal implementation and noting no security impact.

_{Ran code and verified through T-Rex}

Comments Outside Diff (1)

1. General comment

   Delayed Shell removal can erase a later cross-process use

   • Bug
     • VERIFIED. If process A's Shell removal occurs first but A does not rebuild/flush yet, process B can record and persist a later use. When A subsequently observes the old removal in rebuildCom, current code stamps the pending .removed event with the later observation time. On persistence, applyPendingState treats that removal as newer and removes B's valid use, leaving the directory tombstoned.
   • Cause
     • rebuildCom at src/apprt/win32_jump_list.zig:1494-1508 calls eventTimestamp() for an observed removal. applyPendingState at src/apprt/win32_jump_list.zig:1340-1364 resolves conflicts by (changed_ns, order_seq), which correctly prefers that newly stamped removal even though the actual Shell action preceded B's use. The extant test at lines 2127-2157 only covers a removal timestamp intentionally earlier than the persisted use, not the real delayed-observation path.
   • Fix
     • Restore causal ordering for Shell-observed removals: associate the tombstone with the timestamp of the link/event it removes (or otherwise preserve a causal/version token) rather than the time BeginList returns it. Add a regression test that performs A-removal at T1, B-use-and-persist at T2, and A-observe-and-persist at T3, asserting the final event remains B's .used event.

   _{Ran code and verified through T-Rex}

Prompt To Fix All With AI

### Issue 1
src/apprt/win32_jump_list.zig:1503-1508
**Delayed Shell removals override later uses**

A Shell removal is timestamped when `rebuildCom` observes it rather than when the removal occurred. If process A observes an old removal only after process B has persisted a later use of the same directory, this code assigns the removal a newer `changed_ns`; the merge consequently tombstones B's later use. The directory then disappears from Recent despite having been reused after its removal. Preserve the removal's causal event timestamp, or an equivalent ordering token, before merging it.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (16): Last reviewed commit: "win32/jump-list: recover profile discove..." | Re-trigger Greptile}

[greptile-apps]

Headless startup drops profile discovery

When initial-window=false, the startup timer can fire before any primary surface exists. handleTimer stops the one-shot timer, but profile discovery is consumed only inside the primary-surface/host guard, so ensureProfiles() never runs. Creating the first window does not reschedule or consume the pending work, leaving the Profiles jump-list category absent until an unrelated profile UI action loads profiles. Consume pending discovery when the first host is created, or retain bounded retry work until a host is available and rebuild the jump list afterward.

Artifacts

Executable validation source for the headless profile-discovery timer path

• Python validation source reads and asserts the exact production control flow, then executes headless and initial-window state simulations; it provides a repeatable direct check of the affected path.

Initial-window control shows profile discovery publishes Profiles

• Executed control run with `initial-window=true` shows the timer consumes discovery, loads a detected profile, and publishes it to the jump list; the normal window-present condition works.

Headless startup shows timer stops without profile publication

• Executed headless run with `initial-window=false` shows no primary surface, stopped timer, retained pending discovery, no host profiles, no jump-list profile publication, and no creation reschedule; the reported failure is reproduced.

Zig build attempt blocked before Win32 path compilation

• After downloading Zig 0.15.2, the attempted filtered build exited 1 because `fontconfig` is not declared in build.zig.zon; no native Windows executable path could be run.

_{Ran code and verified through T-Rex}

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/apprt/win32.zig
Line: 3010-3016

Comment:
**Headless startup drops profile discovery**

When `initial-window=false`, the startup timer can fire before any primary surface exists. `handleTimer` stops the one-shot timer, but profile discovery is consumed only inside the primary-surface/host guard, so `ensureProfiles()` never runs. Creating the first window does not reschedule or consume the pending work, leaving the Profiles jump-list category absent until an unrelated profile UI action loads profiles. Consume pending discovery when the first host is created, or retain bounded retry work until a host is available and rebuild the jump list afterward.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[amanthanvi]

@coderabbitai review
@codex review

Re-requesting a full pass now that this branch has settled. Context so you can spend your budget where it matters:

What this does: a native Windows taskbar jump list (ICustomDestinationList over hand-written COM vtables, no COM framework) with a Recent category fed from the OSC 7 / OSC 9;9 pwd stream and a Profiles category fed from the existing shell-profile detector. Recents persist to %LOCALAPPDATA%\noctty\jump-list-recents.json.

