Harden Review Tutor streaming and multi-tab question ownership

[ElbertePlinio]

Goal

Harden Review Tutor for unusually long answer streams and simultaneous browser tabs after PR #61 ships.

Context

Local review of PR #61 confirmed the current behavior is correct for the single-user flow, but identified two bounded follow-ups that should not expand the approved page-focused PR:

1. appendAnswer reparses and rebuilds the complete Markdown tree for every SSE delta. A long answer split into many small chunks can create avoidable main-thread work and clear native text selection.
2. When a page has no currentQuestionId, reconnect state adopts the newest queued/running question. That is useful for reload recovery, but a second tab can cause a question it started to appear in the first tab.

PR #61 already buffers pre-response events, reconciles canonical state, bounds Markdown recursion, and prevents duplicate active submissions. This issue is about efficiency and explicit multi-tab ownership, not correctness recovery.

Acceptance criteria

• Coalesce streamed Markdown renders to at most one DOM update per animation frame while preserving exact accumulated answer text.
• Terminal question events render synchronously from canonical state and cannot lose a final delta.
• Native selection in an answer is not repeatedly destroyed by multiple deltas in one frame.
• Add a deterministic large-stream test that proves bounded render count and exact final output.
• Define page/question ownership for reload recovery versus a second active tab without exposing the bearer token or changing the parent Pi session.
• A reload can still recover its sole queued/running question.
• A separate tab does not silently adopt another tab's new question unless the ownership contract explicitly permits it.
• Preserve rt/1 unless a protocol change is demonstrably required; if required, document compatibility before implementation.
• Keep the loopback, read-only, bounded-process, persistence, export, and cancellation contracts unchanged.

Evidence

• Source PR: feat(review-tutor): redesign guided review interface #61
• Review measurement: repeated full Markdown renders reached seconds of parser/DOM work for a tens-of-KiB answer split across hundreds of deltas in happy-dom.
• Current multi-tab behavior is intentionally accepted for the local single-tab release and has no P0–P2 impact.

[ElbertePlinio]

Agent plan

Goal: coalesced long-answer streaming and explicit multi-tab question ownership, as one PR stacked on #65 for a single batched human review.

Checklist:

• lock the ownership contract (in-session design): per-tab page id in sessionStorage, optional additive ownership field in ask/reconnect — rt/1 preserved (additive, ignored by old pages)
• coalesce streamed Markdown renders to ≤1 DOM update per animation frame; terminal events render synchronously from canonical state
• deterministic large-stream test proving bounded render count and exact final output
• reload recovers own question; a second tab does not adopt another tab's question
• focused tests + full check, independent review, CI — stop at Ready for human review

Current status: In progress (worktree feat/review-tutor-hardening, based on #65)
Next: implementation lane dispatch

[ElbertePlinio]

Progress update — PR open: #66 (stacked on #65)

• ownership contract locked and implemented (per-tab page id, additive optional ownerPageId, owner-or-legacy adoption; rt/1 unchanged)
• coalesced answer rendering: ≤1 DOM update per frame, synchronous terminal render; deterministic 300-delta/3-frame test (4 renders, exact text)
• second tab: no adoption/display/cancel of a foreign question; honest busy gating with helper text; queue-depth-safe un-gate
• independent review (1 P2 + 6 P3) fixed; targeted fix verification clean; final one-line stale-button fix folded in
• bun run check: 419 passed | 25 skipped, coverage 78.34%
• CI on feat(review-tutor): coalesce answer streaming and add tab question ownership #66
• human review (batched with the chain)

Next: CI, then Ready for human review. No merge without Elberte's authorization.

[ElbertePlinio]

PR #66 is Ready for human review at 551cb83 (matches the locally verified tree; base feat/review-tutor-package, mergeable).

• required CI passed: check, Gitleaks, Dependency audit, Database (run 32670210176)
• independent review + targeted fix verification: clean

No merge attempted; batched with the #65 → #66 → #62 chain for one human review.

[ElbertePlinio]

PR #66 was auto-closed by GitHub when its base branch was deleted by the #65 merge (it cannot be reopened). Recreated as #68 against main at 9576fb0 — same reviewed content, rebased. #67 is rebased on top. Ready for human review once CI is green.

[ElbertePlinio]

Human smoke on #68 (2026-08-24): streaming passed. Reload/second-tab blocked by a real defect: GET / requires ?session= but the page strips it after load, so a browser refresh returns the 401 JSON page token failed. Pre-existing from #61, but #68 owns the reload-recovery criterion and its test did not cross the HTTP boundary. Fix in progress on the #68 branch: token-less / serves a bootstrap page that re-enters via the tab's sessionStorage token; a wrong token serves a non-redirecting stale-session page. Second tabs still require the tokenized link by design.