kayg/infraternal

Watch

Fork 0

J165: stack toasts instead of replacing them; shorter rootless refusal (#327, D336) #335

New issue

Open

opened 2026-11-04 03:37:43 +00:00 by kayg · 7 comments

kayg commented

2026-11-04 03:37:43 +00:00

Owner

J165 (UI): stack toasts instead of replacing them. Linked to #327 (rootless refusal) and D336.

Owner (D336): "doesn't svelte-sonner allow for this? the calternal thread took that base of svelte-sonner and rewrote it to be smaller and to its needs. it behaves the same way though so stack them."

Problem: the shared toast in packages/ui shows one message at a time. On a rootless first load the "can't open a shell" error was replaced by "unlock host connections".

Scope

Stack: newer on top, older compressed behind, expand on hover/focus, cap about 3 visible, own timer per toast paused on hover, swipe to dismiss on touch. Keep toast.md behaviours (repeat updates one toast with a count, Undo morphs in place). An error is never removed or hidden by a later info toast.
Study kayg/calternal sonner rewrite; port approach only; check licence, THIRD_PARTY_NOTICES if code is ported.
Shorten the rootless refusal copy to: "This server runs without root, so it can only open shells as its own user. Add a host to work elsewhere." (about 3 lines at 393 px).
D188: small growth, report budget lines; reduced motion respected.
Specs at 1440x900 and 393x852; production-build screenshots of a stack of 3 with one error, desktop and phone, dark and light.
Real first-load proof needs a deploy of this branch to test.ssh.kayg.org (orchestrator action, requested below when the branch is ready).

Branch: toast-stack-j165, base origin/dev 109e14cb71.
Plan and estimate: read calternal + callers (20 min), stack core in toast.ts + CSS (60 min), copy change (5 min), specs (40 min), screenshots + gate on compute01 (40 min).

J165 (UI): stack toasts instead of replacing them. Linked to #327 (rootless refusal) and D336. Owner (D336): "doesn't svelte-sonner allow for this? the calternal thread took that base of svelte-sonner and rewrote it to be smaller and to its needs. it behaves the same way though so stack them." Problem: the shared toast in packages/ui shows one message at a time. On a rootless first load the "can't open a shell" error was replaced by "unlock host connections". Scope 1. Stack: newer on top, older compressed behind, expand on hover/focus, cap about 3 visible, own timer per toast paused on hover, swipe to dismiss on touch. Keep toast.md behaviours (repeat updates one toast with a count, Undo morphs in place). An error is never removed or hidden by a later info toast. 2. Study kayg/calternal sonner rewrite; port approach only; check licence, THIRD_PARTY_NOTICES if code is ported. 3. Shorten the rootless refusal copy to: "This server runs without root, so it can only open shells as its own user. Add a host to work elsewhere." (about 3 lines at 393 px). 4. D188: small growth, report budget lines; reduced motion respected. 5. Specs at 1440x900 and 393x852; production-build screenshots of a stack of 3 with one error, desktop and phone, dark and light. 6. Real first-load proof needs a deploy of this branch to test.ssh.kayg.org (orchestrator action, requested below when the branch is ready). Branch: toast-stack-j165, base origin/dev 109e14cb71420b9830defed63a0ee6928cfcc085. Plan and estimate: read calternal + callers (20 min), stack core in toast.ts + CSS (60 min), copy change (5 min), specs (40 min), screenshots + gate on compute01 (40 min).

kayg commented

2026-11-04 03:39:01 +00:00

Author

Owner

Finding 1 (started; branch toast-stack-j165, base 109e14cb7): the owner's calternal toast code is on branch train/2026-11-04-bm14d (packages/ui/src/primitives/toast/*.svelte.ts, Toasts.svelte), not on main. Evidence: grep -ril sonner over every file there returns nothing, and no file carries a licence header. It is a plain column: VISIBLE=3, a per-toast clock paused by hold reasons (mouse, focus, touch), swipe down to dismiss. It has no compressed stack behind the newest toast and no expand-on-hover.

