Feat: Show the served session title in abctl when harvesting names nothing

[esnible]

What

abctl's TITLE column came only from harvested Claude Code transcripts, so a session with
no transcript tree on the operator's disk rendered blank. #1167 added a server-derived
title to /v1/sessions and nothing read it. Now the display falls back to it.

On the laptop this was found on, every blank harvested entry belonged to an agent that has
no Claude Code transcript tree — but does route through the proxy, so a served title
existed for exactly those rows. The two sources are complementary rather than redundant:
harvesting names what the proxy never saw, the proxy names what the filesystem cannot.

Harvest wins when both exist — a fixed precedence, not a judgement about which string is
better. Neither side is the "stable" one: the harvest is LAST-wins (every tier in
core/observe/claude) and the served title is FIRST-wins, so they disagree about which turn should
name a session rather than one being steadier. The two rankings do not agree on every session, and
an explicit /rename losing to a bare cwd is the clearest case where the loser looks better;
accepted for now pending what operators report, and one line to invert. No provenance indicator —
the cell shows a title, not where it came from.

Scope: abctl, plus two comments in core/session. An earlier revision carried an
unrelated comment fix there and it was dropped. What is in the diff now is not that: review
found SessionSummary.Title's own doc still said "No consumer reads this yet", which this
PR falsifies, so core/session/store.go carries a comment-only change to the field this
feature consumes. No code outside cmd/abctl changes.

The load-bearing part: the fallback is display-only

sessionTitle feeds sessionHasTitle, and through it every harvest-backoff predicate
(untitledSettled, untitledFresh, countUntitled, harvestNamedSomething);
countUntitled in turn feeds both the harvest gate and its scoring. Folding the served
title into sessionTitle would make the row read as named, zero untitledMisses and
stop the re-harvest permanently — settling for whichever title the proxy derived first
and never looking for the harvested one.

So sessionTitle and sessionHasTitle are unchanged, and a new sessionTitleFor applies
the precedence for the cell and the three headers. A server-titled row therefore still
reads as unnamed to the backoff and keeps being re-harvested; that periodic transcript
scan is the intended trade, not a leak.

Two details worth keeping:

• The fallback triggers on titleIsBlank, not == "", so a harvested " " (which paints
  nothing) falls back while a harvested "\t" (which sanitizeLabel turns into a visible
  glyph) does not — overriding a title already on screen would be the worse bug.
• The served string is sanitizeLabel'd like the harvested one. /v1/sessions is
  unauthenticated and the title is folded from caller-supplied event content, so
  sessionTitle's CWE-150 reasoning applies to it at least as much. The producer already
  trims and caps; this does not rely on that — and review caught that the claim was not
  true when first written. See below.

Two things review found that the earlier commits got wrong

The sanitiser was relying on the producer it said it did not. sanitizeLabel replaced
only the BIDI overrides and isolates (U+202A-202E, U+2066-2069). The plain marks
U+200E/200F/061C and the zero-widths U+200B/200C/200D/2060/FEFF went through untouched, so
the only thing keeping a mark out of a cell was core/session's sanitizeTitle —
unexported, in another module, reached over an unauthenticated API. That is precisely the
rune class whose purpose is to make rendered order differ from byte order, and the one this
side must not delegate. It now delegates to pipeline.IsControlRune, the repo's single copy
of the rule, whose own doc records that three byte-identical duplicates once drifted under a
comment asserting they moved together. Both sources are covered: the metadata file on disk is
not a trusted input either.

The cap walked back over every regional indicator. They pair left-to-right into flags, so
in a run only every second one binds — and treating all of them as binders walked to index 0
across the run. Measured: 41 consecutive flags capped to "", and "a"*70 + 10 flags lost 11
runes rather than the "rune or two" the function's own doc promised. Since sessionHasTitle
reads sessionTitle, an emptied title flips a named row to unnamed and restarts the permanent
~3-minute re-harvest — the same failure f5a0a615 fixed for whitespace, reached by a second
route. Binding is position-dependent, not rune-intrinsic, so a per-rune predicate cannot
answer it: riBindsAtCut counts the run that precedes the cut. (The fix as first written
claimed the loop therefore "takes at most one step". It does not — see the next section; the
latest round replaced both the claim and the loop.) The existing cap test had asserted the
walk-to-zero behaviour on a lone RI — one RI after ordinary text starts a flag rather than
completing one, so that cut was already on a boundary and the test encoded the defect.

