feat(s5-5a): drain history before navigation + Vec-drain canonicalization

[send]

S5-5a — drain history before navigation + Vec-drain canonicalization

First slice of the plan-reviewed S5-5 navigation/history enforcement cluster (child of the S5 boa→VM flip umbrella). The cluster plan-memo (docs/plans/2026-07-s5-5-navigation-history-enforcement.md) rides this slice.

What & why

process_pending_actions (threaded content mode + inline app mode) drained navigation before history and early-returned, so a same-turn pushState('/a'); location.href='/b' stranded the /a entry (the drain never reached history). Per WHATWG HTML §7.4.4 (Non-fragment synchronous "navigations"), the pushState URL/history update is synchronous — it ran during the script — so its NavigationController entry must commit before the async pipeline-replacing navigation supersedes.

• Reorder both drains to window-opens → history (FIFO) → navigation (window-opens stay first, the S5-4c invariant).
• Canonicalize the shell history drain to iterate take_pending_history() -> Vec; the boa runtime wrapper adapts Option -> Vec (mirroring take_pending_window_opens), leaving the deletion-bound boa bridge untouched — so the drain site is type-stable across the S5-6 flip (when the VM's Vec-returning drain replaces boa).
• The inline-mode window-open drop moves first, closing a pre-existing leak.

Behavior scope: only the same-turn history+navigation interleaving changes; handle_history_action / handle_navigate bodies are unchanged. No same-document / fragment / popstate / state-threading (those are S5-5b / 5c).

Testing

5 new tests (content_history_drain_tests.rs), pin-verified — reverting to the old (navigation-first) order fails the two order-sensitive tests: pushState-before-nav commit, multi-pushState FIFO (at the handle_history_action seam, since boa's bridge is single-slot; the real 2-element Vec is VM-covered by elidex-js tests_engine_s1c), replaceState+nav ordering, pure-nav / pure-history regression pins. mise run ci green; the /elidex-review 5-agent + code-review pre-push gate returned 0 CRIT / 0 IMP (3 MIN, all comment-accuracy, fixed).

Slot

Closes #11-s5-shell-drain-history-before-navigation. The same-turn traversal+navigation race (a history.back() traversal rebuilds and supersedes a same-turn navigation — "one wins" either way) stays the bounded deferred #11-traversal-navigation-same-turn-race (memo §6-E7 / §8-D5).

🤖 Generated with Claude Code

[send]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2482a31c95

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[send]

Codex R1 dispositions (head 665040f0)

P2 — "Stop replaying old history intents after a traversal" → ✅ Fixed (665040f0). The FIFO history-drain loop (both content/navigation.rs and the inline app/navigation.rs) now breaks once a traversal (back/forward/go) rebuilds the pipeline: handle_history_action returns a rebuilt bool (true only when a traversal actually drove handle_navigate; false for pushState/replaceState and for a no-op out-of-range traversal), and the loop breaks on it — so remaining same-turn intents captured from the now-superseded document are not replayed onto the fresh page. Tests: handle_history_action_reports_rebuild (return contract incl. Go(999) → false) + pushstate_after_rebuilding_back_is_not_replayed (end-to-end break).

P2 — "Preserve navigation URL base at enqueue time" → the VM (the S5-6 flip target) already resolves the navigation URL at enqueue, by construction: native_location_set_href (crates/script/elidex-js/src/vm/host/location.rs:136) runs resolve_url_or_syntax_error against current_url, and set_location stores the resulting absolute URL in NavigationRequest.url. So for the VM the shell's resolve_nav_url(pipeline.url, …) is a base-independent no-op — a same-turn pushState mutating pipeline.url cannot change the already-absolute target; the base is captured at assignment time. The raw-string path this finding describes is boa-only (crates/script/elidex-js-boa/src/globals/location.rs:117 stores the un-resolved href); boa is deletion-bound (D-26 PR7 = this same S5-6 flip), and per the project's boa-light-touch policy boa-only findings are resolved by the flip rather than patched in boa. VM correct now; the boa residual is eliminated at the flip. Not fixing in this PR.