Decision: I port the approach (VISIBLE cap, per-toast clock with hold reasons, swipe threshold) as fresh vanilla TS in packages/ui/src/toast.ts. The compressed-behind/expand layout is written from svelte-sonner's documented behaviour only. No third-party source is copied, so THIRD_PARTY_NOTICES.md is unchanged.
Also: terminal-refusal.ts already has the requested text for permission; no_login still has the long one. I will shorten no_login to the same sentence (owner D336 asks for a shorter message) unless told otherwise.

Finding 1 (started; branch toast-stack-j165, base 109e14cb7): the owner's calternal toast code is on branch `train/2026-11-04-bm14d` (packages/ui/src/primitives/toast/*.svelte.ts, Toasts.svelte), not on `main`. Evidence: `grep -ril sonner` over every file there returns nothing, and no file carries a licence header. It is a plain column: VISIBLE=3, a per-toast clock paused by hold reasons (mouse, focus, touch), swipe down to dismiss. It has no compressed stack behind the newest toast and no expand-on-hover. Decision: I port the approach (VISIBLE cap, per-toast clock with hold reasons, swipe threshold) as fresh vanilla TS in packages/ui/src/toast.ts. The compressed-behind/expand layout is written from svelte-sonner's documented behaviour only. No third-party source is copied, so THIRD_PARTY_NOTICES.md is unchanged. Also: terminal-refusal.ts already has the requested text for `permission`; `no_login` still has the long one. I will shorten `no_login` to the same sentence (owner D336 asks for a shorter message) unless told otherwise.

kayg commented

2026-11-04 03:48:17 +00:00

Author

Owner

Progress (head 9cbbdae42, pushed to toast-stack-j165):

e8d61d3af: both rootless reasons use the short sentence (open-refusal unit test + real rootless spec updated).
251b4607f: stacked toast core in packages/ui/src/toast.ts + styles.css. show() now returns an id; dismiss(id) removes one toast, a bare dismiss() removes every non-error toast. Owners that show errors or their own prompts (status relay, authority unlock, recovery notice) dismiss by id.
9cbbdae42: apps/tracer/test/toast-stack.spec.ts (1440x900 and 393x852) and a window.__toast hook behind __CLUSTERS_PREVIEW__ (removed from the product build).
Unit tests on compute01 (bun test): toast-stack, toast-icons, startup-toast, open-refusal: 11 pass (earlier run, before the spec commit).
Next: browser spec run (queued in build-slot on compute01, log ~/.cache/codex-scratch/j165/spec.log), budget numbers, scripts/verify fast, screenshots.

Progress (head 9cbbdae42, pushed to toast-stack-j165): - e8d61d3af: both rootless reasons use the short sentence (open-refusal unit test + real rootless spec updated). - 251b4607f: stacked toast core in packages/ui/src/toast.ts + styles.css. `show()` now returns an id; `dismiss(id)` removes one toast, a bare `dismiss()` removes every non-error toast. Owners that show errors or their own prompts (status relay, authority unlock, recovery notice) dismiss by id. - 9cbbdae42: apps/tracer/test/toast-stack.spec.ts (1440x900 and 393x852) and a `window.__toast` hook behind `__CLUSTERS_PREVIEW__` (removed from the product build). - Unit tests on compute01 (bun test): toast-stack, toast-icons, startup-toast, open-refusal: 11 pass (earlier run, before the spec commit). Next: browser spec run (queued in build-slot on compute01, log ~/.cache/codex-scratch/j165/spec.log), budget numbers, `scripts/verify fast`, screenshots.

kayg commented

2026-11-04 05:56:22 +00:00

Author

Owner

Orchestrator: deploy request (J165): please deploy branch toast-stack-j165 at head 918c45db2 to https://test.ssh.kayg.org (unit infraternal-test). The real first-load case I want to see: sign in on a rootless server with a locked authority. The refusal ("This server runs without root, so it can only open shells as its own user. Add a host to work elsewhere.") and "Unlock host connections" should both stay on screen as a stack. I can't do this myself and have no way to run it for real until it is deployed.