sanitizeLabel ran twice over the untruncated served string. titleIsBlank(served) built
and discarded a full copy, then the next line sanitised again for the cap — ~3.2MB of transient
allocation per row per rebuild at 200k runes where the documented bound said ~1.6MB. Idempotent
made it harmless, not free. It now sanitises once into a local and blank-checks that through a
new blankSanitized, which is titleIsBlank's trim half split out; two session_metadata.go
call sites were in the same position and now say so. The sanitise-before-trim order that
titleIsBlank documents is preserved rather than dropped, and blankSanitized's doc records why
handing it a raw title reintroduces the hazard that ordering prevents.

The cap could sever a grapheme cluster. The cap mirrored clipTitle's TrimSpace while
dropping its precondition — clipTitle's doc says a plain rune cut is safe for it only
because normalizeTitle stripped every binding character first, and neither string this cap
sees has been through that (core/session's sanitizeTitle deliberately keeps combining
marks "so café survives"). A cut at MaxTitleLen could leave a dangling accent, half a ZWJ
emoji, or one regional indicator of a flag. capTitleRunes now walks back off Mn/Me/Mc, ZWJ
and regional indicators — deliberately not Lm, which Grapheme_Extend excludes and which
holds runes that legitimately start a cluster (U+02BB ʻokina). A fixture built on U+02B0 is
what surfaced that; the fixture was the wrong part, not the code.

Both cap sites are now one helper, which is also where the len([]rune(x)) allocation went:
counting with utf8.RuneCountInString takes the common path from 160 B/op and 232ns to 0 B/op
and 155ns for a 40-rune title, several times per row per 2s tick. The measured counter-trade,
recorded in the comment: counting first walks the string twice, so the over-long path is ~45%
slower (780µs vs 1.13ms at 200k runes). The short path is the one that runs constantly.

Review also found four claims in the code that no test would have caught being falsified —
the Lm exclusion, the sanitise-before-cap ordering, the served-title path through
servedTitle, and the zeroWidthFree/bindsToPrevious divergence. Each now has a gate. Two
assertions were themselves too weak to fail: one header check used the at-most form the same
test argues against five lines earlier, and one blankness check trimmed before comparing, which
is the exact defect titleIsBlank exists to prevent.

untitledSettled and untitledFresh still described the steady state as "every row titled",
costing nothing. sessionHasTitle answers false for served-only rows by design, and on an agent
with no transcript tree the harvest can never succeed — so that state is permanent, not
transient, and the per-row-per-tick allocation is paid for as long as the pane is open (bounded
by the ~3m backoff cap rather than by ever being satisfied). That is the accepted price of not
letting a served title stop the search for the harvested one, and both docs now say so. It is
the same class of stale claim this PR set out to fix.

Four comments were corrected because this PR or the one before it falsified them, including
one of my own overstatements — "capping the input is what makes the render cost flat" claimed
more than the code does. The cap removes the quadratic term; sanitizeLabel's b.Grow(len(s))
and the rune count stay linear in the untruncated input, ~1.6MB transient per row per
rebuild at 200k runes. Linear is the difference between laggy and unusable, but "flat" was
wrong, and the honest bound is what a reader needs in order to decide whether to cap earlier at
the decode instead.

The latest round: three findings, and a rejected fix worth recording

All three were reproduced by probe before anything was changed, and each now has a test that
dies against the mutation that reintroduces it.

The row loop's per-session pairing had no test that could fail. Mutating
m.sessionTitleCell(s.ID, s.Title, titleW) to read m.sessions[0].Title renders s2's row
with s1's title and left the whole suite green — no fixture put two distinct served titles
on screen at once. TestSessionsPane_ServedTitleCellIsPerRow does, and asserts at the cell.
This is deliberately separate from the header's own gate: the header reaches the title by
linear lookup (servedTitle) and the loop by iteration, so a lookup can be wrong about which
id it matched and a loop about which iteration it read. One test cannot fail for both.

