#617 Port the slash catalog and dispatch through volume files

Slash commands publish ordinary request files for the existing LocalHarness owner. This PR keeps catalog/completion, settings, confirmations, task selection, command outcomes and view state in followed volume files. It retains the earlier owner error mapping, fork permit, selected-model binding, confirmed delete/clear consumption and registered web_search dispatch fixes.

The review fixes now live in Harness APIs. CommandSession::run_local binds the shared run_command_client loop to the native owner. EOF drains submitted effects, explicit quit cancels parked workers, headless dispatch failures propagate, and rendering uses a separately persisted acknowledgement cursor. Task views select bounded recent content through indexed snapshot/follow windows. GraphCoder and its installed qualification scripts are restored to the main revision already merged into this branch; #626 owns consuming these APIs.

• Command inboxes accept command identities and exclude native search request files. Newly submitted task commands encode the originating UI session in their immutable identity, so another terminal cannot claim them or receive their task selection.

• Prompt outcomes preserve admission_operation. render_command_record emits the queued task/admission-operation line consumed by installed clients.

• The authenticated task owner publishes lifecycle and attention files after progress. Attention selection reads that shared followed file; deletion removes the candidate.

• Source rebuilds preserve aliases after both configured user/project/skill imports and mirrored input-file rebuilding, through edits and reopening. A shrinking property uses nonempty roots and edited source bodies. Theme form input resolves against configured themes, including a renamed /palette action.

• Composer fixtures include persisted view_input state and current unknown-command diagnostics.

• Catalog edits surface conflicts. Clear-all enumerates the authenticated owner input directory at one pinned generation, one bounded page per step; it checks the admission kind and clears stock conversations without requiring UI settings or worker status files. Root diagnostics exclude earlier export artifacts. View consumers render followed content and form inputs with parity assertions against tui-parity.md.

• Child and grandchild forks select the parent's active view while holding that parent's production checkout guard. Reopening authenticates the original durable fork even after the parent changes branches. Sparse branch switches select their own mount instead of staging across filesystem boundaries; every mount gets an exclusively created namespace so asynchronous retirement cannot detach a replacement mount. The native regression exercises registered fs/bash tools, both generations of descendants and reopening; the Loom model and its negative control use production cache selection and synchronization.

• Requests, claims and outcomes are indexed by their originating session. Pending snapshots visit that session's bucket plus shared legacy identities; recent results use the bounded result window. The shrinking property charges pending visits before any filtering, covers requests with and without claims, and asserts that a fresh terminal examines exactly three items regardless of unrelated pending and settled history.

• In-place Git actions perform one final native mount advance after publication/reconciliation, under the checkout guard with owner checks before and after the advance. A no-op pre-command recovery acknowledges its preparation without refreshing the mount. Reconciliation reads historical generations only for ordinary checkouts. The counted production regression covers git status and restore on switched and unswitched child mounts and checks restored contents in the next bash call.

Verification

Code head: 2bf0d6dc801d92a9d98d3057f0165ac8de5bafb3.

• Windows, lb.ps1: Harness cargo check --lib --tests with tui,terminal,filesystem-local,native-execution,test-support passed in 22.11 s for the unchanged Windows compilation input. Subsequent fixture edits are in the Unix-only test module. Only Harness is touched; TUI and the command fuzz target retain their prior passing checks.
• bb1, bs.ps1: eight focused mount/checkout/reconciliation cases pass, each under 10 s (slowest 5.229 s). The new counted regression passes in 0.83 s: git status and restore each perform exactly one advance for switched and unswitched child mounts; the following bash reads restored contents. Includes real owner execution, parent reconciliation, expired/interrupted windows, recovered branch selection, acknowledgement property, descendant inheritance/reopening and child isolation.
• Counted baseline: the same regression against reviewed d171fcc6c Git/reconciliation code fails with three advances for switched git status (expected one). Instrumentation charges actual native advance calls.
• Reused unchanged gates recorded on d171fcc6c: 97 client-command tests and 27 command/checkout/query model and invariant cases; slowest model 2.017 s. Production synchronization and negative controls remain instrumented without scheduling caps. Unchanged paging/durability and composer gates retain their prior passing results.
• UTF-8/LF, source-size, formatting, changed-caller and whitespace checks pass. GraphCoder and installed scripts retain no diff against merged main a961f626c.

Live steps

• An additional existing native test, local::tests::reconciliation_interruptions::premature_publication_acknowledgement_is_detected, fails its final SDK-head assertion at reconciliation_interruptions.rs:265. It reproduces with the reviewed d171fcc6c Git/reconciliation implementation (1.89 s) and with this delta (2.30 s); the deliberate corruption is detected, then the additional assertion reads base instead of upstream-broken. No test assertion was changed. Stopped at this failure; the full native interruption sweep was not run. This is separate from the previously passing command models and the eight focused delta regressions.

Parity against tui-parity.md section 1:

Rows	Coverage
Help, theme, model, MCP, feedback	Followed file renderer and TestBackend; configured picker/form input
Reasoning, details, tree, terminal, find, diff, mode, attention	Selected snapshots and follows, visibility assertions, owner-produced attention, actual diff renderer
Stop, shell, resume, quit	Production Harness input/effect loop in TestBackend plus shared production scheduling/control-file models and negative controls
Delete, clear-all, tools, custom commands, completion and palette	Client-command properties, bounded paging, registered-owner/provider assertions, source edit/reopen alias regression

Decisions

• Keep bin/graphcoder/** unchanged from the merged main revision a961f626c. The replacement client in #626 owns terminal input and exit integration; the Harness APIs expose the required behavior and TestBackend tests exercise them.

• Preserve the request body schema and admission identity. The canonical command filename carries its submitting session and operation identity; requests, claims and outcomes share that identity.

• Recompute task status and attention from canonical owner state inside the publication cut; retry CAS conflicts without replaying effects.

• Bound the model scenarios at their atomic publication/subscription cuts. The activity-cursor case explores before, during and after publication without schedule, permutation or preemption caps. Production synchronization and negative controls remain enabled.

• Retain the configured provider, revision and options when the followed model changes. Use the registered web_search executor for search/fetch. Keep the fork's publication fencing and owner checks.

• GitHub reported conflicts after main advanced. Preserve main's StoredFile durability positions and provider I/O outside the index lock; share its replay implementation with bounded paging. Await main's asynchronous token-accounting selection in the existing Harness binding.

• Use the parent's active branch under its existing checkout guard; release each parent guard before descending. Preserve original fork identity on reopening. Mount namespaces are disposable handles; branch and task authority remain in existing durable files.

• Preserve aliases only when the canonical generated command still identifies the same source. Index historical task results by the session encoded in their immutable command identity.

• Clear-all uses retained owner input files as discovery candidates and authenticates each admission, rather than relying on optional UI settings or an asynchronously published status projection. Read pages at one pinned generation so cancellation and concurrent writes cannot move the continuation cut. Staged requests without admissions and non-conversation tool tasks are skipped.

• Exclude diagnostic export artifacts from new exports to prevent recursive embedding; retain ordinary command request/result records.

• Partition the pending index by session at publication time, remove settled request/claim keys from the same bucket atomically, and charge every visited pending key. Keep the shared legacy bucket for pre-session command identities.

• Consolidate native refresh into final publication, including unswitched mounts without reconciliation markers; advance before acknowledging durable reconciliation. Refresh before capture only when recovery actually ran. Failed closing retains its marker while refreshing any conflict projection. Switched commands select the destination mount.

• The counted cases use independent admitted children, switching before committing each baseline, so both mount modes exercise status and restore against their own branch history.