Already found and settled by a prior adversarial round (please don't re-litigate unless you have new evidence): the argument-injection path was traced end to end — isRecentLocalPath (win32_jump_list.zig) requires a drive-absolute path and rejects " < > | ? *, all bytes < 32, any : past index 1 and invalid UTF-8; the launch string goes through Command.writeDirectArg, which implements the MSVC CRT quoting rules. COM lifetime was audited: every CoCreateInstance result is released, and the BeginList transaction is closed by CommitList/AbortList via the transaction_open flag, with an incomplete removed-list read aborting rather than publishing.

Where I want scrutiny:

1. The removed-destinations contract — recents deleted, profiles tombstoned. Is the tombstone lifecycle correct across a rebuild retry, and can a tombstone ever resurrect or permanently hide a legitimately re-added profile?
2. The persistence path: atomic replace, bounded read (64 KiB) and encode limits, and last-writer-wins across two noctty processes.
3. The hand-rolled vtable/PROPVARIANT layouts and the IUnknown refcount arithmetic on createShellLink (errdefer release, ownership transfer after AddObject AddRefs).

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-01T04:58:36.598304Z	cb1dfc9	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '=== Changed files ==='
git diff --name-status origin/main...HEAD

echo '=== Diff statistics ==='
git diff --stat origin/main...HEAD

echo '=== Jump-list diff ==='
git diff --find-renames --unified=80 origin/main...HEAD -- src/apprt/win32_jump_list.zig

echo '=== Integration and persistence diffs ==='
git diff --find-renames --unified=50 origin/main...HEAD -- \
  src/apprt/win32.zig \
  src/apprt/win32_session_persistence.zig \
  src/apprt/win32/sys.zig

Length of output: 111987

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '=== Target module outline ==='
ast-grep outline src/apprt/win32_jump_list.zig --items all --view expanded

echo '=== Session-persistence outline ==='
ast-grep outline src/apprt/win32_session_persistence.zig --items all --view expanded

echo '=== Windows profile types and key construction ==='
profile_file=$(fd -a '^windows_shell\.zig$' src | head -n 1)
printf '%s\n' "file=$profile_file"
ast-grep outline "$profile_file" --items all --view expanded
rg -n -C 5 '\b(Profile|key|listProfiles|deinitProfiles)\b' "$profile_file"

echo '=== Profile launch and jump-list notification call sites ==='
rg -n -C 8 '\b(noteProfileUsed|createProfileSurface|openSelectedProfile|quickOpenProfileIndex|reloadProfiles|ensureProfiles)\b' src/apprt/win32.zig

echo '=== Atomic persistence helper and its tests ==='
rg -n -C 12 '\b(writeFileAtomic|replaceFileAtomic|readFileBoundedAlloc)\b' src/apprt/win32_session_persistence.zig

Length of output: 35215

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '=== Profile construction ==='
sed -n '420,525p' src/config/windows_shell.zig

echo '=== Jump-list state and rebuild transaction ==='
sed -n '250,455p' src/apprt/win32_jump_list.zig
sed -n '585,830p' src/apprt/win32_jump_list.zig

echo '=== Existing raw COM implementation for declaration comparison ==='
taskbar_file=$(fd -a '^win32_taskbar_progress\.zig$' src | head -n 1)
printf '%s\n' "file=$taskbar_file"
sed -n '1,310p' "$taskbar_file"

echo '=== All direct application profile-surface construction call sites ==='
rg -n -C 6 '\bcreateProfileSurface\s*\(' src/apprt/win32.zig

echo '=== Jump-list tests for tombstones, persistence, COM layout, and retries ==='
rg -n -C 8 'test "jump_list (JSON|removed profile|rebuild retry|raw COM|property keys)' src/apprt/win32_jump_list.zig

Length of output: 38260

---

@amanthanvi I completed the targeted review. I found no actionable issues.