Evidence at 918c45db2 (browser spec on compute01, production-built preview build):

bun x playwright test test/toast-stack.spec.ts at 1440x900 and 393x852: 23 passed (2.5m), SPEC_EXIT=0.
Bugs the spec found and I fixed: the oldest toast had the highest z-index and covered the newest (hover and swipe hit the wrong card); ?theme= takes theme ids, so the first "dark" captures were light.
D188 transfer budget, origin/dev 109e14cb7 -> branch: critical gzip 318,131 -> 319,430 B (+1,299; cap 327,680), brotli 265,715 -> 266,872 B (+1,157; cap 273,408); deferred gzip 54,302 -> 54,306 B (+4), brotli +85; on-demand largest chunk 16,215 -> 16,217 B gzip. The window.__toast hook is behind __CLUSTERS_PREVIEW__, so it adds nothing to the product build.

Question for kayg (recommendation: leave it): at 393 px the rootless sentence wraps to 4 lines (306 px of text in a 362 px card at 16 px touch text), one more than "about 3". Getting to 3 would need narrower phone insets or smaller touch text, and D174 fixes the type scale. I kept the owner's sentence and the type scale.

Orchestrator: deploy request (J165): please deploy branch `toast-stack-j165` at head `918c45db2` to https://test.ssh.kayg.org (unit `infraternal-test`). The real first-load case I want to see: sign in on a rootless server with a locked authority. The refusal ("This server runs without root, so it can only open shells as its own user. Add a host to work elsewhere.") and "Unlock host connections" should both stay on screen as a stack. I can't do this myself and have no way to run it for real until it is deployed. Evidence at 918c45db2 (browser spec on compute01, production-built preview build): - `bun x playwright test test/toast-stack.spec.ts` at 1440x900 and 393x852: 23 passed (2.5m), SPEC_EXIT=0. - Bugs the spec found and I fixed: the oldest toast had the highest z-index and covered the newest (hover and swipe hit the wrong card); `?theme=` takes theme ids, so the first "dark" captures were light. - D188 transfer budget, origin/dev 109e14cb7 -> branch: critical gzip 318,131 -> 319,430 B (+1,299; cap 327,680), brotli 265,715 -> 266,872 B (+1,157; cap 273,408); deferred gzip 54,302 -> 54,306 B (+4), brotli +85; on-demand largest chunk 16,215 -> 16,217 B gzip. The `window.__toast` hook is behind `__CLUSTERS_PREVIEW__`, so it adds nothing to the product build. Question for kayg (recommendation: leave it): at 393 px the rootless sentence wraps to 4 lines (306 px of text in a 362 px card at 16 px touch text), one more than "about 3". Getting to 3 would need narrower phone insets or smaller touch text, and D174 fixes the type scale. I kept the owner's sentence and the type scale.

desktop-dark-collapsed.png

132 KiB

desktop-dark-expanded.png

153 KiB

desktop-light-collapsed.png

122 KiB

desktop-light-expanded.png

139 KiB

phone-dark-collapsed.png

34 KiB

phone-light-collapsed.png

30 KiB

kayg commented

2026-11-04 07:22:59 +00:00

Author

Owner

Gate status at 918c45db2 (dev-02, build-slot):

Run 1 of scripts/verify fast: Rust test row FAIL (101): real_binary_keeps_background_backend_probe_off_the_control_path (crates/infraternal/tests/agent_daemon.rs:15) panicked on a Python probe_listener.accept() TimeoutError in scripts/verify-agent-lazy-manager.py. Every other Rust row PASS (fmt, clippy, cargo-deny, gate architecture, static builds). Because the Rust half failed, ts_verify_fast did not run in that pass.
TS half run on its own (source scripts/verify.d/ts.sh; ts_verify_fast): TS_EXIT=0 (tracer typecheck, unit tests, build, transfer budget).
The failing test alone: passes on this branch on retry (1 passed, 17.58 s) and passes on origin/dev 109e14cb7 (1 passed, 1.25 s). My change touches no Rust, so I read run 1 as a load timeout (the VM had other jobs), not a regression, but I do not call run 1 green.
Full scripts/verify fast re-queued on dev-02 (log ~/.cache/codex-scratch/j165/gate.log); I will post its verbatim result.

