fix(tui): repair reentrant SDK callbacks and pipeline ownership

[Yeachan-Heo]

Summary

• preserve bounded NotificationServer inbound/reply delivery during synchronous host reentry
• refresh valid live pipeline process-group anchors before failing closed
• keep Bash head/tail stripping enabled and disabled behavior unchanged

Verification

• NotificationServer focused reentrancy: 5/5 passes
• BashTool head/tail stripping: 5/5 passes
• cargo test -p pi-shell shell --lib: 51 passed
• bun --cwd=packages/natives run check:types: passed
• native build: passed

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[Yeachan-Heo]

REQUEST_CHANGES

Reviewed exact head 1df1430 against current origin/dev c1bf3be.

Blocking: this PR targets base 44c30bb and is stale/dirty relative to current origin/dev. Rebase onto c1bf3be before any approval; the current exact head must not merge.

Hostile findings to resolve while rebasing: the new Blocking ThreadsafeFunction calls run from spawn_blocking pumps, while stop_and_wait awaits every pump task. There is no bounded shutdown/error-path test proving that a closed or non-draining JS callback cannot leave stop_and_wait hung indefinitely. Add coverage for TSFN closure, callback-side shutdown/reentrancy, and queued inbound/frame backpressure; the single blocking_recv assertion does not cover those paths. Also retain the pipeline process-group repair tests across PID reuse, missing pid, late spawn, and ambient-group rejection after the rebase.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

[Yeachan-Heo]

Owner evidence update — bounded rebase conflict

Inspected exact PR head 1df143099377ca694d6060f226ba91c2fc33dc62 against current origin/dev 9477947f8b89b74bf3efcc4c1bf7c4591a0558ec.

Scope reconciliation:

• fix(tui): repair reentrant SDK callbacks and pipeline ownership #3665 remains the SDK callback / shell pipeline ownership lane: crates/gjc-sdk/src/server.rs, crates/pi-natives/src/sdk.rs, crates/pi-shell/src/shell.rs, and daemon authority updates.
• fix(tui): stop queuing decorative animation frames #3814 is file-disjoint and remains the external decorative-animation backpressure lane: packages/tui/src/animation-scheduler.ts, its congestion test, and TUI changelog.
• No fix(tui): stop queuing decorative animation frames #3814 changes were copied, modified, or broadened into this lane.

Rebase evidence:

• git rebase origin/dev stopped on the first fix(tui): repair reentrant SDK callbacks and pipeline ownership #3665 commit, 10a7bde1d (fix(sdk): deliver reentrant host callbacks without drops).
• Current dev and the PR both materially rewrite the same callback/admission machinery in crates/gjc-sdk/src/server.rs.
• Git reported two content-conflict regions spanning lines 58–383 and 732–857, including callback frame/backlog state and InboundAdmission / server-state ownership logic. This is not a mechanical formatting or manifest conflict.
• Per the bounded-conflict instruction, I did not choose either side or guess at a synthesis. The rebase was aborted; the worktree is clean and restored to exact PR head 1df143099377ca694d6060f226ba91c2fc33dc62.

No branch push occurred, no tests/checks were represented as post-rebase verification, and no CI run was rerun or cancelled. PR #3665 remains DIRTY pending an explicit resolution of the callback ownership conflict with current dev.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

[Yeachan-Heo]

receipt: gajae-ci/tui-batch-verdict-3665
pr: #3665
head: 1df143099377ca694d6060f226ba91c2fc33dc62
recorded-base: dev (44c30bb332ab33098fa04bdd374e1c48a4e7fc01)
live-dev: 9477947f8b89b74bf3efcc4c1bf7c4591a0558ec
ci: 25 success, 5 skipped, 0 pending, 0 failure (stale exact-head topology)
mergeable: false, mergeable_state: dirty
hostile-verdict: REQUEST_CHANGES (P0=0, P1=2)
reviewed-scope:
  - SDK reply/inbound/frame callback pump ownership
  - Blocking ThreadsafeFunction queue behavior and stop_and_wait ownership
  - Shell process-group anchor refresh and fail-closed ownership
blocking:
  - The PR remains based on 44c30bb3 while live dev is 9477947f. Current dev and the PR materially rewrite the same callback/admission ownership regions in crates/gjc-sdk/src/server.rs; GitHub reports DIRTY and the owner-recorded rebase reached non-mechanical content conflicts. The old exact-head checks do not validate any synthesis with current dev
  - The head replaces async/nonblocking reply, inbound, and frame pumps with spawn_blocking plus Blocking TSFN calls, while stop_and_wait awaits every pump JoinHandle without a timeout or cancellation path for a callback that is closed, reentrant, or not draining. The requested bounded shutdown/reentrancy/backpressure regression coverage is still absent at this unchanged head
pipeline-ownership:
  - The shell change refreshes a group anchor only after rejecting the ambient group and proving the observed PID is running in the reported PGID, then records the fresh incarnation before allowing ownership to continue
  - That lane remains subordinate to the unresolved callback conflict and must retain PID-reuse, missing-PID, late-spawn, ambient-group rejection, and stale-anchor tests through the eventual conflict resolution
feedback:
  - Prior owner REQUEST_CHANGES remains unresolved
  - The only automated comment is a Codex usage-limit notice; there are no review threads or automated code findings
disposition: REQUEST_CHANGES; do not merge this exact head

PR #3665 read-only adversarial exact-head review: REQUEST_CHANGES (P0=0, P1=2). This verdict is confined to callback/pipeline ownership and is independent of #3814. The head is still DIRTY against live dev, and its blocking TSFN pumps remain coupled to unbounded stop_and_wait joins without the previously requested shutdown/reentrancy/backpressure proof. Exact-head CI is green but validates the stale topology, not a current-dev conflict resolution.

—
[repo owner's gaebal-gajae (clawdbot)]