P3 ×5 — "Split the oversized … module" (tests_observer_keepalive.rs, intersection.rs, gc/collect.rs) → not in this PR's diff. git diff --name-only origin/main..HEAD = {crates/shell/elidex-shell/src/{content/navigation.rs, app/navigation.rs, content/mod.rs, content_history_drain_tests.rs}, crates/script/elidex-js-boa/src/runtime/mod.rs, docs/plans/2026-07-s5-5-navigation-history-enforcement.md}. The three flagged files are pre-existing main content (landed via S5-3 #441 / #430 / #440) — this is a stale-base attribution, not a PR #449 change. Their 1000-line split is already tracked as a standalone follow-up task.

Resolving the corresponding threads.

[send]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 665040f0b5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[send]

Codex R2 — all 3 fixed (+ a self-root-check design re-gate applied, since the history-drain-loop was touched across R1+R2; it ratified the loop is converging cleanly and the boa fix is policy-justified, and caught the §-cite below).

P2 — "Preserve the enqueue-time base for relative navigations" → ✅ Fixed. boa's location href/assign/replace now resolve the nav URL at enqueue against bridge.current_url() (globals/location.rs resolve_against_current, mirroring the VM's current_url.join), so NavigationRequest.url is absolute for both engines and the shell's resolve_nav_url is base-independent — a same-turn location.href='next'; pushState(…,'/dir/') no longer resolves next against the pushState-mutated pipeline.url. (Authority is WHATWG HTML §7.2.4 The Location interface — href setter step 2 / assign step 3 / replace step 2, "encoding-parse relative to the entry settings object".) Both engines now store an absolute URL on the success path.

P2 — "Report rebuild only after a successful traversal load" → ✅ Fixed. handle_navigate now returns bool = "did the pipeline get replaced" (Ok → true, Err [pipeline intact] → false); handle_history_action returns it for Back/Forward/Go, so the FIFO drain loop breaks only on a genuine rebuild. A failed-load traversal (network/load error → state.pipeline unchanged, old document still active) no longer breaks the loop and no longer drops a trailing same-turn pushState. Both content + inline drivers. Regression test failed_traversal_load_does_not_drop_trailing_history pins it (rigor-checked: temporarily flipping the Err branch to true fails all 3 R2 tests).

P3 — "Use a real audit date for spec verification" → ✅ Fixed. Normalized the plan-memo's spec-verification timestamps 2026-07-05 → 2026-07-04 (consistent with the commit + the S5-4d-merge reference + the UTC/git frame). Backstop dates unchanged.

Resolving the threads.

[send]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 99e516a3c6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[send]

Codex R3 dispositions — head 541abeb0

Both R3 P2 threads addressed. mise run ci green (12673 tests).

thread content/navigation.rs:435 — restore the history cursor after failed traversals → FIXED.
Real, shell-side. go_back/go_forward/go move the NavigationController index before handle_navigate runs; under the R1/R2 supersede contract a failed-load traversal does not supersede, so the drain continues — but the cursor was left on the unreached target, and a trailing same-turn pushState then committed from the wrong index and truncated the active entry. Fixed with atomic traversal: capture current_index() before the eager move, restore_index() on a failed load (new NavigationController::current_index()/restore_index()), both drivers (app + content) + regression test failed_traversal_load_rolls_back_cursor (verified to fail when the rollback is neutralized).

thread elidex-js-boa/src/globals/location.rs:155 — keep Boa's URL base in sync → REVERTED + DEFERRED (not fixed in 5a).
The R2 enqueue-resolution fix is reverted and the whole boa relative-nav base is deferred to the S5-6 flip (D-26 PR7 boa deletion). Rationale: fully correcting boa needs two boa changes — resolve-at-enqueue and pushState updating current_url — which is an edifice on the deletion-bound engine that this repo's §0 pre-decision (2) (boa = light-touch, touched only to keep CI compiling) + the #396 self-root-check forbid. The VM is correct by construction (it resolves at enqueue and its pushState updates current_url synchronously); the boa-only divergence is deletion-bound, rare, and within the defer envelope, and the flip erases it (no tracking slot). Keeping the R2 partial fix would leave a strangler half-fixed boa, so 5a reverts to the raw-store disposition. Memo §3.2 records the deferral.

