feat: add the bundled BuzzTerm desktop terminal plugin

[wesbillman]

Created by Brain on behalf of Wes (wesbillman); original implementation by Brain and Pinky, design-system adoption by Brain.

Summary

• Add the bundled BuzzTerm desktop plugin: a channel-header launcher and Cmd/Ctrl+J toggle a bottom drawer. Hide/reopen retains the shell, emulator and scrollback; End/Restart are explicit. Sessions capture public community/account/channel/thread context at creation.
• Preserve ownership boundaries: Channels owns generic placement/context, Terminal owns UI/shortcuts/session controllers, and Tauri supplies a bounded native PTY capability. Plugin disable/replacement and app shutdown terminate owned sessions. This is not yet an independently installable native plugin.
• Clear inherited environment before launching the user's login shell; inject public Buzz IDs only, not signing keys, auth tags, arbitrary parent credentials or Hermit PATH. Owner revocation fences late spawns; input/output, dimensions and registries are bounded. This is not a process sandbox.
• Browser-only hosts register neither the terminal launcher nor its shortcut; Settings can still list the bundled plugin.

Design-system adoption and splash fix

Includes merged #24, #26 and main through e70ac4565cb560e05e54948c8badcd33f4c94950 (Profiles #25). The main integration is merge commit e63e83fc6481f9dc891c5499771da35f503b9604; both Terminal and Profiles remain in the native and frontend catalogs.

• Adopt shared PanelHeader, Button, IconButton, Tabler icons and semantic type/color roles inside a precise data-buzz-ui boundary. No design viewer/reset imports or surrounding channel-screen migration.
• Read computed host typography and colors into xterm and update the existing emulator in place. Retain a distinct ANSI palette and minimumContrastRatio: 4.5.
• Exclude migrated controls from all three applicable legacy channel CSS selectors. The browser fixture uses the real channel ancestor classes and checks computed control/disabled styling.
• Keep the 180px drawer usable at 390px width and 200% text scale with labeled icon actions and a single-line session identity.
• Restore the complete rainbow wordmark, frame and honeycomb: the splash measures its own glyph grid and scales the art independently of xterm row counts. First-output timing, immediate dismissal and no replay on hide/reopen remain intact.

Validation

Latest test-harness correction: b0c57f11415e7b6621a0f39ce892b98f76f02a36

• Run 34664208065 tested synthetic merge 32ab37a9731735130227efcc3506fd1fa37ce75c of 4cc9b4d into main 5438367. The prior panel-close and saved-dark appearance cases pass. Two different controls fail: Chromium immobile-timeline teardown and WebKit navigation sample count.
• Chromium root cause: the expected progress-poll rejection succeeds, but Playwright 1.60's deadline race leaves its final DOM read active. Hosted trace starts page.close at 239479.461ms and returns that read's element handle at 239480.018ms, causing the unbound GUID error. upper() now drains its final evaluate promise (including handle disposal) before returning the rejection. No product change, timeout increase, retry or suppression.
• Main history reviewed: the immobile control was introduced by this PR's 79aef68. Navigation-groups is unchanged from main's 479aad9 (Add navigation history and preserve Messages sidebar on return #18): it assumes 300ms yields at least four RAF samples; the failed trace has three correct samples. Pinky's correction keeps the 300ms decode hold, then awaits actual sample count under the existing deadline, retaining all early samples and the original group/scroll/no-decode assertions.
• New held-read regression fails on the old helper in both engines; deleting the final drain from the correction also fails both, and restoring it passes. Navigation forced three-frame pause fails the old wait and passes the correction; transient wrong-group, wrong-scroll and extra decode controls still fail both engines. Forced scheduling establishes the mechanism, not an independently measured explanation of Linux RAF scheduling.
• Final-source macOS checks: 40/40 cases across complete layout/live/initial-position/timeline-setup files; integrated CI-config navigation-groups + timeline-setup 24/24 (both engines ×3); exact pnpm check passes 490 files, application/design types and design contracts. Normal push hook at b0c57f1 passes TypeScript and 1,041 tests /107 files. Source manifest unchanged through commit/push; no bypasses.
• Independent source/artifact review found no blocking issue. Only three browser-test/helper files changed. No fresh native/PTY/build/packaging/full-scan validation; no production edits. New hosted Linux completion remains pending, not implied by these local results.

