stack/agents/filbert/work/queue-95/build.md

# Row 95 (#1589): the Board shows the stack's seats, and a sign-out line

Filbert, 2026-10-12. Brief: `docs/plans/2026-10-12_pm-test-fixes.md`, "The
Console's Board shows the stack's seats and a sign-out" (blob ae867dfa,
unchanged). Darkwing reviews. Sage commits after the gate. Nothing in the
candidate is committed, staged or pushed.

Base a3f6e9e6. Nothing has landed on the manifest paths since: `git diff --stat
a3f6e9e6..f9db19d7` on `packages/webui/src/public`, `packages/webui/tests`,
`packages/webui/README.md` and `serve.mjs` is empty. `build.patch` applies at
a3f6e9e6 with `git apply --index`, and `candidate-manifest.sha256` pins all 10
files after the patch. `serve.mjs` is unchanged: the held roles come from the
existing `/api/bus/agents` read.

## What ships

- **Held roles first.** The Board's first section, "Held roles", lists each
  role a run holds on the bus, from the `agents` read: role, state (with the
  working count), attention, address, holder run with its harness, and held
  since. A claim with no address shows "no address". It's read with the Inbox
  count on every Board render (the 10 s poll and Refresh). A refusal shows no
  roles; any other failure keeps the last read, labelled with its time, as the
  bus pages do. Focus stays on the same Message button or Retry across the
  repaint.
- **Message.** Each row has a Message button when the Console takes a send
  (`send` in `/api/config`). It sets the form's role, goes to `#/inbox` and puts
  the caret in the message box. Without `--send` there is no button, and the
  section says messaging needs a Console started with `--send`.
- **Show machine sessions.** A checkbox in the Board's head, off by default.
  While it's off the page never requests `/api/board` (no first read and no
  poll), and the projects tree, Waiting on you, Seen, All sessions and the
  board banners are hidden. Turning it off drops the scan, the selection and
  any open conversation, so turning it on starts from a fresh read. The choice
  is kept in `localStorage` as `mosaic-console-board` = `{"machine":bool}`.
- **Signed out.** Every Console fetch in `app.js` and `bus.js` passes
  `redirect: 'manual'`: the board and conversation reads, the board's Seen and Reply POSTs,
  `/api/config` (both), the bus and module reads, and the send. The first
  `opaqueredirect` dispatches `mosaic-signed-out`. `app.js` sets
  `body.signed-out`, and both scripts then:
  - stop their timers and make no further Console fetch (each fetch helper
    checks first, and Refresh and Pause are disabled);
  - drop everything drawn from a read: the sessions, the inspector, any
    conversation, the held roles, the kept bus reads and the bus page;
  - show one line, "Signed out. Reload the page to sign in.", focused only if
    focus was lost, never pulled out of the send form.

  The send form stays with its draft and its receipt. A send answered with a
  redirect says "Not sent … the sign-in proxy redirected it …; the draft is
  kept". A send after sign-out says "Not sent … signed out; reload the page to
  sign in again" and fetches nothing. A read in flight at the sign-out is
  dropped when it lands.
- **README**: a new section, "Board: held roles and signing out (row 95,
  #1589)", the "Not sent" bullet's redirect case, and the new test file in
  Verify.

## Tests

- New `tests/board-held.test.mjs`, two browser tests against an in-process
  broker with pm (address `pm-run`) and coder (no address) holding claims:
  1. Held roles with machine sessions off: the two rows, "no address", the
     count, the Message labels; the toggle unchecked, no `/api/board` request;
     on, the sessions show and the setting is kept across a reload; off, the
     sessions go and a reload reads no board; Message for each role lands in
     `#/inbox` with that role and the caret in the message; with no send, no
     Message button. Every request asked for `redirect: 'manual'`.
  2. A redirect answer on a Board read (`/api/board` on Refresh), a bus read
     (`/api/bus/agents` on Refresh), a conversation read (`/api/conversations`
     from History), a board POST (`/api/seen` from the inspector's Seen), a
     module read (`/api/queue` on the Queue page) and a send. Each time: the
     line once, no NetworkError, "did not answer" or "not read" text (the
     footer stays visible), no sessions or held roles left, Refresh disabled,
     and no further request on a route change, Refresh, the toggle twice or
     the poll. The send keeps its draft and form.
- `send-browser.test.mjs`: after its redirect-send case, the page is signed
  out; the test checks the line and that a further send fetches nothing, then
  reloads before its remaining cases.
- `browser-edge.test.mjs`: with storage denied, the toggle starts off and still
  turns on.
- `browser.mjs`: `browser({ machine })`, default on (see choice 5).
- `shell.test.mjs`: the 1440 short-page check is 1000 px tall (choice 6).

