refactor(chat): one module owns the loaded thread window

[chrisnojima]

Problem

One invariant — which response may become the loaded thread window — was implemented as six independent nonces across four modules:

Nonce	Lived in
clearVersion, liveUpdateVersion, windowCleared, windowGateOwner	thread-context.tsx
nextLoadID (module global)	thread-load.tsx
threadLoadGeneration, mountedRef	thread-load-status-context.tsx

None could answer the question alone, so the modules carried ~80 lines of comments explaining why each was insufficient without the others. thread-load-status-context owned "is this load still current?" but was mounted below the store whose loads it arbitrated, so the answer had to be handed back up as a callback struct on every load call.

LoadMoreMessagesParams had 12 fields, two documented "Internal: callers leave it unset" — an interface nearly as complex as its implementation.

Change

chat/conversation/thread-window.tsx owns the loaded window and its arbitration.

requestWindow({anchor, reason})   // anchor: 'newest' | 'older' | 'newer' | {centeredOn}
useThreadWindow() // → {generation, loaded, moreToLoadBack, moreToLoadForward, ordinals}

Gate claim/release, clear-version comparison, cached-vs-full pass reconciliation, disjoint-page refusal and the back-page retry chain are now implementation. LoadMoreMessagesParams becomes an unexported WindowLoad, so retryBelowMessageID/retryCount are genuinely private. thread-load-status-context.tsx is deleted.

Six nonces become one store-visible generation (drives both the response gate and the desktop dataKey) plus a module-private WindowGate.

Deliberate equivalences, not silent drops

• forceContainsLatestCalc deleted — it was set exactly when centered was, so centered && forceContainsLatestCalc ≡ centered.
• knownRemotes deleted — no caller set it; thread-rpc already defaults it to [].
• isCurrentLoad() now also refuses after a clear, so a superseded in-flight load skips its post-await work. The reload the clear issued hits the same conditions one round-trip later.
• Gate release keys on generation, not on mounted — an unmounted load is precisely the one with nothing after it, so it must still release.

liveUpdateVersion deliberately did not fold into generation: it encodes content churn inside one window (a streamed reaction landing under a focus refresh), not a new window. Folding it would change the desktop dataKey on every incoming message and remount LegendList.

Validation

lint:all clean — 0 bailed out, 0 whole-props deps, tsc clean on desktop and native.
jest --runInBand — 230 suites / 2238 tests (master baseline 230 / 2236).

1,549 lines of tests moved out of thread-context.test.tsx and thread-load.test.tsx into thread-window.test.tsx; net test count went up by 2. thread-load.test.tsx's ~160 lines of fabricated actions and hand-set windowCleared/windowGateOwner are gone — the gate suite now drives the real store, actions and gate.