Implementation-only takeover handoff — BLOCKED DESIGN / REBUILD NEEDED

Target: [#15091](https://github.com/pingdotgg/t3code/pull/15091)
Head repository: [pingdotgg/t3code](https://github.com/pingdotgg/t3code)
Original head branch: t3code/fix-browser-focus-stealing
Original head: [aec2d97e389f](https://github.com/pingdotgg/t3code/commit/aec2d97e389f40a9041f7fa0398feaccb456ad92)
Original author: bmdavis419 / Benjamin Davis.
Base: main. Same-repository head; tests handoff records maintainerCanModify=false.
Worktree: /home/ubuntu/wt/terminal-preview-21
Replacement layer: terminal-preview-21/tab-focus
Replacement base: [ab6be13d438a](https://github.com/pingdotgg/t3code/commit/ab6be13d438abeace7617e8d789d59cf2e880f42)
Current local head: [bd08c54d0280](https://github.com/pingdotgg/t3code/commit/bd08c54d0280e225139ed9f7d81cc1a801c2b431) (local only, not pushed).
Only the target PR was linked to this implementation thread. No other batch PR is in scope.

Outcome
No production patch or implementation commit. Worktree remains clean at the separate
agent run’s test commit. The original branch still resolves to aec2d97e389f40a9041f7fa0398feaccb456ad92.
No original source was reused, so no new author-credit trailer is applicable.
The implementation is not complete. Leave the replacement unpublished and blocked.
This is a design blocker in addition to the independent missing native acceptance.

Spec
Automated native Tab/Shift+Tab must traverse the guest page while preserving the
focused host composer, including page boundaries and arbitrarily delayed native focus
destinations. Host typing, caret/selection editing, and active IME must continue.
Intentional human host/guest navigation and takeover must remain available.

Read
Full ~/.agents/skills/take-over-pr/SKILL.md, worktree AGENTS.md,
~/.agents/skills/gh-stack/SKILL.md, /tmp/terminal-preview-21/15091-tests-report.txt,
and /tmp/terminal-preview-21/15091.diff. Inspected the original commit with git show,
without checking out or modifying it. gh stack view --json confirms the current layer
is based on ab6be13d438abeace7617e8d789d59cf2e880f42 with needsRebase=false.

Current architecture and concrete obstacles
1. DesktopBrowserHost.relayFor invokes GuestInput.sendPageCommand only for the page
   session; child-session commands bypass it. An unfocused page’s keyboard input uses
   webContents.sendInputEvent after the existing same-site focus probe. Its subsequent
   Runtime.evaluate is not a native focus completion or destination acknowledgment.
   The old renderer PreviewAutomationHosts press handler does not exist here.
2. A request/acknowledgment before native dispatch could arm a renderer guard in time,
   but the proposed DOM focus/focusout listener only restores focus after the host has
   already lost it. DOM focus notifications cannot cancel the native focus transfer.
   Re-focusing a composer does not establish preservation of its live native IME
   session, current selection, or host blur side effects. Restoring saved selection
   would also overwrite legitimate caret changes made while the traversal is pending.
   This is why no focus-restoration helper was transplanted or newly invented.
3. Releasing at the CDP receipt (or after a timer) leaves delayed destinations
   unprotected. In the original helper, settle() also releases when no focus event
   happened during the command: a first late destination after the receipt is outside
   its guard. Keeping a guard indefinitely fixes that lifetime hole only by creating
   an ownership problem; it still cannot prevent the underlying native blur.
4. The existing takeover signal is not a reliable release acknowledgment for injected
   native keys: PickPreload reports every trusted keydown, with only key/code, through
   HUMAN_INPUT_CHANNEL. Manager turns every such report into controller=human and then
   resets it after 750ms. The payload has no injection identity or origin. Native input
   is not equivalent to an untrusted dispatchEvent, so a guard cannot assume this IPC
   uniquely identifies a physical human action. No native provenance test was run.
   HostedBrowserWebview additionally synthesizes pointerdown on webview focus to dismiss
   host popups; that synthetic event is not human takeover and must never release a guard.
5. Native boundary traversal is implemented below these TypeScript adapters. Chromium’s
   FocusController can transfer to a remote ancestor, or clear document/frame focus and
   call ChromeClient.TakeFocus when the page has no next destination. Focus emulation
   changes reported focus; current upstream ChromeClientImpl.CanTakeFocus still returns
   true outside web tests. It is not a demonstrated containment fix for this embedding.
   Electron’s public WebContents focus event has no cancelable event parameter. I found
   no exposed pre-transfer veto or traversal-scoped completion/provenance primitive in
   the installed Electron 44.4.5 types.

Rejected shortcuts
No hand-built tab order, synthetic KeyboardEvent-only replacement, dropped Tab,
new cross-site refusal, temporary guest focus, receipt/timer cleanup, or global focus
restoration policy was shipped. Passing the conservative two tests by suppressing native
Tab would be a no-op regression, not success. Restoring the deleted renderer handler
would place protection outside the current authoritative input path.

