F1: the org list shows a broken org as invalid only when the failure
came after the owner check passed (ownerVerified). A broken root or
marker on someone else's org stays hidden.
F2: /api/orgs answers a registry read failure with a fixed message.
The parser text could quote private registry bytes.
F3: selected-org pages keep the list error, paint one replaceable
header banner, and Retry always re-reads the list. The Board shows the
registry message once.
New tests org-list-privacy and org-list-refresh-browser fail on
0e9b2c505 for F1, F2 and F3 and pass here. Serial batch over all 134
webui files plus business org-* and cli org: only failures were the
known pinned-copy EISDIR (8) and an org-switch assertion on the old
pass-through text, updated here.
#867: organization reads no longer take the registry writer lock; they
retry while the lock exists or the registry changed during the read.
#868: a broken organization is listed as invalid with a path-masked
reason instead of disappearing; the Board, header and picker show it,
and /api/orgs 503 carries the reason. Orgs the principal may not see and
archived orgs still give an empty list.
#869: a Console with no board says "No board", not "Board: null".
#866 (save-path validation at bus admission) is left out: it refused
documents the bus accepted before and needs a migration story first.
Every bus, business, cli and webui file run serially; failures are only
the known EISDIR node_modules-link files.
serve.mjs keeps the bound address as well as the port, so the settings,
queue and business routes answer a request that arrives after close().
browser.mjs keeps an exited leader's group tracked until it is killed at
exit, and close() signals the group only while the leader is alive. The
late-request test is event-based with one owned timeout. New test: the
chromium group dies when the main process dies and close() never runs.
Webui browser and server files (92, pinned-copy excluded): 741 pass, 0 fail.
- serve.mjs read server.address().port in the Host checks. Once close() starts that is
null, so a request on a kept-alive connection threw and was never answered, and the test
file waited forever. The bound port is now stored on 'listening'.
- Killing only chromium's main process left its renderer and GPU children writing into the
profile, so the profile rm failed with ENOTEMPTY. Chromium now runs in its own process
group; close() and the exit hook kill the group, and the rm retries.
- teardown.test.mjs: a request sent after close() starts gets a 200.
Combined node --test runs hung in the org browser files. Two causes:
- org-quick: a page's GET /api/config reached the server on a
kept-alive connection after close(server) had stopped the listener.
The handler threw on server.address().port, the request was never
answered, and server.close() waited for it forever. close() in
fixture.mjs now cuts every connection and fails the hook after 5 s
with a message.
- org-delete: t.after hooks run in registration order, so the data
directory was removed while the server still wrote there. The rm
failed with ENOTEMPTY, node:test skipped the later hooks, and the
open server and chromium kept the file running. The three org files
and project-archive-style now register the removal last.
browser.mjs: close() kills a browser that does not answer
Browser.close within 5 s, a call to an exited browser fails at once,
and an unclosed chromium no longer holds the event loop and is killed
when the test process exits.
teardown.test.mjs reproduces each case: 0/4 pass on the old helpers,
4/4 on the new ones.
mosaic org delete ID --confirm ID --if-revision N, and POST /api/orgs/:id/delete,
mark the organization as deleting, stop its bus, move its files into
<dataRoot>/deleted/<ID>-<stamp>/ with a receipt, then drop it from the registry
and append deleted.log. A failure stops at its step and a rerun resumes. Bus
start refuses an organization that is being deleted. The settings page asks
twice: a panel that lists the effects, then typing the ID before Delete
permanently is enabled. Purge and remote revocation are follow-ups.
A 200 or 201 with a body that does not name the expected step as done now
stops at that step as an unknown outcome, with no further writes. Starting a
new draft re-enables the preset, thinking and run controls and clears the
risk checkbox. Browser regression covers both (Sol review P1, P2).
Settings marked every page except appearance and business read only when
send was off. Organization mode always turns send off, so the read-only
style hid New organization and Save organization. Organizations now stays
writable when the server allows org setup. The browser test asserts both
buttons are visible, not only clickable.
Add a reviewed `theme` plugin kind (interfaceVersion 1, export `theme`, switch
"list"). A module returns data only: a displayName and a flat map of colour
custom properties for light, dim and dark. checkTheme validates names and
#rrggbb colours strictly and checks each text/background pair for contrast; a
bad module is refused and logged, never served.
The ten shipped palettes become the first ten modules under
packages/plugins/theme/<name>/. Modules are found by directory scan
(loader.discoverModules, loader.loadInstalled), not by a list in the Console.
loadModule and createLoader are unchanged.
The organization file takes `appearance: { theme, mode }`, validated in
packages/business/src/appearance.mjs; a missing appearance is valid.
GET /api/themes (themes-http.mjs) serves the installed, valid themes.
