…ments

…tates

…ped to the POST

- SheetHeader was invisible on formSheet pickers: react-native-screens lays
  out a formSheet's scroll view natively and only honors a header when
  [header, scroll view] are the screen content's direct children — the
  wrapping View made it pin the list over the header. PickerSheet drops the
  wrapper (fragment) and marks the header collapsable={false} so view
  flattening can't recreate the bug; mode-picker migrates to PickerSheet.
  Verified on-device: mode + model pickers now show title + Done.
- device-auth: the 15s start timeout now clears as soon as the POST
  resolves. start() stays suspended on the auth browser await for as long
  as the sheet is open, so the timer previously fired mid-sign-in, stomped
  the live pending/idle state with a bogus error, and left a zombie poll
  running behind it.

The bots.length !== 1 guard already narrows bots[0] to ActiveMemberRow; the
root oxlint config forbids the non-null assertion and flags it as unnecessary.

…event-driven clear

- session mutations: dedup only an ADJACENT identical op (repeat of the
  chain tail) instead of any op in a global set, so rename A -> B -> A runs
  the final A and the user's latest intent wins; double-taps still coalesce
- kilo-chat redeliver (DO): reserve the webhook-chain slot synchronously with
  no external await first, so a concurrent request can't slot a later message
  ahead of the redelivery or run delivery out of order; the redelivered event
  is pushed inside the serialized task, strictly before deliverToBot
- kilo-chat redeliver (client): drop the optimistic clear + guarded restore +
  invalidate; the server's message.redelivered event is the single source of
  truth for the flag, which removes both the rollback ambiguity on an unclear
  HTTP error and the refetch race that could overwrite a newer delivery
  failure with a stale pre-failure snapshot

Pre-existing EmptyState call sites keep their previous screen-reader
behavior; only QueryError (which had accessibilityRole='header' before
delegating to EmptyState) opts in via titleAccessibilityRole.

- use-session-mutations: replace hand-rolled per-key promise chain with
  the shared chainSave primitive (already used by use-model-preferences
  and use-code-reviewer); adjacent-op dedupe is dropped since rename/delete
  both go through a confirm step that already prevents double-fire
- shrink onMutate handlers to single-expression returns
- delete hasFailedAttachments (one-line wrapper) and inline its .some()
  at the only call site
- remove five dead toast guards in agent-chat/new.tsx's handleCreate;
  they're already covered by the Start button's canCreate disabled state
- drop the toast on pull-to-refresh failure for the session list; the
  inline "Could not refresh" header line already owns that feedback,
  which lets refetch revert to Promise<void> across the three call sites

…, dedupe refresh/text helpers

- Replace the bespoke rename-conversation formSheet route + sheet component
  with RenameModal (already used for kiloclaw instance and org renames);
  delete the route, sheet, layout registration, and path helper. RenameModal
  gains a maxLength prop (default 50) so conversation rename can pass 200.
- Delete a use-messages test asserting the abandoned resend-as-new-message
  retry design; production handleRetrySend only redelivers in place.
- Inline the conversation-route "Failed to load conversation" message and
  delete the now-unreachable not-found branch of getConversationRouteErrorMessage.
- Drop the unused memberContext field from RedeliverMessageResult's ok variant.
- Extract a shared contentBlocksToText(content, separator) helper for the
  three near-identical reply/auto-title text extractions in conversation-do.ts
  and services/messages.ts.
- Extract a useManualRefresh hook for the three duplicated pull-to-refresh
  blocks (conversation list, kiloclaw instance list, instance dashboard).

Review follow-up: ConversationRow hand-rolled the renaming state +
open/close/save pattern that useConversationRename already encapsulates —
wire it onto the hook. Also update the stale useRenameConversation comment
(the rename form sheet is gone; callers now rename via RenameModal) and
narrow useConversationOptionsSheet's return to what its caller uses.