Design needed before implementation can be considered correct
First establish a native traversal primitive that advances the guest using Chromium’s
real focus order while containing focus at the guest/embedder boundary, without blurring
the host composer. It needs a defined policy for delayed cross-frame destinations and
physical takeover. A native Electron hook or a guest surface with independent focus
ownership are investigation directions, not proven recommendations or implementations.
If a renderer handshake is retained, it must be acknowledged before dispatch, tied to the
actual attached guest and host lifetime, and must not use controller=human as unambiguous
input provenance. A handshake alone does not solve the native containment/IME issue.
I could not establish a sound small TypeScript port meeting all requirements in this run;
this does not assert that every possible Electron design is impossible.

Supporting upstream source inspection (research, not pinned-runtime/native proof)
[Chromium FocusController](https://raw.githubusercontent.com/chromium/chromium/main/third_party/blink/renderer/core/page/focus_controller.cc):
AdvanceFocusInDocumentOrder, SetFocusedFrame, SetFocusEmulationEnabled.
[Chromium ChromeClientImpl](https://raw.githubusercontent.com/chromium/chromium/main/third_party/blink/renderer/core/page/chrome_client_impl.cc): CanTakeFocus.
[Electron WebContents](https://raw.githubusercontent.com/electron/electron/main/shell/browser/api/electron_api_web_contents.cc): TakeFocus.
[Chromium WebFrameWidgetImpl](https://raw.githubusercontent.com/chromium/chromium/main/third_party/blink/renderer/core/frame/web_frame_widget_impl.cc): ShouldHandleImeEvents.
These sources support the architectural concern; they do not reproduce the failure on
this app’s Electron build. No claim is made that active IME cancellation was observed.

Final diff
Implementation delta from bd08c54d0280: empty (15091-implementation.diff).
Complete replacement delta from ab6be13d438a: only the pre-existing 17 added test lines
in apps/desktop/src/preview/GuestInput.test.ts (15091-replacement-final.diff).
No test adaptations, new helper suite, contract changes, renderer changes, or docs edits.
The original 36 helper cases were not transplanted. Current tests remain 7 prior + 2
contract guards in GuestInput, plus 104 Manager and 4 DesktopBrowserHost cases.

Checks rerun in this implementation run
Every shell invocation starts with export PATH="$HOME/.local/bin:$PATH".
Worktree vp is used because the prior run established there is no global vp.
1. From worktree root:
   ./node_modules/.bin/vp test run apps/desktop/src/preview/GuestInput.test.ts apps/desktop/src/preview/Manager.test.ts apps/desktop/src/preview/DesktopBrowserHost.test.ts
   Exit 1: 115 pass, 2 expected red contract guards, 117 total across 3 files.
   Both failures are the raw native Tab dispatch assertion at GuestInput.test.ts:66.
   Log: /tmp/terminal-preview-21/15091-implementation-tests.log.
2. ./node_modules/.bin/vp lint apps/desktop/src/preview/GuestInput.test.ts
   Exit 0. Log: /tmp/terminal-preview-21/15091-implementation-lint.log.
3. ./node_modules/.bin/vp fmt --check apps/desktop/src/preview/GuestInput.test.ts
   Exit 0. Log: /tmp/terminal-preview-21/15091-implementation-format.log.
4. From apps/desktop: ../../node_modules/.bin/tsc-rs --noEmit
   Exit 0; existing suggestions only in DesktopClerk.test.ts and DesktopWebLinks.test.ts.
   Log: /tmp/terminal-preview-21/15091-implementation-typecheck.log.
5. git diff --check
   Exit 0. git status --porcelain=v1 is empty.
No web or contracts typecheck: neither scope changed. No repo-wide checks.

Native acceptance — BLOCKED / NOT RUN
No dev server, browser, Electron app, native client, computer use, agent, screenshot,
recording, push, PR creation/edit, assignment, or public comment was performed.
Automated tests are contract guards only; they do not reproduce or prove focus/traversal.
A future implementation must be exercised on the actual Electron bridge, covering:
- Native Tab and Shift+Tab advance through genuine page controls, shadow DOM and frames;
  repeated forward traversal at the final control and backward at the first control
  never send focus into host toolbar/navigation or another guest.
- Host composer remains focused throughout, not merely restored afterward. Continue
  typing and editing selection/caret during and after traversal, including active IME
  with real composition updates and completion. Assert text lands only where intended.
- First focus destination after the CDP reply, and multiple queued late destinations,
  remain protected without arbitrary timeouts; no per-press guards accumulate.
- Physical host Tab/Shift+Tab, shortcut navigation, click outside the composer, caret
  click within it, and actual pointer/keyboard guest takeover retain correct ownership.
  Synthetic pointer replay and injected keys must not masquerade as physical takeover.
- Visible guest, hidden/cross-chat guest, multiple guests, navigation, guest crash/remount,
  composer removal, window hide/close, and explicit release clean up safely.
- Existing cross-site restrictions remain exactly scoped; rejected dispatch is explicit,
  and supported traversal is not silently dropped. Child-session routing is accounted for.
- Cover supported desktop platforms because native focus and IME behavior differ.
These are acceptance requirements, not new unit cases requested for the small test suite.

Model/harness: gpt-6.1-sol, Codex harness. No delegated work in this run.
