Pup - Puppeteer Bridge

Close issue 41, the isolation hole the nb thread caught that masqueraded as a cross-thread takeover: a verb naming a DEAD sessionId now hard-errors with session_not_found and the live-session list instead of silently falling back to another thread's active window, and per John's ai-thread model the activeSessionId implication is deleted from every session-targeting verb: omitted sessionId resolves to the CALLER THREAD's own window (the shared ai-thread-slug keying pup_open_window uses, or the single window the thread owns by explicit name), with a teaching error when the thread has none or several; the ownership gate also now covers resolved targets, not just explicitly named ones

The PowerShell deletion on ab 2.0.16 native verbs, closing the ab64 commitment: z-order, foreground reads, user-idle, window enumeration by pid and class, hwnd owner validation, parent-pid checks, send-to-back, lower-by-pid, and the taskbar attention clear are all precompiled-Rust ab calls now (roughly 20ms each versus 300ms runtime-compiled PowerShell spawns), the EnumWindows resolver and its temp-file EBUSY class are gone, the zero-caller osMinimizeToBackground and osBackgroundWatchdog are deleted, the synchronous PowerShell runner itself is deleted with zero callers remaining, internal identifiers adCommand and adPayload renamed to abCommand and abPayload, and the user-foreground doctrine got the fix John's question exposed: an ever-user-raised window stays hands-off for as long as it remains OS-foreground with no ten-minute clock, the recency window only applies once the user has left. Five scripts remain by design: the focus-raise dance x3 (works today, wishlisted for a native raise verb), base-icon extraction, and the credential import scan, all async-only

Stop fighting the user for the window: the post-open re-assert timers called the z-bottom primitive with force (needed for Chrome PDF self-activation pops) which also demoted a window the USER had just raised from the taskbar, because the session-flag guards lag the click by seconds. The primitive now checks GetLastInputInfo in the same PowerShell pass: OS-foreground plus user input within 5s means a human raised it, so it returns user-foreground instead of bottoming even under force; a PDF self-pop with idle hands still gets demoted. All re-assert and park callers stop retrying on that signal and mark the session userActive so every later demotion timer skips it for 10 minutes

One visible taskbar mutation per window open instead of three, from John watching the button live: the create-time identity stamp fired before session registration so its result was never recorded and the post-park re-brand recreated the button again with the identical appId (pre-registration stamps are now remembered and adopted at registration so the second stamp truly no-ops), and the favicon overlay no longer races onto the still-Chrome button just to be wiped by the stamp (young windows defer overlay until identity lands, stamp-once then overlay-once, with a 30s grace so an unstampable window is never left bare)

Title mangling fully dead, completing what John asked when the jump-list owner task shipped: the three legacy always-on title-suffix injectors (launch path, adopted-tab retag, post-navigate) predated the titleTag setting and kept appending the ai-thread/profile suffix with their own observers; they now stamp only the invisible window.name carrier and strip legacy tags, installing nothing and observing nothing. Ownership is conveyed solely by the jump-list Owned-by task and the pup_window_info native card

Zero synchronous PowerShell: all 7 remaining execFileSync window-management helpers (idle probe, foreground reads, force-activate, the three backgrounding paths, z-bottom, flash-clear) are now async with every call site awaited, so pup's event loop can never again stall on a powershell spawn and starve ab's health probe (the ab61 reap trigger); the sync runner carries a do-not-add-callers tombstone until ab ships native window verbs and PowerShell is deleted outright

Caption card copy polish: replace em-dashes with middots in the pup_window_info native card per the house style for user-facing copy

Ownership conveyed the way John designed it instead of title mangling: every pup window's jump-list now leads with an 'Owned by: ' task, and clicking it runs the new pup_window_info verb, which paints a native always-on-top click-through caption card just above the taskbar (ab desktop_caption, 12s auto-dismiss) showing the owning thread, container, profile, tabs, window age, last agent action, and any takeover history; the verb also returns the same info as JSON for AI callers and is read-only and never owner-gated

Hotfix for the frozen-window regression John hit within the hour: revert the titleTag default to off (the v2.0.19 flip re-armed the documented title-observer ping-pong that pegs renderers and froze hd-publish-1.0.0), harden the opt-in observer to only ever watch a real title node instead of the whole document subtree on titleless pages, and make takeover:true on one-shot verbs act without stealing ownership so a sanctioned repair reload does not lock the original thread out of its own window

Hard window ownership keyed on caller identity: every window-mutating verb naming an explicit sessionId is refused with session_owned_by_another_thread when that session belongs to a different AI thread (the old gate compared only the optional args.owner field and covered just navigate and close, so undeclared callers could take over other threads' windows, the kicad-vs-nb incident John caught); takeover:true is logged with both thread names and reassigns ownership. Ownership is now user-visible too: the ai-thread title tag defaults on so taskbar hover and Alt-Tab name the owner, and the jump-list header carries the owning thread

Negative-result backoff on window-handle resolution: a shared-profile window that cannot be disambiguated was re-probed with PowerShell EnumWindows passes on every overlay, park, and flash touch, forever; three straight misses now put that session on a 5-minute resolution cooldown (any real handle landing clears it). Ends the hot loop that burned laptop CPU and blocked the event loop so often that ab's 1500ms health marker probe timed out against a live bridge, judged it unhealthy, and reap-looped it, the other half of the 557 flap

EADDRINUSE self-heal for the 557 permanent-outage loop: when a replacement pup spawn finds its port held, it probes the holder's /health and, only if the holder identifies as a sibling pup bridge (by definition an orphan ab lost track of), kills that one pid and retries the bind with a 3-attempt cap; a non-pup holder is never touched and the process exits with a clear log. Turns the reaper-lost-my-pid outage from a manual taskkill into automatic recovery on the next verb

Close out wiki discussion 557 (startup hang after an ab cycle with orphaned Chrome windows): timeout-cap every hangable await in session recovery (CDP version probe 5s, puppeteer.connect 15s, browser.pages 10s, window.name evaluate 3s) so one wedged or orphaned Chrome window costs seconds instead of wedging the whole recovery pass, and sweep the remaining Adom Desktop and AD naming out of user-facing errors, hints, tooltips, dashboard copy, welcome and recorder pages to the canonical ab, Bridge, adom-bridge-cli names, leaving frozen code identifiers untouched

Guidance shim for the browser_* to pup_* clean break: pup re-claims the browser_ prefix and answers every old-verb call with a verb_renamed error naming the exact pup_* replacement (nothing executes, no aliasing), so broken callers self-migrate instead of following the misleading not-installed hint into a reinstall; nbrowser_* unaffected

Overlay/HWND fix: resolve a window's OS handle by its unique (ai-thread: sid) title tag whenever it returns exactly one match, regardless of the titleTag setting. Fixes shared-profile windows (e.g. a 13-tab bridge-pages) that the geometry wiggle left ambiguous, so their taskbar overlay finally paints.

Freeze the jump-list on the first commit to the real category appId (not a beat later), collapsing the settle rebuilds too. Completes option B: one taskbar commit per window, then frozen.

Freeze the jump-list too (option B): once a window's menu is committed to its frozen identity, never rebuild it on later view/active-tab changes. Completes the stamp-once-then-freeze so multi-tab windows produce ZERO taskbar rebuilds after settle.