Gate status at 918c45db2 (dev-02, build-slot): - Run 1 of `scripts/verify fast`: Rust `test` row FAIL (101): `real_binary_keeps_background_backend_probe_off_the_control_path` (crates/infraternal/tests/agent_daemon.rs:15) panicked on a Python `probe_listener.accept()` TimeoutError in scripts/verify-agent-lazy-manager.py. Every other Rust row PASS (fmt, clippy, cargo-deny, gate architecture, static builds). Because the Rust half failed, `ts_verify_fast` did not run in that pass. - TS half run on its own (`source scripts/verify.d/ts.sh; ts_verify_fast`): TS_EXIT=0 (tracer typecheck, unit tests, build, transfer budget). - The failing test alone: passes on this branch on retry (1 passed, 17.58 s) and passes on origin/dev 109e14cb7 (1 passed, 1.25 s). My change touches no Rust, so I read run 1 as a load timeout (the VM had other jobs), not a regression, but I do not call run 1 green. - Full `scripts/verify fast` re-queued on dev-02 (log ~/.cache/codex-scratch/j165/gate.log); I will post its verbatim result.

kayg commented

2026-11-04 09:18:31 +00:00

Author

Owner

Final report (J165), branch toast-stack-j165, head 918c45db2.

Done: stacked toasts (newest in front, older compressed behind, fan out on hover/focus, cap 3 drawn, one clock per toast held while the stack is held, touch swipe, count for repeats, in-place morph, errors never removed or hidden by later notices), short rootless sentence for both reasons, spec at 1440x900 and 393x852 (23 passed), screenshots attached above (dark and light).

Gate, verbatim (scripts/verify fast does NOT pass in a single run; evidence follows):

scripts/verify fast, run 2, head 918c45db2 (dev-02), final table:
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| real-binary fixture paths | PASS         |
| Traefik component manifest | PASS         |
| release component publication | PASS         |
| test                      | FAIL (101)   |
| SSH inode reuse fixture   | PASS         |
| shim process-per-user     | PASS         |
| cargo-deny                | PASS         |
| gate architecture         | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+
VERIFY_EXIT=1

failed tests in run 2 (same three also FAIL on origin/dev 109e14cb7, PASS on the branch when run alone):
test remote_client::tests::winning_quic_drops_the_unfinished_tls_dial_before_control_dispatch ... FAILED
test remote_client::tests::unavailable_udp_does_not_add_seconds_before_tcp_admission ... FAILED
test remote_client::tests::server_path_capability_is_advertised_on_native_and_fallback_transports ... FAILED

gate3.log (cargo test --workspace --locked --lib -- remote_client::tests):
build-slot: [08:44:28] all 2 slots busy; queue position 6, waiting...
build-slot: [09:14:30] got slot 1/2
=== j165-gate
test result: ok. 19 passed; 0 failed; 6 ignored; 0 measured; 223 filtered out; finished in 1.08s
=== j165-base
test remote_client::tests::unavailable_udp_does_not_add_seconds_before_tcp_admission ... FAILED
test remote_client::tests::winning_quic_drops_the_unfinished_tls_dial_before_control_dispatch ... FAILED
test remote_client::tests::server_path_capability_is_advertised_on_native_and_fallback_transports ... FAILED
thread 'remote_client::tests::unavailable_udp_does_not_add_seconds_before_tcp_admission' (1972816) panicked at crates/infraternal-agent/src/remote_client_tests.rs:167:5:
thread 'remote_client::tests::winning_quic_drops_the_unfinished_tls_dial_before_control_dispatch' (1972817) panicked at crates/infraternal-agent/src/remote_client_tests.rs:205:10:
thread 'remote_client::tests::server_path_capability_is_advertised_on_native_and_fallback_transports' (1972811) panicked at crates/infraternal-agent/src/remote_client_tests.rs:688:25:
test result: FAILED. 16 passed; 3 failed; 6 ignored; 0 measured; 223 filtered out; finished in 3.03s
GATE3_DONE

