Add a reviewed `theme` plugin kind (interfaceVersion 1, export `theme`, switch
"list"). A module returns data only: a displayName and a flat map of colour
custom properties for light, dim and dark. checkTheme validates names and
#rrggbb colours strictly and checks each text/background pair for contrast; a
bad module is refused and logged, never served.
The ten shipped palettes become the first ten modules under
packages/plugins/theme/<name>/. Modules are found by directory scan
(loader.discoverModules, loader.loadInstalled), not by a list in the Console.
loadModule and createLoader are unchanged.
The organization file takes `appearance: { theme, mode }`, validated in
packages/business/src/appearance.mjs; a missing appearance is valid.
GET /api/themes (themes-http.mjs) serves the installed, valid themes.
Browser: the Settings picker lists /api/themes. Precedence is a per-organization
browser override, then the organization's saved theme, then the built-in default
(Harbor, dark). Clearing the override restores the organization's choice. An
uninstalled or invalid saved theme renders the default with a visible warning
and keeps the saved value. A legacy global browser preference is not copied to
every organization. The organization is named in text, so colour is never the
only cue. A plain load writes no appearance record. The default look is
unchanged: computed styles match the base commit element for element.
A failed bus start now carries the host's own refusal line, read from host.log; repository paths in messages are shown relative and URLs are kept. Setup cards keep the chosen mode, remote and risk box across a re-render, and a client-side refusal is shown on the card.
Form and live JSON preview over one document, field errors with their
JSON path, the save receipt, and setup cards that name the CLI verb each
step equals. serve.mjs mounts org-admin.mjs with the existing origin and
CSRF fencing.
org-admin.mjs serves the S6 routes over the C2 organization service:
template, validation with JSON paths, create, edit with if-revision, and
guided setup steps that read their receipt back before acting and never
reinitialize. Receipts reach the browser with host paths relative to the
data and config directories.
Read-only: finds a thread's launch and end records in the organization launch log and checks each run's session.json, bundle manifest digests and turn stderr files.
Starts the fixture provider's loopback endpoint for a named dev instance and records it under the data root. Refuses the default instance, a configured proxy, provider credentials in the environment, a non-loopback bind and a second fixture. fixtureLauncherOptions hands the endpoint to the launcher as its session proxy context.
S15 review fixes on top of a584c08ad.
- Breadcrumb: from 700px the project name stops at 40% and a long current
label ellipsizes after it, so a long Conversation title no longer pushes
the page wider than the window. Under 700px the current label is hidden
and the project name shrinks as before.
- Details keeps its size beside a long Conversation title instead of
squeezing to a vertical label (also present on 7c664fac9).
- The active tab is brought fully into the strip after counts load, after
a refresh repaint and when a tab receives keyboard focus.
- Long speaker names wrap between words at narrow zoom; the time stays
whole.
Tests: three new S15 browser tests, red on a584c08ad sources and green
here. S10-S15 each alone 3 times green; webui 952/0/0.
A Tab outside the transcript while a stale matching scroll was still being
classified deleted the settling pin, which cancelled the classification.
Tab moves no transcript, so no later scroll event decided it, follow stayed
on and the next growth pulled the reader to the tail.
The classification now has its own mark. Reader input drops only the pin
provenance that a repaint reads; the two-frame check still runs.
Room and Conversation 700x700 cases: bf6e92232 fails 2/2 in 3 of 3 runs
(5017 to 5267, 5135 to 5385); this commit passes 4/4 in 3 of 3.
jason.woltje