The mark arm could still empty a non-blank title — the same failure, third route. The RI
arm was parity-guarded, but bindsToPrevious walked back over every consecutive Mn/Me/Mc.
Probe: "a" + 100×U+0301 → "", which flips sessionHasTitle false for a named session and
restarts the ~3-minute re-harvest.

And the bound the loop documented was false. It claimed "at most one step for marks and
ZWJ, because a mark cannot follow a mark" — a mark certainly can. The walk is now
clusterStart, which stops at the first rune that does not bind to what precedes it, so the
work is proportional to the one cluster straddling the cut rather than to the title (5 marks
and 2000 marks yield the same result). The defect was the false claim and the walk-to-empty it
justified, not any amount of shortening: "a"*60 + 40 marks returns 59 runes both before
and after, and 59 is correct — the cluster's base is at index 59, so it is the only boundary
at or before the cut. An earlier revision of this section cited that as a 21-rune loss, which
was wrong; the next section has the corrected bound.

The rejected fix is the part worth keeping. The first version of this guarded the result:
if the cap emptied a non-blank title, cut bluntly instead. Every display test passed. Then
restoring the old unbounded walk underneath it also passed — the guard rescues the output
of any walk, so broken and fixed became indistinguishable and every mutation test of the walk
was dead. It now decides the blunt cut structurally (clusterStart == 0, i.e. the title
opens with marks or an odd flag half and there is no earlier boundary), which keeps the walk's
correctness observable. A dangling accent renders as one odd glyph; "" restarts the
re-harvest. The comment records why the blanket form was rejected.

One existing test had encoded this defect too. ..._CapOfOnlyCombiningMarksIsEmpty asserted
"" and called it "the honest answer" — while its own doc named the cost, "what
sessionHasTitle already handles". Inverted to ..._CapOfOnlyCombiningMarksKeepsAPrefix, the
same treatment the lone-regional-indicator test got a round earlier.

The round after that: the cap's trim was the third route to the same failure

Five findings, four of them real, and the main one is the same bug this PR has now fixed
three times over — which is the most useful thing in this section.

capTitleRunes trimmed after its cut, and that emptied genuinely-named titles. A title
whose first MaxTitleLen runes are whitespace loses its real text to the CUT and is then
emptied by the TRIM. Reproduced: 40 leading spaces keeps 50 runes, 79 keeps just "m", 80 or
more returns "", for U+0020, U+00A0 and U+3000 alike. sessionHasTitle reads sessionTitle,
so a session the harvest successfully named reads as unnamed and re-harvests ~/.claude
every ~3 minutes for the process lifetime.

The comment above it asserted that trimming "cannot introduce the failure it prevents, because
it only ever removes whitespace". That comment was written as the fix for the whitespace
route, and it was wrong about its own direction: removing whitespace cannot blank a string that
holds text, but the cut had already thrown the text away. The fix is to trim before
measuring — leading whitespace is not part of a name and should never have spent the rune
budget — which dissolves the case rather than guarding against it. clipTitle upstream trims
after its cut safely, for a reason that does not transfer: normalizeTitle has already
collapsed every whitespace run before it sees the string.

The guarding property test could not catch it, and that is the lesson. All six fixtures in
..._CapNeverEmptiesANonBlankTitle were binder-class, so none of them reached the trim at all.
The property was exactly right and the table could not express the defect. It now carries
whitespace shapes in three Unicode classes plus the boundary length — and the standing rule is
a fixture per code path through the function, not a fixture per bug already found in one.