…ut, dedupe org-id/pending helpers

- InstanceContextBoundary now owns its own header+background shell (title
  prop) instead of relying on dead children passthrough; all 11 callers
  collapse to a one-line early return.
- Move the provisioning wall-clock timeout out of the onboarding machine
  into local ProvisioningStep state — it had no other producer/consumer
  and was threaded through three components just to flip one flag.
- Restore single-shell + body-switch structure in changelog/channels/secrets
  screens instead of duplicating the header per branch.
- Replace hand-rolled pending-id state + onSettled clearing with React
  Query's mutation.variables (model-list, device-pairing), matching the
  pattern already used by exec-policy.
- Extract instanceOrgId() helper for the organizationId-from-context dance
  repeated across ~10 screens.
- Collapse REDEPLOY_BLOCKING_STATUSES into a canStart-derived check.
- Invalidate billing status via queryClient in the mutation's onSuccess
  instead of threading an onContinued callback through three components.
- Collapse useKiloClawBillingStatus's number|function refetchInterval
  union to a single function-typed param.
- Replace model-list's remount-key search-clear hack with TextInput.clear().

Adds [platform]/_layout.tsx to validate the scope+platform route params
once for all six code-reviewer platform routes, instead of each route
calling useValidatedReviewerRouteParams() and branching on
InvalidRouteState itself. The five config-editing routes (style, gate,
focus-areas, repos, instructions) move into an (edit) route group whose
own layout runs useReviewerEditGuard once; the group adds no URL segment
so existing links are unaffected. Drops the forced Route/RouteContent
split in every route now that there's no null check to gate on.

Content half of the previous commit's route restructure: the layout now
does the validation/guard work, so each of the six route files just
reads the already-validated params via useLocalSearchParams instead of
re-running useValidatedReviewerRouteParams()/useReviewerEditGuard and
branching into a Route/RouteContent split.

…Rows

pick() and capitalize() each existed verbatim in 2-4 places; both now
live once in @/lib/utils and every call site imports the shared version
(finding-row's severityLabel was exactly capitalize).

bitbucket-overview.tsx's hand-rolled overview rows are now built with
buildOverviewRows(PLATFORM_CAPABILITIES.bitbucket, ...), matching what
it already produced for bitbucket's capability flags; resolveRowOnPress
moves alongside buildOverviewRows in platform-overview-rows.ts so both
overview screens share one copy instead of two identical locals.

Also deletes platform-overview-screen.tsx's bitbucket+personal "Not
available" EmptyState: the sole caller gates on parseReviewerPlatform,
which already returns null for that combination, so the branch was
unreachable re-validation of an already-trusted route param.

dismiss-finding-screen.tsx hand-rolled the exact bg-secondary/border-b
radio list that PillGroup already renders for the automation and
notification severity pickers. Widens PillGroup's value to T | null
(the dismiss form starts with no reason selected) and its options to a
readonly array so an `as const` literal list can be passed directly.

…spread

advanceSettingsBaseline(baseline, patch) was { ...baseline, ...patch }
with a JSDoc comment and its own test block. Inlines the spread at all
five settings-screen call sites and drops the function and its tests.

…y-agent

Moves platform-error-screen.tsx out of components/code-reviewer/ (a
neutral location, since security-agent now imports it too) and adds
optional eyebrow/errorTitle/message/variant/isRetrying so it covers both
features' full-screen load-failure shape instead of each screen
hand-rolling its own ScreenHeader+QueryError wrapper. Replaces the
duplicated wrapper at 7 security-agent sites (analysis, automation,
notification, repository, sla, settings-overview, scope-entry) with
PlatformErrorScreen, preserving each site's existing icon/title/message
via explicit variant/errorTitle props. scope-entry-screen.tsx's local
ScopeEntryError component is deleted as it's now just this shared one.

Rest of the previous commit's change: generalizes PlatformErrorScreen
with optional eyebrow/errorTitle/message/variant/isRetrying and points
the 7 security-agent full-screen error states (plus code-reviewer's
existing 3 call sites) at it instead of each hand-rolling its own
ScreenHeader+QueryError wrapper.

…lled rows

RepoToggleRow (new, components/repo-toggle-row.tsx) replaces the
copy-pasted repo checkbox row (Lock + name + Check, identical classes
and toggle logic) in code-reviewer's repos.tsx and security-agent's
repository-settings-screen.tsx; it's built on ChoiceRow via a new
optional `children` override (for the icon-prefixed label ChoiceRow's
plain label/description text can't express).