• Removed profiles use stable Profile.key values. A tombstone survives refreshes, retries, and restarts. It prevents automatic resurrection. A successful in-app launch through Host.openSelectedProfile clears the tombstone and schedules a rebuild.
• A profile with the same key stays hidden after temporary discovery loss or a reinstall with the same WSL distribution name. This is the intended removed-destination behavior. The in-app picker provides the explicit restoration path.
• An incomplete removed-destinations read aborts the BeginList transaction. The code preserves only entries that it decoded successfully. It does not publish a replacement based on an incomplete list.
• The state file is bounded to 64 KiB on read and on emitted JSON size. Failed encoding or atomic replacement keeps persist_dirty set. The next model-driven flush can retry.
• writeFileAtomic fsyncs the temporary file before replacement. The process ID plus timestamp temporary name avoids cross-process collisions under the documented last-writer-wins policy.
• The raw COM interface order, PROPERTYKEY, and PROPVARIANT layouts match the reviewed ABI contract and have offset and size tests.
• createShellLink correctly releases its initial IShellLinkW reference on error. IObjectCollection.AddObject retains the successful link. The local reference is then released after category construction.

The reviewed changes are ready from these areas.

_{You are interacting with an AI system.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f654189bbb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[amanthanvi]

Round 1 closed on this PR, plus live-desktop verification is now in.

Bot round summary at f654189bb:

• CodeRabbit: no actionable issues (it independently confirmed the tombstone lifecycle across refreshes/retries/restarts, the abort-on-incomplete-removed-list behaviour, the 64 KiB bounds in both directions, and the createShellLink refcount handoff).
• Codex: one P2 on tombstone-vs-retry ordering — answered on its thread and declined, because staging the removals until commit does not actually close the race it describes and the state is self-healing once a rebuild commits.
• Greptile: the headless startup-discovery finding was real against the commit it read and is already fixed at this head (scheduleIfStartupPending, win32_jump_list.zig:776, called from win32.zig:4567); the concurrent-persistence finding was withdrawn by Greptile after the last-writer-wins rationale was laid out.

No code change was needed in this round, so the head is unchanged at f654189bb and CI is green.

Live verification (performed by the desktop lane, not by me — artifacts under evidence/182/): on a real Windows 11 desktop the taskbar jump list renders both the Recent and Profiles categories, and entries in both launch correctly. That closes the one gap the static reviews could not reach, since the COM path can only be exercised against a live Shell.

[amanthanvi]

@coderabbitai review

@codex review

Final pre-merge review pass. This PR has already been through adversarial review and at least one bot round; findings were triaged as fix / decline-with-evidence / follow-up rather than applied blindly, so some flagged items are deliberate design with reasoning recorded in-thread. Please focus on anything that would be wrong at merge time: stale claims in the description versus the current head, cross-PR interactions, and correctness of security-relevant paths. If you flag something previously declined, please engage with the recorded reasoning rather than restating the original finding.

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '=== PR metadata ==='
gh pr view 182 --repo amanthanvi/noctty --json number,title,state,isDraft,baseRefName,headRefName,headRefOid,mergeStateStatus,url,body,commits

echo '=== Current checkout ==='
git status --short
git rev-parse HEAD
git branch --show-current

echo '=== Changed files against merge base ==='
git diff --name-status origin/main...HEAD
git diff --stat origin/main...HEAD

echo '=== Commit subjects on PR ==='
git log --format='%H %s' origin/main..HEAD

echo '=== Relevant module outlines ==='
ast-grep outline src/apprt/win32_jump_list.zig --items all --view expanded
ast-grep outline src/apprt/win32.zig --items all --view expanded
ast-grep outline src/apprt/win32_session_persistence.zig --items all --view expanded

echo '=== Relevant full diff ==='
git diff --find-renames --unified=60 origin/main...HEAD -- \
  src/apprt/win32_jump_list.zig \
  src/apprt/win32.zig \
  src/apprt/win32_session_persistence.zig \
  src/apprt/win32/sys.zig \
  docs/status.md \
  docs/windows.md \
  docs/windows-capability-matrix.md

echo '=== Current PR comments and reviews ==='
gh pr view 182 --repo amanthanvi/noctty --comments