An existing test had encoded the defect, again.
..._HarvestedTitleIsCappedAtLoad asserted wantNamed: false for 80 spaces + "real name",
labelled it "the correctness case", and sat five lines above an assertion whose own message
calls an unnamed verdict the thing that "restarts the ~3-minute re-harvest forever". Inverted,
and a 500-space case added so no off-by-a-few fix passes by accident. That is the third test in
this PR to have pinned a defect while explaining why the defect was bad.

sessionTitleFor decided precedence on the capped title. So every cap-blanking route also
silently inverted the published harvest-wins contract: sessionTitleFor(85×" " + "real", "served-name") returned "served-name", showing the proxy's name to an operator told by
CLAUDE.md, cmd/abctl/README.md and core/session/store.go that they are looking at the
harvest. Worse than the blank cell it replaced — a wrong name gets acted on. It now asks about
the raw harvested title, so a display bound cannot reach into a precedence decision.

That one is not a mutation gate and its test says so. Reverting the guard leaves the suite
green, necessarily: a search over this file's degenerate shapes — marks, ZWJ, BOM, word joiner,
NBSP, ideographic space, lone regional indicators, Thai vowel signs, five lengths around the
cap, with and without a real suffix — found zero inputs that sanitise non-blank and cap to
blank. With no observable difference there is nothing to gate, so the test pins the outcome and
the doc carries the argument, rather than implying a guarantee it cannot make.

clusterStart panicked on cut == len(r). clusterStart([]rune("abc"), 3) → index out of range [3] with length 3, safe in production only because capTitleRunes' early return
guarantees a longer slice — a coupling two functions apart that no comment stated and no test
pinned, while bindsToPrevious' doc invites other callers in this package. A cut past the last
rune orphans nothing, so it returns cut. A cut above len(r) still panics deliberately:
clamping it would invent an answer for a question the caller got wrong.

The fifth finding did not reproduce, and the instrumentation is why. It reported
clusterStart's walk as unbounded — "5 marks → 6 runes back; 20 → 21; 40 → 41" — contradicting
its own doc. Counting iterations directly:

shape	r[80]	start	steps
"a"*75 + 5 marks + tail	t	80	1
"a"*40 + 40 marks + tail	t	80	1
"a"*1 + 79 marks + tail	t	80	1
"a" + 100 marks + "z"*200	mark	0	80
"a" + 2000 marks + "z"*200	mark	0	80

The reported curve measures clusterStart at a fixed cut against a mark run anchored before
it; inside capTitleRunes the cut is always MaxTitleLen, so growing the run moves the base
later and the walk gets shorter. What the finding did surface is a genuine doc inaccuracy in
the other direction: "bounded by one cluster" is true but is not "one step", because a
degenerate cluster can be as long as the cut. The bound is min(cluster, cut) — 80 steps for
100 marks, still 80 for 2000, which is the property that matters. Corrected in three places,
and ..._CapWalkIsBoundedByOneCluster now asserts the degenerate case through clusterStart
directly, since capTitleRunes' blunt-cut fallback returns the same answer either way and hid
it.

Five mutants, four dying (the fifth is the precedence guard above, reported as surviving rather
than dressed up): trim restored to after-the-cut (4 test functions), TrimSpace narrowed to
TrimLeft(s, " ") (2), the end-of-slice guard removed (panics), and clusterStart's early
return broken (4).

Docs

The README stated the old behavior in the two places a reader looks first — the Sessions
pane column list and the --skip-claude-metadata section — and both now describe what
fills the column and which source wins. CLAUDE.md's /v1/sessions row is updated the
same way.

One transient shape, documented rather than changed

A session that arrives on the event stream before a list refresh gets a stub
SessionSummary with a zero Title, so its row shows no served title for up to two
seconds. It is the one display path where an empty served string does not mean "the proxy
derived none", and it self-corrects on the next poll. Noted in sessionTitleFor's doc.

Cached-only rows are the other empty-by-construction case: they exist because the server
stopped listing the session, so there is no summary to carry a title.

Tests

Twenty-seven new test functions against the base ref (82 vs 55), and the one that matters most
is still the backoff guard — it is the only one that fails when the fallback is moved into
sessionTitle, because the rendered cell is correct either way.

