[AbirAbbas]

The second full pre-release hand test, on dev@b0dfe9702 after #2567, drove the real binary against a real
model in throwaway homes on Linux and macOS. It included the v0.8.2 upgrade, rollbacks and the live tmux suite. This
PR fixes the majors it found. Each fix is its own commit with a test that fails with the fix reverted.

Draft until the hand check of this branch passes. Each finding's exact repro is being redone on a binary built
from this branch.

Majors

• An unsent draft is lost when its chat is reopened from Home after Ctrl+C, and an empty composer could then
  overwrite the saved words. The cold open restored the draft only over a shared handle, which engine conversations
  no longer use. It now restores on every road, and a composer that never loaded the saved draft can't write over
  it. v0.8.2 had the restore half of this too.
• A remote task's spend was billed twice on the worker computer when its conversation arrived there. Paid calls
  now carry a portable identity from the worker through the remote record. Reconstruction never writes a ledger row
  for a call the ledger already holds: one rule, covering Fix what the pre-release hand test of dev found #2567's folded-usage case too.
• The older-turns notice from Fix what the pre-release hand test of dev found #2567 went silent after a chat moved away and back, because take-back and
  materialize rewrote the copy-ready stamp empty. The stamp is now carried forward.
• A late reconciled provider receipt didn't reach Home's card, so Home stayed below /cost by exactly that
  receipt. The reconciliation path now stamps the conversation's spend.
• A landing whose work was kept on a branch didn't name the branch (since Group task and process completions under collapsed work #1893 folded routine endings). It stays
  visible again, and says branch kept · <branch>.

The UsageCallID contract (for the app/v3 re-merge)

session.UsageCallID(line UsageLine) string (in internal/session/usage_identity.go) is the one identity of a paid
call, independent of the computer, folder or parent conversation that later carries it:

• Contract:
  • A transported identity wins: the CallID that a remote record or a cell receipt carries (call_id on the wire
    and in cellstore types).
  • LOCAL ledger rows keep their original schema and store no call_id. Their identity is derived as call: + the
    SHA-256 of [At (UTC RFC3339Nano), Session, Model, Role, Calls, Input, Output, USD]. That's stable because the
    ledger is append-only: a late reconciliation appends its own row and never edits one. Older rows match without
    rewriting.
  • An empty At or Session gives no identity (such a row is never deduped).
• Where it flows:
  • The worker's ledger row carries it.
  • The remote task record (task_remote_money.go) carries CallID beside RemoteEvent, and dedupes on either.
  • The journal's usage entry keeps it.
  • internal/cellindex/usage.go reconstruction skips any call whose identity the ledger already holds, and writes
    the rest once. That includes Fix what the pre-release hand test of dev found #2567's folded-usage case.
• Remote append and reconstruction share one process lock (UsageLedgerLockSuffix).

Any other identity layer (for example app/v3's) should unify on this one rule: one function, the same precedence
(an explicit id first, then the content hash), and the same "no identity means no dedupe" behaviour.

Suite and manual

The tmux suite and the manual follow decisions the product already made: the tab word Memory (#1943), the
first-conversation starter screen (#680), and folded task endings (#1893). The folded receipts are asserted on the
decision receipt and the named row's state.

Minor findings that aren't fixed here are filed in #2575. The tmux word gate's weakness is #2572.

🤖 Generated with Claude Code