Note for the next round: the boa relative-nav base (either enqueue order) is a standing deferral to the flip — please treat a re-raise as already-dispositioned. The 5 file-split findings on tests_observer_keepalive.rs / intersection.rs / gc / collect.rs are out-of-diff (merged-main S5-3 content, not touched by this PR).

[send]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 541abeb0a8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[send]

Codex R4 dispositions — structural (the #396 self-root-check fired)

R4's 3 P2 were all on content/navigation.rs — the 4th consecutive round on the history-drain-then-navigate mechanism, with the findings now in mutual tension (R2 made the break success-only → #259 says a success-break drops trailing FIFO; R3 added restore_index → #448 says it clobbers reentrant state). Rather than patch a 5th clause, this triggered a root-cause re-derivation (+ webref §7.4 verification).

Root cause. A traversal is a queued task in the spec — WHATWG HTML §7.4.3 traverse the history by a delta appends to the traversable's session-history traversal queue, §7.4.6.1 apply the history step runs within it, and §7.4.4 URL and history update steps (pushState/replaceState) run synchronously in the current task. So history.back(); history.pushState() is "pushState commits synchronously this task; back() runs as a later task" — they phase-separate. elidex instead drains all same-turn intents in ONE synchronous pass, treating a traversal as a synchronous pipeline-rebuild mid-FIFO-drain. R1/R2/R3 + #259/#283/#448 + the carved E7 race are 7 clauses approximating that one missing task boundary.

Disposition = minimize 5a + defer the model. The faithful task-queued model is edge-dense (needs its own plan-review), so it does not belong in 5a's narrow base-case; patching the 3 findings on the synchronous-rebuild model would just accrete the edifice. Reachability (code-traced): boa's single-slot history back-channel makes the drain ≤1 action/turn, so only #283 is live-reachable pre-flip.

thread	disposition
#283 navigation.rs:283 (fall-through drains fresh runtime)	FIXED — break → return true on a superseding traversal: it returns immediately and never falls through to take_pending_navigation(), so a successful traversal never drains the freshly-loaded page's queued nav. Preserves E7 "traversal wins"; restores pre-5a symmetry. Both drivers. This is 5a's own regression (the reorder created the fall-through).
#259 navigation.rs:259 (break drops trailing FIFO)	DEFERRED — unreachable pre-flip (boa single-slot ⇒ ≤1 action/turn; [Back, PushState] never occurs). The real fix is the task boundary, not keep/remove-break (removing it just changes the post-flip failure mode). Re-evals at the reframed slot below.
#448 navigation.rs:448 (restore clobbers reentrant)	RETIRED by construction — R3's eager-move + restore_index is replaced by peek-then-commit (peek_back/peek_forward/peek_go + commit_index; the cursor moves iff the load succeeds). No speculative move ⇒ no rollback path to clobber. The reentrancy concern (the dead SW path re-dispatching mid-load) re-lands at the SW-interception wiring (M4-10) via the reframed slot.

Reframed slot #11-traversal-navigation-same-turn-race → #11-session-history-task-queue-model (memo §8-D5): implement the spec's task-queued traversal (apply the history step as a deferred post-drain content-thread task). One slot subsumes #259/#283/#448 + E7; lands in a plan-reviewed 5c/5d. §4.1 amended — the collapse onto the synchronous Vec+index correctly drops the multi-navigable serialization but must KEEP the single-navigable task boundary (its omission was the root).

mise run ci green; /elidex-review 5-axis design re-gate 0 CRIT / 0 IMP (§7.4.3/§7.4.4/§7.4.6.1 cites webref-verified). The boa relative-nav base stays deferred to the S5-6 flip (unchanged).