Sixteen mutations checked by hand, each dying against the test written for it: fallback
moved into sessionTitle, precedence swapped, trigger weakened to == "", sanitizeLabel
dropped, sessionLabel reverted to harvest-only, the served-title cap removed (failing both
the accessor and the header assertion), the harvested-title cap removed,
newServedTitleModel's fixture wiring stripped — that last one is why a test that had been
asserting a literal instead of its fixture is now a gate at all — plus four from the latest
round: sanitizeLabel narrowed back to overrides-and-isolates only (fails ZWJ, WJ, BOM and
LRM on both sources), a genuine byte-based cap (fails the == rune assertion that the old
<= let through), the grapheme-cluster walk removed (fails all six binder cases and the
degenerate all-marks case), and the shared fixture constant normalised to a precomposed
U+00E9 (fails both cap tests via assertFixtureIsSlowPath, which is the point of having it).

Three more from the round after that: sanitizeLabel dropped from sessionTitleFor now fails 13
tests rather than the 2 it did before the fixtures were rewired; titleIsBlank's ordering
reversed to sanitise-after-trim; and zeroWidthFree's category set unified with
bindsToPrevious's — the tempting "these two are near-duplicates" refactor, which nothing
caught until the new pin. The two predicates answer different questions (is a rune count wrong
about this string's width? vs would cutting before this rune orphan it?) and unifying them is
wrong in both directions: it makes a Mc-terminated title take the slow width path for nothing,
and makes the cap walk back off an Sk that starts nothing.

And three from the latest round, one per finding: the row loop's s.Title replaced with
m.sessions[0].Title (fails ..._ServedTitleCellIsPerRow with TITLE for s2 = "first session", want "second session"); the unbounded mark walk restored (fails
..._CapNeverEmptiesANonBlankTitle and ..._CapOfOnlyCombiningMarksKeepsAPrefix); and
clusterStart's early return broken so the scan runs past the cluster (fails
..._CapWalkIsBoundedByOneCluster and the existing ..._CapCutsOnAClusterBoundary). Each was
applied and reverted individually.

Two fixture guards, because a cap test is easy to write so that it exercises nothing:
assertFixtureIsSlowPath fails loudly if the string it is handed would take truncLeft's
fast path or is already under the cap. The served test had that check inline; the harvested
test had none.

One test is explicitly not a mutation gate, and now says so in its own comment:
TestSessionsPane_CachedOnlyRowTakesNoServedTitle cannot fail if the cached-only loop is
changed to look the title up itself, because cachedOnlySessionIDs excludes every listed
id, so the lookup can only return "". Verified by running that mutation — the suite
stays green. It is kept for the cross-talk check and the worked example, not as a gate.

One test was deleted rather than inverted, as its own doc instructed:
TestSessionsPane_ServedTitleBidiMarksRelyOnTheProducer recorded the BIDI-mark gap as a
deliberate reliance on core/session's sanitiser. Closing that gap is what the latest
commit does, so the characterization no longer describes the code. Its replacement,
TestSessionsPane_ServedTitleStripsEveryControlClass, walks all ten classes (LRM, RLM, ALM,
ZWSP, ZWNJ, ZWJ, WJ, BOM, RLO, LRI) and asserts the rune is gone, U+FFFD is present, and the
surrounding text survives — and its harvested twin does the same for the file on disk, which
is not a trusted input either.

cmd/abctl/tui green plain and with -race; gofmt -l and GOWORK=off go vet clean;
go mod tidy -diff clean.

Verified end-to-end against a live proxy

The motivating case is confirmed on screen, with a base-ref control. A second
authbridge-proxy built from this branch ran on its own loopback ports (47700-47704,
bind_loopback_only, throwaway CA dir) alongside the laptop's existing instance, which kept
answering on its own port throughout — no shared config, launchd label, port or CA was
touched, and no abctl service command was run.

Traffic was inference (POST /v1/chat/completions) bucketed by X-Task-Id, which is the
whole point: such a session has no Claude Code transcript tree, so the harvest can never name
it. Worth recording for the next person, because it cost two attempts — A2A traffic folds no
title at all, since titleCandidate returns rankNone when e.Inference == nil. Only
inference events name a session.