Also adopts ChoiceRow at the remaining hand-rolled Pressable+Check rows
this PR left duplicating its boilerplate: the repository-mode radio
picker in both repos.tsx and repository-settings-screen.tsx, and
finding-filter-modal's FilterOptionRow (kept as a thin wrapper using
ChoiceRow's children override, since its default label rendering's
`capitalize` class would mangle arbitrary repo full names).

…t directly

dashboard-screen.tsx's "More actions" button opened a one-item action
sheet (View audit report / Cancel) for what scope-entry-screen.tsx and
settings-overview-screen.tsx already do as a direct MoreHorizontal
press. Extracts the shared Pressable into AuditReportButton and points
all three at it, dropping dashboard's action sheet plumbing for this
action (its repo-filter action sheet is unaffected).

Sanctioned behavior change: tapping the button on the dashboard now
opens the audit report directly instead of via the action sheet.

sla-settings-screen.tsx had four parallel useState(Number.NaN) hooks
plus hand-built setters/values Records used only to route SlaDayRow's
per-severity value/onChange through the four fields by key. Collapses
to one useState<Record<SlaSeverity, number>>, so the day-row list reads
and writes slaDays[row.key] directly instead of indirecting through the
Records.

…gentCapability

useSecurityAgentEditCapability was just useSecurityAgentCapability(scope)
.canManage, and useSecurityAgentOrgRole's only caller (finding-detail-
screen.tsx) took the raw role only to re-run canManageSecurityAgent(scope,
role) — re-deriving what useSecurityAgentCapability already returns.
Deletes both hooks, keeping useSecurityAgentCapability as the one query;
updates all 7 callers. Also drops the now-unused OrganizationRole
re-export from lib/security-agent.ts (knip-flagged after the callers
that used it were removed).

…branch

The !data.success branch rendered byte-identically to the transient
"could not load" branch above it (same title/variant/onRetry) — folds
into one if (!data || !data.success) after the permanent-error-code
check, which still returns early with the not-found/permission variant
untouched.

…creens

The pre-sharing platform-error-screen hardcoded eyebrow="Code Reviewer"
on its ScreenHeader; the shared PlatformErrorScreen defaults eyebrow to
undefined, so platform-overview-screen's three error states (permission,
provider-state, config) silently lost it. Pass it explicitly at all
three call sites.

…ntry consent chain

OrganizationBoundary now calls useOrgBoundary() itself and takes an optional
title, collapsing all 7 call sites to a single line. Purchase/restore error
suppression drops the hand-threaded suppressToast option in favor of a mount
counter (useInlinePurchaseErrorOwnership) that the subscription screen
registers once. FormField owns blur-validation via a validate prop, removing
~4 copy-pasted touched-field state blocks. sentry-consent drops the manual
gate/Promise-constructor plumbing for a plain await chain with identical
serialization/no-reject/un-mark-on-failure semantics. Also: extracted
AddCreditsRow and InlineRetry to de-duplicate zero-balance and retry UI,
removed force-update's redundant Copy URL button, folded poll-response's
1xx/3xx fallthrough into the error arm, dropped formatDate's no-op options
object, and trimmed validator/utils tests down to the product rules and
Hermes-specific behavior they actually cover.

…e-error owner count in tests

The low-balance-alert sheet's folded loading branch used isLoading, which is
false for an offline paused fetch (no data, no error) — the sheet rendered
nothing. Use isPending (no data AND no error) so the paused case shows the
skeleton while real errors still reach QueryError; guard with organizationId
so a disabled query still falls through to OrganizationBoundary.

Also add resetInlinePurchaseErrorOwnership mirroring the toast-dedup reset
and wire it into the test beforeEach so a throwing test can't leak ownership
into later tests, and drop the pointless call-site alias for the ownership
harness (the rules-of-hooks/new-cap dodge now lives inside the helper,
matching the existing renderProviderElement pattern).