Run 1 failed in real_binary_keeps_background_backend_probe_off_the_control_path (a socket accept timeout); that test passes on the branch on retry and on origin/dev. Run 2 failed in three remote_client timing tests; the same three fail on unmodified origin/dev 109e14cb7 and pass on the branch alone. This change contains no Rust.
The TS half (ts_verify_fast) ran on its own: TS_EXIT=0. It does not run inside verify fast once the Rust half fails.
Static builds row: PASS. D188 budget lines are in an earlier comment (critical gzip +1,299 B, brotli +1,157 B, both under the caps).

Still open: the real first-load check needs the deploy asked for above. The phone rootless sentence is 4 lines, not 3 (question above, recommendation: leave it).

Final report (J165), branch `toast-stack-j165`, head `918c45db2`. Done: stacked toasts (newest in front, older compressed behind, fan out on hover/focus, cap 3 drawn, one clock per toast held while the stack is held, touch swipe, count for repeats, in-place morph, errors never removed or hidden by later notices), short rootless sentence for both reasons, spec at 1440x900 and 393x852 (23 passed), screenshots attached above (dark and light). Gate, verbatim (`scripts/verify fast` does NOT pass in a single run; evidence follows): ``` scripts/verify fast, run 2, head 918c45db2 (dev-02), final table: | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | real-binary fixture paths | PASS | | Traefik component manifest | PASS | | release component publication | PASS | | test | FAIL (101) | | SSH inode reuse fixture | PASS | | shim process-per-user | PASS | | cargo-deny | PASS | | gate architecture | PASS | | static builds | PASS | +---------------------------+--------------+ VERIFY_EXIT=1 failed tests in run 2 (same three also FAIL on origin/dev 109e14cb7, PASS on the branch when run alone): test remote_client::tests::winning_quic_drops_the_unfinished_tls_dial_before_control_dispatch ... FAILED test remote_client::tests::unavailable_udp_does_not_add_seconds_before_tcp_admission ... FAILED test remote_client::tests::server_path_capability_is_advertised_on_native_and_fallback_transports ... FAILED gate3.log (cargo test --workspace --locked --lib -- remote_client::tests): build-slot: [08:44:28] all 2 slots busy; queue position 6, waiting... build-slot: [09:14:30] got slot 1/2 === j165-gate test result: ok. 19 passed; 0 failed; 6 ignored; 0 measured; 223 filtered out; finished in 1.08s === j165-base test remote_client::tests::unavailable_udp_does_not_add_seconds_before_tcp_admission ... FAILED test remote_client::tests::winning_quic_drops_the_unfinished_tls_dial_before_control_dispatch ... FAILED test remote_client::tests::server_path_capability_is_advertised_on_native_and_fallback_transports ... FAILED thread 'remote_client::tests::unavailable_udp_does_not_add_seconds_before_tcp_admission' (1972816) panicked at crates/infraternal-agent/src/remote_client_tests.rs:167:5: thread 'remote_client::tests::winning_quic_drops_the_unfinished_tls_dial_before_control_dispatch' (1972817) panicked at crates/infraternal-agent/src/remote_client_tests.rs:205:10: thread 'remote_client::tests::server_path_capability_is_advertised_on_native_and_fallback_transports' (1972811) panicked at crates/infraternal-agent/src/remote_client_tests.rs:688:25: test result: FAILED. 16 passed; 3 failed; 6 ignored; 0 measured; 223 filtered out; finished in 3.03s GATE3_DONE ``` - Run 1 failed in `real_binary_keeps_background_backend_probe_off_the_control_path` (a socket accept timeout); that test passes on the branch on retry and on origin/dev. Run 2 failed in three `remote_client` timing tests; the same three fail on unmodified origin/dev 109e14cb7 and pass on the branch alone. This change contains no Rust. - The TS half (`ts_verify_fast`) ran on its own: TS_EXIT=0. It does not run inside `verify fast` once the Rust half fails. - Static builds row: PASS. D188 budget lines are in an earlier comment (critical gzip +1,299 B, brotli +1,157 B, both under the caps). Still open: the real first-load check needs the deploy asked for above. The phone rootless sentence is 4 lines, not 3 (question above, recommendation: leave it).