## Choices

1. **"Kept in the page's settings" is `localStorage`.** The other Board
   filters (Hide offline, Hide seen) aren't kept across a reload, so "like the
   other Board filters" can't mean their storage. I read it as: a checkbox with
   the other filters, kept the way the page keeps its appearance settings
   (`mosaic-console-appearance`). Refused storage starts it off.
2. **No board read while off.** Hiding the sessions while still polling the
   scan would spend a 1.3 s read every 10 s on data nobody sees. Off means no
   request.
3. **Message only with `--send`.** The brief says Message opens the send
   form; the form exists only on a Console that takes a send. A button that
   leads to a page saying "this Console only reads" is worse than a line on the
   Board saying so.
4. **The send form stays when signed out.** "Doesn't show stale data as
   current" covers the reads. The draft is the person's own text, so it stays,
   and a further Send says why it wasn't sent instead of fetching. A board
   Reply in the inspector goes with the rest of the Board: its draft isn't
   shown again (the README says so).
5. **`browser()` defaults to machine sessions on.** The existing suites open 16
   browsers in 11 test files, and most of them read the board scan. Seeding
   the setting is one line in the harness; the alternative was a click in each. Row 95's own first test passes
   `{ machine: false }` to see a first visit.
6. **The shell check is 1000 px tall.** It asserts a short Board doesn't
   scroll. With the held roles added, its two-session Board is 967 px, so 900
   failed. The 420 px case still checks a scrolling page.
7. **The in-flight read race.** Test 2 found that a `/api/board` read in
   flight when a bus read signed the page out landed afterwards and redrew the
   sessions. `accept()` and `error()` now return when signed out; mutants 10
   and 11 cover them.
8. **Overlap with row 77.** Row 77 (#1571, round 2 in review) also edits
   `packages/webui/README.md`, in other sections. Whichever lands second needs
   a rebase of that file.

## Gate

Run in my worktree (`a3f6e9e6` plus the candidate), sequential,
`DOCKER_HOST` at a dead socket, 2026-10-12T21:27:35Z–21:30:19Z
(`gate/summary.txt`):

- webui 86/0, control-board 124/0;
- every `scripts/test-*.sh` exited 0: auth 15, conductor 17, config 24,
  discord 66, extension-package 18, foundation 44, queue 27, release 4 and
  task 26. test-queue skipped its canonical-root part (a worktree), and
  test-release skipped its Docker cases.

The first gate (20:22:51Z–20:25:43Z, same counts, `gate1/`) ran before the
first mutant round. That round left 9 of 35 alive (`mut/out-round1.txt`). Four
were gaps:
- no test redirected a conversation read, a board POST or a module read, so
  dropping `redirect: 'manual'` from `getJSON`, from `api`'s POST or from
  `fetchApi` survived;
- dropping `error()`'s signed-out guard survived. Without it, a redirected
  Board read writes "Board not read: the read failed" into the footer, which
  stays visible when signed out, and the test didn't look there.

Test 2 now redirects `/api/conversations` from History, `/api/seen` from the
inspector's Seen and `/api/queue` on the Queue page, and checks the page for
"not read" and "last known data". `app.js` and `bus.js` didn't change, and
`board-held.test.mjs` is the only file whose digest moved.

**Mutants** (`mut/mutants.py`, `mut/out.txt`), round 2,
21:03:18Z–21:27:35Z: 35 edits to `app.js` and `bus.js`, each matching once,
each run against board-held, send-browser, browser-edge and browser. 30 were
killed and both files were restored byte for byte. The 5 survivors are
redundant guards behind another check that holds:

| Survivor | Why nothing changes |
| --- | --- |
| 13 `schedule` polls with the toggle off | `refresh()` returns on `!machine` (12, killed) |
| 14 `refresh()` without its signed-out guard | `api()` throws before fetching, and `error()` returns on `err.signedOut` (11, killed) |
| 27 bus `schedule` polls signed out | `render()` returns on `out()` (26, killed) |
| 28 Board render without its signed-out return | the listener's `gen++` returns the render before any paint; only `last` is refilled, and nothing reads it again |
| 29 bus view render without its signed-out return | the same `gen++` check, before the view is drawn |

I kept them, so that no single check stands between a signed-out page and a
fetch or a stale paint. Mutants 10 and 11 (choice 7) are killed.

The mutant 19 run (toggle on reads nothing) times out at 900 s in both rounds.
The run's timeout killed only `node --test`, so its file runner and browser
were left, one per round. Darkwing saw them, and I killed both by PID at
21:23:55Z. The `mutants.py` here starts each run in its own process group and
kills the group on a timeout. That's the only change from the copy that
produced `out.txt`.

## Not tested here

- The real Firefox NetworkError: the tests stub `fetch` to answer an
  `opaqueredirect`, which is what Chromium and Firefox both return under
  `redirect: 'manual'`. Live, a pod replacement at the edge is the check.
- Live after the Console restart Mos approves (decision 109).