Length of output: 176352

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '=== Jump-list implementation, remaining sections ==='
sed -n '430,760p' src/apprt/win32_jump_list.zig
sed -n '760,1120p' src/apprt/win32_jump_list.zig
sed -n '1120,1450p' src/apprt/win32_jump_list.zig

echo '=== Profile model and launch contract ==='
sed -n '380,560p' src/config/windows_shell.zig
rg -n -C 8 --glob '*.zig' \
  '(parseCLI|initial-command|working-directory|createProfileSurface\s*\(|noteProfileUsed\s*\()' \
  src

echo '=== Jump-list call sites and timer declarations ==='
rg -n -C 6 --glob '*.zig' \
  '(initializeJumpList|scheduleIfStartupPending|handleTimer|updateProfiles|noteRecent|jump_list|WM_TIMER)' \
  src/apprt/win32.zig src/apprt/win32_jump_list.zig
rg -n -C 4 --glob '*.zig' \
  '(extern.*SetTimer|pub extern.*SetTimer|SetTimer|KillTimer|type MSG|pub const MSG)' \
  src/apprt/win32/sys.zig

echo '=== Persistence helper behavior ==='
sed -n '1,180p' src/apprt/win32_session_persistence.zig

echo '=== Live verification evidence ==='
if [ -d evidence/182 ]; then
  fd -t f . evidence/182 -x sh -c 'echo "--- $1"; file "$1"; sed -n "1,160p" "$1" 2>/dev/null || true' sh {}
else
  echo 'evidence/182 is absent from the current PR checkout'
fi

echo '=== Referenced PR state and current merge bases ==='
for pr in 177 186; do
  echo "--- PR #$pr"
  gh pr view "$pr" --repo amanthanvi/noctty --json number,state,isDraft,headRefName,headRefOid,baseRefName,title,url 2>&1 || true
done

echo '=== Documentation dates and live-validation claims ==='
rg -n -C 3 --glob '*.md' \
  '(Last updated|Last reviewed|Not validated on a live desktop|live.desktop|jump list)' \
  docs README.md 2>/dev/null || true

Length of output: 157206

---

@amanthanvi Final review completed for f654189bbb0fc7236e345f06e0011a0267c3c113.

I found no new actionable code issue.

I rechecked the security-relevant argument path, the thread-timer dispatch guard, the COM transaction cleanup path, persistence bounds, and the #177 and #186 interaction. The current branch includes the #177 timer convention. It has no code dependency on draft PR #186.

One merge-time documentation item remains:

• The PR description still says that live-desktop validation did not occur. The later verification comment says that the Windows 11 desktop lane verified both categories and both launch paths. Update or remove that residual before merge.
• docs/status.md and docs/windows-capability-matrix.md retain 2026-08-12 metadata after adding this feature. Update the dates if those fields represent the review date for the document.

The concurrent-writer behavior remains documented last-writer-wins. I did not restate it as a defect because the recorded rationale explicitly accepts the MRU-state tradeoff.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f654189bbb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[amanthanvi]

@coderabbitai full review
@greptileai review this draft
@codex review

[coderabbitai]

@amanthanvi I will perform a complete review of the current pull request state.

⚠️ Action not completed

Review rate limited.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 59 minutes.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: f654189bbb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[amanthanvi]

Addressed all seven current review threads in c333091. Cross-process persistence now locks, reloads, and applies event deltas; recent removals persist as bounded tombstones; profile-use overrides survive failed COM retries; startup profile discovery remains pending and re-arms after failure; and removed destinations are trusted by the AUMID-scoped BeginList transaction rather than the current executable path. Validation: focused jump_list suite PASS, executable build PASS, emitted full suite PASS, git diff --check PASS.

[amanthanvi]

@coderabbitai review

[amanthanvi]

@greptileai

[amanthanvi]

@codex review

[amanthanvi]

@coderabbitai review

[amanthanvi]

@greptileai

[amanthanvi]

@codex review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: e9ae804f67

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[amanthanvi]

@coderabbitai review

[amanthanvi]

@greptileai

[amanthanvi]

@codex review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 97810a7bf6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[amanthanvi]

@coderabbitai review

[amanthanvi]

@greptileai

[amanthanvi]

@codex review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cb1dfc9c15

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[amanthanvi]

@greptileai review

[amanthanvi]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cb1dfc9c15

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[amanthanvi]

@codex review

[amanthanvi]

@coderabbitai review

[amanthanvi]

@greptileai review

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

⚠️ Action not completed

Pull request is closed.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.