Roadmap: near-term priorities #125

Tracking issue for the near-term roadmap. Closed 2026-08-23: the batch is complete — every item below either shipped or was resolved by an explicit decision; the two survivors (#120 signing, #123 Windows backend) stand as independently-scoped issues and no longer need a tracking umbrella.

Batch 1 — release and correctness blockers — ✅ complete

• Windows: embedded preview WebView can crash the entire app #149 Windows Preview WebView crash — root-caused and fixed (PR fix(preview): async WebView2 creation on Windows — root fix for #149 #253): wry's synchronous build_as_child pumps a nested Win32 message loop on the GPUI thread; a window close dispatched inside it killed the process mid-creation. Windows now creates WebView2 asynchronously (no nested pump) with generation-tokened cancellation and an app-local user-data folder. Reproduced deterministically and re-validated (3/3 PASS) on physical Windows 11 via the new --preview-smoke lifecycle harness (PR feat(preview): --preview-smoke lifecycle harness #244).
• App self-update and macOS code signing / notarization #120 App update surface — shipped (PR feat: app update-available check via GitHub releases #255): GitHub-release update check riding the provider version-check cadence. Signing/notarization + self-updater remain in App self-update and macOS code signing / notarization #120 — blocked on maintainer credentials, not on code.
• Render-time filesystem probes (canonicalize / exists) run per row on the GPUI thread #154 Render-time filesystem probes removed (PR perf(ui,services): remove render-time filesystem probes from the GPUI thread #236): workspace-root LRU + document-scoped link-target cache.
• Panic surface: unreachable!() clusters and mutex-poison cascade #116 Panic surface reduced (PR fix: reduce the panic surface — poison recovery, structured pipe errors #240): poison-recovering locks everywhere, structured ACP pipe errors, audited unreachable!() sites.

Batch 2 — high-value product gaps — ✅ complete

• Full-text search over conversation event logs #122 Full-text search over conversation logs (PR feat(palette): full-text search over conversation event logs #245): lazy fingerprinted index, palette "Messages" group, jump-to-turn.
• Thread export and sharing (import exists, export doesn't) #108 Thread export (PR feat: thread export (lossless JSONL + readable Markdown) #243): lossless JSONL (round-trips through import) + deterministic Markdown.
• Bridge OpenCode structured questions (agent blocks, user only sees a warning) #110 OpenCode structured questions bridged (PR feat(opencode): bridge structured questions #241): ask/answer/cancel/resume, verified against OpenCode 1.18.21.
• pi adapter does not attach tcode MCP servers (computer use / orchestrate / preview all unavailable on pi) #109 pi MCP gap made durable (PR feat: durable pi MCP-capability surface + warning-severity fix #246): honest Caps::mcp_servers + pre-session capability hints; pi core has no MCP client (verified).
• Worktree isolation follow-ups: ignored files, merge-back, and orchestrate children #121 Worktree isolation completed (PRs feat(worktree): .worktreeinclude seeding + lifecycle hardening (#121 tracks 1+4) #254 + feat(worktree): merge-back flow + opt-in orchestrate child worktrees (#121 tracks 2+3) #259): .worktreeinclude seeding, orphan/collision lifecycle hardening, merge-back flow with a strict never-touch-the-user's-checkout precondition matrix, and opt-in orchestrate child worktrees.

Batch 3 — longer-horizon items — ✅ resolved

• Design spike: opt-in rewind for providers without native support #111 Rewind spike — closed with a written verdict (in the issue body): won't-build; worktree isolation is the undo boundary.
• Computer use: OCR/pictureOnly fallback and Windows (UIAutomation) backend #123 Computer-use fallback — maintainer decision: no OCR (PR feat(computer-use): OCR pictureOnly fallback (macOS Vision) #256 reverted in revert: OCR pictureOnly fallback (#256) #257); raw-image pass-through shipped instead (PR feat(computer-use): raw-image fallback for text-sparse AX trees #258). The Windows (UIAutomation) backend remains in Computer use: OCR/pictureOnly fallback and Windows (UIAutomation) backend #123.
• Unbounded in-memory growth: timeline + per-message MarkdownState never evicted #117 Long-session memory bounded (PR perf(chat): bound MarkdownState residency with windowed eviction #252): windowed MarkdownState eviction with hysteresis (720 → ≤78 resident states in the 240-turn regression).

Still open, independently tracked

• App self-update and macOS code signing / notarization #120 — macOS signing/notarization + self-updater (needs the maintainer's Apple credentials; the update-check surface is already in place).
• Computer use: OCR/pictureOnly fallback and Windows (UIAutomation) backend #123 — Windows UIAutomation backend (+ CDP roots), M–L effort.

Standing decisions (unchanged)

• Headless tcode run (Headless 'tcode run' mode: scriptable agent runs with a structured event trace #124): won't-do — provider CLIs cover scripted runs.
• Self-hosted cloud execution: out of scope; local-first.
• In-app file editor: out of scope.
• syntect asset trimming (Trim bundled syntect syntax set (largest discretionary binary weight) #118): won't-do.