Keep shared-session viewer panes on their own conversation (QUALITY-1676)

[warp-agent-staging]

Description

Fixes QUALITY-1676. Partway through replaying an orchestrator's transcript in a shared cloud session, the pane stopped showing the transcript and rendered the terminal blocklist underneath it — the environment bootstrap git clone block — with the spinner stuck on Warping....

BlocklistAIController::on_shared_init resolved each Init event's server conversation token and then rebound the pane's active conversation to whatever it resolved to. When the token belonged to some other conversation the pane ended up bound to it (or, on a miss, to a brand-new empty one), so the transcript vanished and the InProgress status kept the spinner running.

This change establishes one invariant: a shared-session viewer pane never repoints its active conversation away from the conversation it is already showing.

• on_shared_init binds the pane only when the resolved conversation is the one the pane already shows, or when the pane has no established shared-session conversation yet (the join path). The test is identity, not novelty: the first Init for a foreign conversation binds its token to a locally minted conversation, so later Inits for that same conversation resolve normally and would otherwise rebind. Foreign streams are still recorded, so a later selection update can navigate to them; pane selection continues to travel its own channel (apply_selected_conversation_update → try_enter_agent_view, which sets the active conversation itself).
• on_shared_init drops an Init whose conversation_id is empty. It identifies no conversation, so it can only ever mint one.
• Historical replay now decides what a viewer may receive in one place, is_replayable_for_shared_session: conversations with no token at all (previously replayed as conversation_id: "", which matches nothing on the viewer) and remote-child placeholders (they live on the parent's surface but mirror another run, which the viewer materializes from that run's own session) are skipped, with a warning naming the conversation.
• link_forked_conversation_token refuses an empty incoming token, which would otherwise blank a live conversation's token and unmatch every later Init for it.
• Refreshes a stale comment in orchestration_viewer_model.rs: ?ancestor_run_id= is implemented server-side as parent_run_id (direct children only). Comment only.

Not included: a live-forwarding gate on the sharer. No producer of a local response stream on a remote-child placeholder exists today, so that gate would be dead code — the reachable sharer-side leak is the replay path above. Root-cause analysis, the regression window, and the OrchestrationUnifiedStack question are recorded on QUALITY-1676.

Linked Issue

QUALITY-1676 (Linear).

• Where appropriate, screenshots or a short video of the implementation are included below — see "Verification gap" for why there are none.

Testing

New regression tests, each traced against master to confirm it fails there:

• view_impl_tests.rs — after the pane replays its own conversation, Init events for a conversation the viewer does not hold must not repoint it and must not cost it its transcript. Two events are sent, because the second is the one that resolves through the token index. Asserted with OrchestrationUnifiedStack both on and off, since the invariant is not flag-gated.
• view_impl_tests.rs — an Init with an empty conversation_id neither repoints the pane nor creates a conversation.
• view_impl_tests.rs — link_forked_conversation_token ignores an empty incoming token.
• replay_agent_conversations_tests.rs (new) — replay skips tokenless conversations and remote-child placeholders, and still uses the forked-from token when that is the only one.

Validation: ./script/format reports no changes. This repo skips CI on draft PRs (ci.yml:46-53), so the full workflow was dispatched manually against this branch (run 31860632569, all green) — fmt/clippy on Linux, macOS, Windows and wasm; release compilation on all four; Verify compilation with eval features; and the workspace test suites on Linux, macOS and Windows.

No local cargo check/nextest run: the authoring sandbox has ~4 GB RAM, 2 cores and no swap, and every attempt was OOM-killed partway through the warp crate.

Verification gap

This restores a visibly broken screen, and it has not been verified visually. Reproducing it needs a two-party shared session — a sharer relaying a foreign Init to a viewer — driven from a client built off this branch. crates/integration has no shared-session support at all today, so an automated visual check would mean building new harness capability, and a live repro additionally needs a depth-2 cloud run on staging. The unit tests above cover the exact event sequences that produced the screenshot, at the model layer.

• I have manually tested my changes locally with ./script/run

Agent Mode

• Warp Agent Mode - This PR was created via Warp's AI Agent Mode

[warp-agent-staging]

This PR was generated with Warp.