[send]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1933dedae6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[send]

Codex R5 disposition — head will be the next commit

Real finding, and it was a regression R4's peek-then-commit introduced (thanks — this is exactly the kind of fix-introduced regression the loop is for). In a successful JS traversal, handle_navigate shipped NavigationState (can_go_back/can_go_forward from nav_controller) via notify_navigation before the caller's commit_index moved the cursor → stale chrome state. A fresh nav already push()es inside handle_navigate before notify; the JS-traversal asymmetry (commit deferred to the caller) was the bug.

Fix — commit the cursor INSIDE handle_navigate, before notify (symmetric with the push). New enum HistoryCursorOp { Push, Commit(usize), Keep } replaces is_history_nav: bool; the Ok branch does match cursor_op { Push => push, Commit(i) => commit_index(i), Keep => {} } before notify_navigation. JS traversal → Commit(target) via peek (caller-side commit_index removed); fresh → Push; chrome GoBack/GoForward (already eager-moved) → Keep; Reload → Keep. The app/inline path is left unchanged (verified no bug: it sends no nav_controller-derived NavigationState IPC; the inline chrome reads can_go_back/forward live at egui render time, after the synchronous caller-side commit).

Because R4's fix introduced this, I re-screened the R5 fix with an independent adversarial pass (Step 4.5). It came back clean except for one doc-accuracy MIN: the code's "atomic by construction" claim was overstated — handle_navigate's SW-fetch synchronous message pump could stale the held peek index before commit (the same SW-reentrancy root as #448; unreachable today — the SW controller path is dead — and debug_assert-backstopped). Dispositioned doc-only: scoped the claim to the non-reentrant path and folded the SW-pump held-peek vector and the pre-existing chrome-eager failed-load atomicity gap into the deferred slot #11-session-history-task-queue-model (§8-D5). Both re-land at the SW-interception / async-event-loop wiring (M4-10); the task-queued model unifies all traversal cursor commits at one seam.

mise run ci green. (The success-path assertion — post-commit NavigationState on a successful traversal — is not unit-producible in the disconnected harness, same boundary as #283; the failed-load complement + the enum success-gating are pinned, and the success case is registered as connected/flip integration coverage.)

[send]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Nice work!

Reviewed commit: 8cbc88ad86

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[send]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8cbc88ad86

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[send]

Codex R7 disposition — repeat of the deferred boa relative-nav base (re-examined + confirmed)

This is the boa relative-nav base already surfaced at R2 and deferred at R3 (memo §3.2). Because it re-raised and my own 5a reorder is implicated, I re-examined it rather than reflexively citing the prior defer — and the re-examination confirms the deferral, on a decisive point:

A single base-choice for the same-turn boa navigation cannot serve both orders.

• Order A location.href='next'; pushState('/dir/') — correct is /next (the setter runs before pushState). Current 5a resolves next against the post-drain base /dir/ → /dir/next (the bug you flag).
• Order B pushState('/dir/'); location.href='next' — correct is /dir/next (the setter runs after pushState updated the base). Current 5a resolves against /dir/ → /dir/next ✓ (right).

Any single-base fix — resolving next at enqueue, or snapshotting the pre-drain base — flips the outcome: Order A becomes right, Order B becomes wrong (/next instead of /dir/next). It doesn't fix the divergence, it moves it. Fully correcting boa needs two changes — resolve-at-enqueue (Order A) and pushState synchronously updating current_url (Order B) — which is precisely the edifice on the deletion-bound engine that this repo's §0 pre-decision (2) (boa light-touch) + the #396 self-root-check forbid. The VM is correct by construction (it does both), so the S5-6 flip (D-26 PR7 boa deletion) erases the divergence at the root.

Disposition: DEFERRED to the S5-6 flip (unchanged from R3; memo §3.2). Not fixed on the boa engine in 5a — a one-order fix would regress the other order (and Order B, pushState then relative-nav, is the more natural pattern current behavior already gets right). This is the standing deferral for the boa relative-nav base (both orders); the VM shell path is unaffected.