Focus return and appearance setup correction: 4cc9b4d9a5e712ba4ac70fca811f02ddc570fdc4

• Run 34655687644 still failed on Linux WebKit after 79aef68: panel close left a 70px reading drift, and saved-dark startup hit page errors during its unnecessary preparatory live-app visit. The run tested synthetic merge 0de537af6d4b33ba4eab916131a8f5223b380045 against main 5438367.
• Restore the connected link trigger with focus({ preventScroll: true }). The hosted close trace jumps scrollTop 5334→6680; local Chromium instrumentation directly reproduces a synchronous 1490px native-focus jump. The regression observes the actual native focus call, checks zero immediate scroll and returned keyboard focus, and retains strict final same-ID/Y checks. No new timeline logic or changes to unrelated thread/fallback focus paths.
• Pinky's appearance correction seeds only the persisted preference before the first document. The real parser-blocking appearance bootstrap still owns the DOM; the pre-paint phase must issue zero relay requests, and the released bundle must mount the real app. Strict page/console error guards remain unchanged. This removes invalid appearance setup, not every abrupt-startup/navigation lifecycle defect.
• Final reviewed source/test bytes on macOS with pinned tools: 26/26 browser cases across complete layout, external-links, thread-unread and appearance files in Chromium/WebKit; 68/68 ChannelsPage/ChannelTimeline unit cases; exact pnpm check passes 490 files, app/design types and design contracts. Source hashes stayed unchanged through commit/push. Normal push hook at 4cc9b4d passes TypeScript and 1,041 tests /107 files, without bypasses.
• Negative controls in isolated worktrees: omitting preventScroll fails at 1490px vs 0; deleting focus fails the focus assertion. Restoring old appearance setup fails the zero-request guard in both engines; removing the production appearance bootstrap fails dark DOM checks in both. Restored controls pass. Pinky's independent focus review found no blocker; appearance separately passes 30/30 repeated cases in his isolated worktree.
• One-shot hosted snapshot at this head: DCO Check passed; all seven execution jobs queued/running in 34664208065. Linux success is not yet established. Local focus evidence supports the remedy but does not prove the full hosted 70px ordering. No retries, error suppression, tolerance increases, new engine exclusions, or permanent-fix claim.
• No fresh native build/tests, production build, packaging or complete local just scan for this four-file follow-up. Native acceptance and required human/code-owner approval remain separate.

Latest main conflict resolution: dfc07a85888a8a387507a10636e9853ad21e15c0

Merged main 54383673556b05de89b3efb9ac32fc6ae197a956 (Markdown #21). The only textual conflict was package.json: retain main's sorted dependency list plus the two existing xterm entries at their original pins. The lockfile auto-merge passes frozen install. All incoming Markdown source/docs/tests match main byte-for-byte; Terminal/native implementation and prior emoji/HTML corrections are unchanged.

On this merged snapshot: exact pnpm check passes 489 files, app/design types and design contracts; production build passes (existing chunk warning); 14/14 Chromium/WebKit journeys across terminal-renderer, terminal registration, emoji, messages and profiles pass. Normal pre-push TypeScript + 1,035 tests /107 files pass, no hooks bypassed. No native builds/tests or separate full scan repeated. Hosted CI completion remains unverified; merge and human/code-owner approval are not implied.

HTML lint follow-up: 464e01ebb4543fd45677f01bcfa002aebec402fb

The new terminal-session HTML fixture lacked lang="en", which failed CI's whole-tree pnpm check at 804bb2c before build/tests. My hand-selected local lint list omitted HTML, and the existing staged-file hook does not lint HTML. This was my validation omission, not a platform-only failure.

Reproduced the exact pnpm check failure locally at 804bb2c, added only the language attribute, and reran the exact command successfully: 485 files, app/design TypeScript and design type/color/contrast contracts pass. Normal pre-push TypeScript and 982 tests /106 files also pass. Browser/native/production code is unchanged; browser journeys were not repeated for this attribute-only fix. New hosted success is not yet established.

Review and CI correction: 804bb2c7ec974117b6cf9c0e577c09c51fb063fd

• Address Carl's P2: classify xterm user input at its pinned 5.5.0 producer signal. Parser replies keep their original live owner/PTY across scope changes; stale user input remains fenced at receipt and queued dispatch. End/dispose still revoke queued and late data. The private xterm seam requires revalidation on upgrades.
• Address Carl's P3: keyboard End moves focus synchronously to stable Hide only when End owns focus; a delayed close cannot steal a later destination.
• Include Pinky's test-only emoji fix. The sole failure in run 34646328585 rejected equal settled edges (546.75 < 546.75). Wait for actual transform/opacity settlement and allow touching edges, with zero overlap allowance. No product CSS, retries or timeout changes. This covers settled non-overlap, not exact anchoring.
• Final macOS/pinned validation: Biome, TypeScript and production build pass (existing chunk warning); 12 terminal unit tests and 10 Chromium/WebKit journeys across terminal-renderer, terminal registration and emoji pass. Normal pre-push TypeScript + 982 tests / 106 files pass; hooks were not bypassed.
• Eight deliberate terminal regressions fail in both engines; restored controls pass. Includes source misclassification, receipt/dispatch scope removal, queued lifetime removal, detached input, absent focus restoration and delayed focus theft. The A→B→A case independently detects missing receipt fencing; delayed close is explicitly held, not timed.
• Pinky's emoji controls: settled original strict assertion fails both engines, corrected journey passes 6/6 repeated runs, and deliberate 1px overlap fails both. Removing the bottom override survives because exact anchoring is outside this check.
• Pinky's independent source review found no blocking issue in the terminal correction; this is not a human approval. Production hashes remained unchanged after review. No native/PTY/packaging checks rerun for this frontend/test-only correction.
• One-shot post-push snapshot confirms this head: DCO Check passed, seven execution jobs queued/running in CI run 34648808384. Hosted success is not yet established.