kayg commented

2026-11-04 14:24:55 +00:00

Author

Owner

Real first-load check on https://test.ssh.kayg.org, deployed head 918c45db2 (rootless unit, fresh profile and real passkey sign-in per case via sw-authenticator, theme set with ?theme=mocha|latte). Screenshots attached: desktop 1440x900 and phone 393x852 (touch, 2x), dark and light, collapsed, plus the desktop stack fanned out on hover.

What the real server did, same in all four cases (timeline from sampling .ui-toast every 150 ms after "Open shell on ssh"):

+0.2 to 0.3 s: "Not saved — keep this tab open" (the persistent notice, its own stack above).
+0.9 to 1.0 s: info "Your layout is waiting for the server. Keep this tab open."
+1.3 to 1.5 s: error "This server runs without root, so it can only open shells as its own user. Add a host to work elsewhere." The info toast stays on screen; the two stack (errors and info both data-hidden="false").
+5.7 to 7.0 s: the info toast expires on its own clock; the error stays on screen.
+8.9 to 9.7 s: the error expires on its own 5 s clock. No later toast removed or hid it.
Before this change the same sequence replaced the first toast with the second.

What I could not show for real, and why:

"Unlock host connections" never appears: the CA is unlocked (the palette has no "Unlock host connections" row), so the unlock prompt cannot be raised from here, and I have no way to lock it. If you want that exact pair on screen, please lock the CA on the test unit and tell me.
A later info toast after the error: no real action on this server raises one while the error is up (canvas lock, input lock, transparency, view changes, zoom, pan and a second "Open shell" all produced no new toast). That rule is covered by the stack unit tests and the browser spec (an error is never removed or hidden by later notices, 100 % of 5 later notices at 1440x900 and 393x852), not by this real run.

Two real bugs found by this check, fixed in b2403663b (not yet deployed):

Phone: the key-tray lift was applied to both the stack and each card, so the "Not saved" notice floats ~118 px above the stack (see the phone screenshots; DOM measurement: main stack card y=648..754, notice y=464..518).
Desktop: a fanned-out stack interleaves with the "Not saved" notice (see the desktop expanded screenshots). Fix: expanded stack goes above it.
Also fixed: the global reduced-motion rule set transform: none on every toast, which would flatten the stack.
New spec checks cover the first and third. Browser spec rerun with the fixes is queued (build-slot, compute01).

Request: please redeploy toast-stack-j165 at b2403663b so I can recapture the four cases with the fixes. Accepted per your note: 4-line phone wrap (D174).

