[M4n5ter]

Summary

Repair the failing rust-preview recovery and desktop checks without relaxing replay fences or skipping tests.

• Interrupt and settle the active model attempt before consuming steering. Preserve accepted-prefix proof identity and exactly-once effects; distinguish durable Stop/finish/steering intent from an interrupted attempt's token so empty streams can still use the existing safe retry contract.
• Retract pending interactive messages atomically with Stop. Keep Goal/Schedule work intact, preserve exact historical Run targeting, and do not consume messages submitted after a terminal or repeated Stop.
• Align cold-reopen, tool-catalog and Goal fixtures with current upstream contracts: hydrate referenced results, retain original failed Run identities rather than redispatching, and verify bound GoalStatus results and the New Goal dialog.
• Fix macOS fixture path aliases and offscreen NSH input. AppKit text-input helper windows are established using a plain Input before desktop commands; real window count/identity/visibility checks remain. Suppressed secondary-window autofocus no longer blocks paste into the main editor. Pixel previews use the actual shared tooltip surface color.
• Resolve Clippy findings with explicit local layout tradeoffs rather than blindly boxing large enums. ToolResultReader shares immutable access on its real clone path; no end-to-end performance claim is made.

The durable safe-prefix SQL fence is unchanged. No retry fallback, timeout increase, test deletion, new skip, CI routing change, or public schema migration is introduced.

Verification

Local Apple Silicon macOS; frozen base 5119f9d6c, final repair commit 64cbd1243. Checks use the maintained scripts/ci.mjs entry points. Required local tools included ripgrep, cargo-nextest and cargo-deny; the missing ripgrep dependency was installed rather than bypassing grep-parity tests.

Command	Result
node scripts/ci.mjs check format	Passed
cargo clippy --locked --workspace --all-targets --features maka-cli/desktop-tests -- -D clippy::all	Passed
node scripts/ci.mjs run root	762 passed; 4 existing skips; full archive extraction/replay completed
node scripts/ci.mjs run macos-agent-execution	13 passed; includes crash/reopen, Goal budgets, and both real Host steering regressions
node scripts/ci.mjs run nsh	4589 + 41 Rust tests and 68 JS tests passed; 29 existing Rust skips
node scripts/ci.mjs run macos-surface	13 passed on the final autofocus source, including window isolation and paste
node scripts/ci.mjs run desktop	21 passed on the final commit, including the complete Goal lifecycle; 0 skipped
node scripts/ci.mjs run pixels	2 passed, covering four scale factors; both also passed in final root

Earlier in the same investigation, the maintained tooling, native, macos-host, macos-desktop, macos-nsh, contracts, product, bridge, and native-build suites also exited 0. These were not all repeated after the final localized repairs. The original full run was red; the table above records completed repairs and reruns, not a claim that the first run passed.

Behavior evidence from the final desktop run:

PASS [12.767s] desktop_goal_commands_create_pause_resume_and_finish_without_losing_the_draft
Summary [136.286s] 21 tests run: 21 passed, 0 skipped

The initial desktop Goal timeout did not include a caller backtrace. Both subsequent full desktop executions passed, but that does not independently establish the cause of the original timeout.

Linux/Windows execution and hosted GitHub Actions were not run locally. Remote CI must still validate the PR merge result against the current branch.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Maka investigated failures, authored production/test changes, ran local checks, and performed a bounded independent-session review of the final four repairs. All material commits carry Generated-by: Maka; retain that trailer when squashing. AI review is not independent human approval.

Checklist

• Tests cover the change and fail without it
• Format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No