Both binaries were then driven in a real pty against the same endpoint. Sessions list, this
branch:

e2e-e4f69e1c-…  Why did the flag emoji title cap to an empty string?   30s ago  2
e2e-6e7b42c2-…                                                         53s ago  2

Base ref, same proxy:

e2e-e4f69e1c-…                                                 1m ago   2   —   —   —
e2e-6e7b42c2-…                                                 1m ago   2   —   —   —

The header on Enter is a separate call site — the cell takes Title off the summary
the row loop already holds, the header resolves it by id through servedTitle — and it moved
too: abctl · Why did the flag emoji title cap to an empty string? (e2e-e4f69e1c-…) against the
base ref's bare abctl · e2e-e4f69e1c-….

Three things that confirms beyond "the cell filled in":

• The fallback is per-row, not global. The second row is an A2A-only session with no served
  title, and it stays blank on this branch. A blanket substitution would have painted something.
• FIRST-wins held live. The second turn re-sent the whole conversation plus a new user
  message; the title did not change.
• The base-ref control rules out "the proxy started naming things" as the explanation — same
  proxy, same data, blank.

Not done

• The one cmd/abctl failure, TestRunExec_BeforeFirstStartRunsAndSaysWhatIsLost,
  predates this branch — it wants a local CA bundle this machine has not got — and was
  confirmed failing on the untouched base (checked out detached, reproduced, discarded).

Rebased

Rebased onto current main (5625049a, "Merge pull request #1153 … feat/billing-units"),
since the head was 20 commits behind and main had since touched cmd/abctl —
cmd_cost*.go and cmd_pricing*.go, none of which overlap the eight files here, so the
rebase was clean. Everything above was re-verified on the new base: cmd/abctl/tui green
plain and with -race, gofmt -l and GOWORK=off go vet clean for cmd/abctl and core,
go mod tidy -diff clean, core/session and core/sessionapi green.

Assisted-By: Claude (Anthropic AI) noreply@anthropic.com

Summary by CodeRabbit

• New Features
  • Session titles now fall back to the proxy-provided title when no harvested transcript title is available. Harvested titles take precedence when both sources provide a title.
  • Proxy-provided titles appear in the sessions list, are sanitized and limited in length, and may be truncated to fit the column. They are shown only while the proxy lists the session.
  • Skipping Claude metadata scanning does not hide previously saved harvested titles or proxy-provided titles. The title column does not indicate which source supplied a title.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 0b3d9402-8b1c-4860-9323-018baaef35ed

📥 Commits

Reviewing files that changed from the base of the PR and between e5503af and 622d6af.

📒 Files selected for processing (6)

• cmd/abctl/README.md
• cmd/abctl/main.go
• cmd/abctl/tui/session_metadata.go
• cmd/abctl/tui/sessions_pane.go
• cmd/abctl/tui/sessions_title_test.go
• cmd/abctl/tui/usage_render.go

🚧 Files skipped from review as they are similar to previous changes (2)

• cmd/abctl/main.go
• cmd/abctl/README.md

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The TUI now uses proxy-served session titles when harvested titles are unavailable. Harvested titles remain preferred. Served titles do not count as harvested titles for title checks or re-harvest backoff.

Changes

Session title fallback

Layer / File(s)

Summary

Resolve and display session titles cmd/abctl/tui/session_metadata.go, cmd/abctl/tui/sessions_pane.go, cmd/abctl/tui/sessions_title_test.go, cmd/abctl/tui/app.go, cmd/abctl/main.go, cmd/abctl/README.md, CLAUDE.md, core/session/store.go

Session labels and table rows use a nonblank harvested title first, then a sanitized proxy-served title. Cached-only rows have no served-title fallback. Both title sources are capped at the shared maximum title length. Tests cover precedence, sanitization, truncation, cached-only rows, and harvesting checks. Documentation describes the fallback and clarifies that served titles do not suppress re-harvesting.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 622d6

The served-title fallback remains display-only, preserves harvested-title precedence, and applies the intended sanitization. No merge-blocking issue was established; the change is ready to merge after normal checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 622d6

The change is limited to session naming for display. Titles are sanitized and capped, matched to the correct session, and kept separate from transcript-harvesting decisions. No introduced security concern was established, but incomplete comparison coverage warrants a cautious low-risk assessment.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The demonstrated new exposure is event-influenced title text reaching the operator’s session table and selected-session headers. The traced fallback does not acquire harvest-state authority or redirect titles between session IDs.