Browser: the Settings picker lists /api/themes. Precedence is a per-organization
browser override, then the organization's saved theme, then the built-in default
(Harbor, dark). Clearing the override restores the organization's choice. An
uninstalled or invalid saved theme renders the default with a visible warning
and keeps the saved value. A legacy global browser preference is not copied to
every organization. The organization is named in text, so colour is never the
only cue. A plain load writes no appearance record. The default look is
unchanged: computed styles match the base commit element for element.
A failed bus start now carries the host's own refusal line, read from host.log; repository paths in messages are shown relative and URLs are kept. Setup cards keep the chosen mode, remote and risk box across a re-render, and a client-side refusal is shown on the card.
Form and live JSON preview over one document, field errors with their
JSON path, the save receipt, and setup cards that name the CLI verb each
step equals. serve.mjs mounts org-admin.mjs with the existing origin and
CSRF fencing.
org-admin.mjs serves the S6 routes over the C2 organization service:
template, validation with JSON paths, create, edit with if-revision, and
guided setup steps that read their receipt back before acting and never
reinitialize. Receipts reach the browser with host paths relative to the
data and config directories.
S15 review fixes on top of a584c08ad.
- Breadcrumb: from 700px the project name stops at 40% and a long current
label ellipsizes after it, so a long Conversation title no longer pushes
the page wider than the window. Under 700px the current label is hidden
and the project name shrinks as before.
- Details keeps its size beside a long Conversation title instead of
squeezing to a vertical label (also present on 7c664fac9).
- The active tab is brought fully into the strip after counts load, after
a refresh repaint and when a tab receives keyboard focus.
- Long speaker names wrap between words at narrow zoom; the time stays
whole.
Tests: three new S15 browser tests, red on a584c08ad sources and green
here. S10-S15 each alone 3 times green; webui 952/0/0.
A Tab outside the transcript while a stale matching scroll was still being
classified deleted the settling pin, which cancelled the classification.
Tab moves no transcript, so no later scroll event decided it, follow stayed
on and the next growth pulled the reader to the tail.
The classification now has its own mark. Reader input drops only the pin
provenance that a repaint reads; the two-frame check still runs.
Room and Conversation 700x700 cases: bf6e92232 fails 2/2 in 3 of 3 runs
(5017 to 5267, 5135 to 5385); this commit passes 4/4 in 3 of 3.
In the short desktop Room layout the section title sat in the first grid column, so Room details ended mid-row. The title now spans the row and the members line sits right-aligned before the button, capped so long names ellipsize.
The chip's percentage max-width resolved against a content-sized picker
column, so even a single short name was cut off. Cap chips at 16em and
test a one-member Room for whole chip names.
fit-content() is not valid inside minmax(), so the browser dropped the
composer column rule and the field fell into a narrow implicit column.
Use fit-content(50%) for the picker and test the field's share of the row.
Review fixes for S13: the closed-room notice and library line sit above the
messages, the members summary keeps one line (full names in Room details),
the recipient picker is bounded with truncated chips, and the icon-only Room
details button keeps a 44px target. Adds long-member and closed-room tests at
1440x700 and 700x541.
At 100% zoom in windows 541-760px tall the Room page was 60px taller than
the window and the Send to room button started cut off (S10's 160px log
minimum). A short-window Room grid moves the members line beside the
section title and puts the composer on one row; under 650px the header
compacts. Keyed on the CSS viewport only, so 2x displays get the same
layout; page-flow layouts are unchanged.
An upward reader scroll that left the newest message's end at the
viewport bottom still read as at tail, so new content pulled the reader
down past the composer pin. The message-end tail position now counts
only on a downward scroll. A channel-disabled Conversation pins the
newest message instead of a composer that cannot send. S11 and S12
visibility checks require the whole newest message whenever it fits
above the composer.
In page flow (200% zoom, short or narrow windows) the transcript now
follows with the composer's bottom at the viewport bottom and the newest
message above it. Absent or disabled composers keep the S11 pin. Narrow
Room composers stack in one column. S11's visibility check accepts the
newest message's end when it is taller than half the viewport.
In page flow (200% zoom), the S11 follow logic re-pinned the document on
any scroll without wheel, touch, pointer or scroll-key input, so Tab,
Shift+Tab, focus(), find-style reveals and dialog return focus were pulled
back to the tail with focus thousands of pixels off screen.
Re-pin only a downward scroll with no reader input while following (scroll
anchoring as content grows). Count Tab as reader input, expire the reader
flag after two frames, and resume following when a transcript is opened.
S10 review P1: the max-height:700px page-flow rule moved the composer
off screen on 1440x700 and 1366x650 windows at 100%. Page flow now
applies only at max-height:540px (200% tab zoom on desktop screens) or
below 320px wide. S10 review P2: the moved Room details control keeps
its 44px target.
At 200% zoom on a 390px viewport the compact conversation row held a decision status on one line, so Needs your input pushed the page 12px sideways. The status now takes its own line under the icon and text and wraps. The Overview column margin and split were scoped to Overview, so Requirements keeps its base geometry. Tests cover a real decision status and the Requirements position.
jason.woltje