Real first-load check on https://test.ssh.kayg.org, deployed head `918c45db2` (rootless unit, fresh profile and real passkey sign-in per case via sw-authenticator, theme set with `?theme=mocha|latte`). Screenshots attached: desktop 1440x900 and phone 393x852 (touch, 2x), dark and light, collapsed, plus the desktop stack fanned out on hover. What the real server did, same in all four cases (timeline from sampling `.ui-toast` every 150 ms after "Open shell on ssh"): - +0.2 to 0.3 s: "Not saved — keep this tab open" (the persistent notice, its own stack above). - +0.9 to 1.0 s: info "Your layout is waiting for the server. Keep this tab open." - +1.3 to 1.5 s: error "This server runs without root, so it can only open shells as its own user. Add a host to work elsewhere." The info toast stays on screen; the two stack (errors and info both `data-hidden="false"`). - +5.7 to 7.0 s: the info toast expires on its own clock; the error stays on screen. - +8.9 to 9.7 s: the error expires on its own 5 s clock. No later toast removed or hid it. Before this change the same sequence replaced the first toast with the second. What I could not show for real, and why: 1. "Unlock host connections" never appears: the CA is unlocked (the palette has no "Unlock host connections" row), so the unlock prompt cannot be raised from here, and I have no way to lock it. If you want that exact pair on screen, please lock the CA on the test unit and tell me. 2. A later info toast after the error: no real action on this server raises one while the error is up (canvas lock, input lock, transparency, view changes, zoom, pan and a second "Open shell" all produced no new toast). That rule is covered by the stack unit tests and the browser spec (`an error is never removed or hidden by later notices`, 100 % of 5 later notices at 1440x900 and 393x852), not by this real run. Two real bugs found by this check, fixed in `b2403663b` (not yet deployed): - Phone: the key-tray lift was applied to both the stack and each card, so the "Not saved" notice floats ~118 px above the stack (see the phone screenshots; DOM measurement: main stack card y=648..754, notice y=464..518). - Desktop: a fanned-out stack interleaves with the "Not saved" notice (see the desktop expanded screenshots). Fix: expanded stack goes above it. - Also fixed: the global reduced-motion rule set `transform: none` on every toast, which would flatten the stack. New spec checks cover the first and third. Browser spec rerun with the fixes is queued (build-slot, compute01). Request: please redeploy `toast-stack-j165` at `b2403663b` so I can recapture the four cases with the fixes. Accepted per your note: 4-line phone wrap (D174).

real-desktop-dark-collapsed.png

73 KiB

real-desktop-dark-expanded.png

83 KiB

real-desktop-light-collapsed.png

65 KiB

real-desktop-light-expanded.png

74 KiB

real-phone-dark-collapsed.png

105 KiB

real-phone-light-collapsed.png

92 KiB

kayg commented

2026-11-04 14:59:56 +00:00

Author

Owner

Update: head is now 39709a52e (fixes b2403663b plus a spec correction). Browser spec on compute01: 25 passed (3.2m), SPEC_EXIT=0, at 1440x900 and 393x852. The unit tests are unchanged by these CSS-only fixes; scripts/verify fast was not re-run for them (earlier gate result at 918c45db2 stands, with its two known timing-test failures that also fail on origin/dev).

Orchestrator: when you put the test server back, please deploy 39709a52e first only if you want me to recapture the four real cases with the fixes; otherwise the real run above (at 918c45db2) is the evidence and the fixes are covered by the spec. Not claimed as verified for real: "Unlock host connections" next to the refusal (CA is unlocked on the test unit), and a later info toast after the error (no real action raises one).

Update: head is now `39709a52e` (fixes `b2403663b` plus a spec correction). Browser spec on compute01: 25 passed (3.2m), SPEC_EXIT=0, at 1440x900 and 393x852. The unit tests are unchanged by these CSS-only fixes; `scripts/verify fast` was not re-run for them (earlier gate result at 918c45db2 stands, with its two known timing-test failures that also fail on origin/dev). Orchestrator: when you put the test server back, please deploy `39709a52e` first only if you want me to recapture the four real cases with the fixes; otherwise the real run above (at `918c45db2`) is the evidence and the fixes are covered by the spec. Not claimed as verified for real: "Unlock host connections" next to the refusal (CA is unlocked on the test unit), and a later info toast after the error (no real action raises one).

kayg referenced this issue

2026-11-05 02:07:41 +00:00

Machine trust: self-renewal and 7-day key rotation #285

kayg referenced this issue

2026-11-05 18:10:54 +00:00

Housekeeping 2026-11-05 #369