Trust Boundaries and Controls

• observed — At the text-to-terminal boundary, C0, DEL, C1, specified bidi controls, and specified zero-width characters become visible replacement glyphs. Sanitization precedes blank checking and capping, so headers and cells receive the controlled accessor result.

Resilience and Maintainability Implications

• observed — The producer bounds stored title output before publication, and the consumer independently caps rendered titles. These controls constrain downstream rendering work; they do not establish an upstream request-size limit.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 42 functions across 7 files. (1 skipped: 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: abctl displays the served session title when harvesting does not find a title. The wording is slightly awkward, but the title is specific and directly rela…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[huang195]

The fallback is correct and cleanly layered. Keeping it out of sessionTitle is the right call, and the headline mutation (folding the fallback into sessionTitle) is killed by exactly the test the body says, and only that test in the whole package.

Two new behaviors have no test that can fail, and both fixes are under 10 lines in this PR's own test file (guards inline, each verified green at HEAD and red under its mutant):

• servedTitle's id match: every fixture lists one session.
• The gate side of the backoff (untitledSettled / untitledFresh), which the regression test's header claims to cover.

The rest are comments the second commit set out to correct and missed. One more is outside this diff: core/session/store.go:737 still says "No consumer reads this yet". The commit declines it for scope, which is fair, but it becomes false on merge. Worth a follow-up issue.

Mutation gate: 15 mutants, 11 killed, 4 survived (3 live gaps, 1 unreachable by construction: the cached-only lookup, as the test's own comment says).

[huang195]

must-fix: this lookup has no test that can fail. Mutating if s.ID == id to if s.ID != "" (so every id gets the first listed session's title) leaves the whole tui suite green. Every served-title fixture lists exactly one session, so the lookup is indistinguishable from a constant. It is reachable on any pod with two or more sessions, where session B's header would show A's title.

This guard is green at HEAD and red under that mutant. It could also go into TestSessionsPane_ServedTitleFillsAnUnharvestedCell by adding an s2:

m := newServedTitleModel(t, map[string]SessionMetadata{},
	map[string]string{"s1": "first", "s2": "second"}, "s1", "s2")
for id, want := range map[string]string{"s1": "first (s1)", "s2": "second (s2)", "gone": "gone"} {
	if got := m.sessionLabel(id); got != want {
		t.Errorf("sessionLabel(%q) = %q, want %q", id, got, want)
	}
}

[huang195]

must-fix: the gate half of the backoff is unasserted. The header says a served title must not satisfy "the harvest-backoff predicates", and the PR body lists four. This test asserts countUntitled and harvestNamedSomething, which are the scoring side. It does not assert the two predicates the gate actually reads (app.go:1457–1462). Repointing untitledSettled's skip (session_metadata.go:246) or untitledFresh's (:307) at !titleIsBlank(m.sessionTitleFor(id, s.Title)) survives the whole suite. The untitledSettled one is exactly the regression this test is named for: a served-only row never opens the gate, so the re-harvest stops for good.

This guard is green at HEAD and red under both mutants:

// The GATE's two predicates too, not only the scoring's: untitledSettled decides whether a
// harvest starts at all.
now := time.Now()
m.sessions[0].UpdatedAt = now.Add(-untitledSettleDelay)
if !m.untitledSettled(now) {
	t.Error("untitledSettled is false for a settled served-only row: no harvest will start")
}
if !m.untitledFresh() {
	t.Error("untitledFresh is false for an uncounted served-only row")
}

[huang195]

suggestion: c2f2088 retracted "richer — cwd plus prompt text, tiered" as an overstatement, "corrected in all three places it appeared". It is still here, and still in the PR body ("the richer of the two", "the richer harvested one"). The "stable one" reason is also backwards. The harvest is LAST-wins (core/observe/claude/harvest.go:510; every prompt tier is last-wins), while the served title is FIRST-wins. So the harvest lets whichever turn landed last decide, which is exactly what this comment faults the proxy for doing with the first turn. Suggest reusing sessionTitleFor's "fixed precedence, not a judgement" wording.

[huang195]

nit: "hunting for the better title" sits ten lines below "Deliberately a fixed precedence and not a judgement about which string is better". "the harvested title" or "the title it would prefer" (sessionHasTitle's wording) keeps the two consistent. CLAUDE.md's /v1/sessions row has the same pair ("not a judgement" … "looking for the better one").

[huang195]

nit: this cell says the precedence is "fixed rather than a judgement about which string is better" and then ends "so a served title does not stop it looking for the better one". "looking for a harvested one" would say the same without the judgement.

[huang195]

suggestion: this paragraph went stale in this PR. sessionTitleCell → sessionTitleFor → titleIsBlank, so the cell does call this now. And "a " " title … is returned as " "" no longer holds: a probe at HEAD gets "" for a harvested " " with no served title, and the served title when there is one. Line 377's "it renders sessionTitle" should now say sessionTitleFor.

[huang195]

nit: "like the other two consumers" is now three: sessionHasTitle, harvestNamedSomething and sessionTitleFor. This PR removed titleIsBlank's caller list because it "went stale the first time a caller was added", and this count did the same. Dropping the number avoids the next one.

[huang195]

nit: noServedTitle exists so that "the one legitimate empty argument says so by name". This call and the five other rewritten ones (647, 787, 856, 943, 1000) pass a bare "" where they mean exactly that.

[esnible]

Both must-fix items are addressed in 93b5ebe, and both of your suggested guards were right about
what they'd catch. I reproduced each mutant surviving the full tui suite before writing the guard,
and confirmed it red afterwards.

servedTitle's id match — TestSessionMetadata_ServedTitleIsPerSession. Took your two-session
fixture including the unlisted "gone" id, which turned out to matter: the mutant fails on both the
wrong-session assertion and the miss path, since if s.ID != "" returns "first" for an id that
is listed by nobody.

The gate half of the backoff — folded into the regression guard, with your untitledSettled /
untitledFresh assertions. Verified each gate mutant separately; each is killed by its own line.
The guard's header now distinguishes the scoring side from the gate side and says why they fail
differently, since the old header claimed coverage it didn't have. I also re-ran the headline mutant
(sessionTitle learning the fallback) against the full suite — still killed by that guard alone.

Worth flagging one process note: my first attempt at re-running the headline mutant was a no-op
(I substituted sanitizeLabel(m.sessionsData[id].Title), which is just sessionTitle's own body),
so it "passed" and told me nothing. Redone as the real hazard.

All the comment items are fixed too, including the one you caught as a factual error rather than
staleness: the harvest is LAST-wins (core/observe/claude/harvest.go:511 — "Both are LAST-wins", and
every prompt tier the same), so my "stable one" reasoning was backwards. Neither side is steadier;
they disagree about which turn should name a session. Reworded to the "fixed precedence, not a
judgement" form, and the same fix applied to the PR body above, which had the stale wording in two
places.

On titleIsBlank's stale paragraph — you were right on both halves, and I probed before rewriting:
a harvested " " with no served title now yields "", and the served title when there is one. So
the old worked example ("returned as \" \"") was doubly wrong. The paragraph now says the cell
reaches the predicate through sessionTitleFor, and scopes "not a blankness test" to what's actually
left of it — sessionTitleCell's title == "" fast path.

Also done: the stale "other two consumers" count (dropped rather than incremented, same reasoning as
deleting the caller list), both "the better title" phrasings, and noServedTitle at the six rewritten
call sites.

Still open by design: core/session/store.go:737's "No consumer reads this yet", which becomes
false on merge. Filed as a follow-up — #1191 covers a different core/session title defect found
while testing this branch (a Claude Pro quota probe capturing a session's served title via
first-wins), and I'll note the stale doc there rather than leave it untracked. This PR stays
abctl-only.

Not done, unchanged: no end-to-end run against a live proxy.

Assisted-By: Claude (Anthropic AI) noreply@anthropic.com

[esnible]

Closing in favor of #1192

[huang195]

closing this since we merged the other parallel PR