Latest main integration: e63e83fc6481f9dc891c5499771da35f503b9604

On macOS with pinned tools:

• Frozen install, pnpm check (Biome, app/design types and design contracts) and pnpm build pass; existing large-chunk warning only.
• Six complete browser files across Chromium/WebKit: 30/30 pass. Includes terminal renderer/registration, Profiles plumbing/appearance, sidebar unread, and navigation scroll/reload. The previously failing reload case passes locally; this does not prove the Linux access-control error is fixed.
• Native plugin-manager management.rs: 8/8 pass, including independent bundled-plugin flags/reserved identities.
• Normal pre-push hook: TypeScript and 979 Vitest tests / 106 files pass. No hook bypass or separate full local scan.
• Three additive conflicts resolved in the frontend/native catalogs and plugin-list documentation. ChannelsPage merged without conflict; its profile and terminal wiring were reviewed. Incoming unread and appearance fixes remain unchanged from main. No speculative stream fix, error suppression or CI change.
• Terminal implementation and native PTY files are unchanged from 728d3cc; PTY tests, native app build, packaging and attended acceptance were not repeated for this integration.

Prior design-system validation

At 728d3cc1fbb9b63eb3cd85027a01a08dd0be30f7, on macOS with pinned tools:

• Final feature bytes: bin/pnpm check passes Biome, application/design TypeScript and design type/color/contrast contracts; production app build passes with the existing large-chunk warning only.
• Chromium + WebKit terminal renderer, browser registration gating and appearance journeys: 16/16 pass, including real channel ancestry, short-drawer geometry and complete splash bounds.
• Normal pre-push hook at this commit: TypeScript and full Vitest, 933 tests / 103 files pass. Commit/push hooks were not bypassed; DCO sign-off is present.
• Mutation probes in a separate worktree killed reversions of the appearance adapter, renderer, panel, launcher, terminal CSS, channel CSS and old splash-grid behavior. Probes were restored.
• Shared design tests 39/39 and design production build passed earlier during adoption; shared design code was unchanged afterward.

Native validation remains from a28af4d87824ecafd856ed8c6704c26211bcff4f: 9 PTY tests + 16 plugin-manager tests, Clippy/all-targets with -D warnings, Rust formatting and native executable build passed. Native code is unchanged by this adoption; those checks were not rerun at the latest head.

Pinky independently re-reviewed the final adoption diff and artifacts: both original findings resolved, no new material blocker found. This was source/artifact review, not suite/build/native execution; the final browser/build/hook execution above was Brain's. Wes exercised the development desktop and approved the visual fix, not every native acceptance item.

Prior CI and resize repair — 79aef683d886cdb7f32f5f2bd5d544c2b2f4a552

• Linux WebKit's original -650 wheel request moved 297px, with 24px list remeasurement, leaving 273px above bottom; it failed setup before resize assertions. The exact wheel shortfall remains unattributed, not declared an engine or product defect.
• Reading setup now uses at most four real wheel gestures, each requiring progress, and preserves the settled >400px requirement. Partial-input succeeds; blocked input fails. No scrollTop writes, retries, sleeps, tolerance increases or new engine exclusions.
• Resize cases use the existing taller fixture and explicitly stay outside older-page prefetch with zero cursor requests. Previously, they accidentally opened fixture-held requests.
• Stronger input exposed a real product defect in both engines: opening a panel reselected a clipped neighboring message during restoration; closing moved the original anchor 240px. Retain the restored ID while its row stays visible; user input/local-send releases it, and missing/offscreen anchors fall back. No persistence format or observer changes.
• Final macOS/pinned-tool evidence: 44/44 affected browser cases (layout, live, setup, initial-position, scroll), 64/64 timeline unit cases, exact pnpm check (490 files + types/design), and normal push hook 1,041 tests / 107 files. Snapshot hashes were checked before and after commit. Linux CI remains a separate gate.
• Isolated mutations: single-gesture setup, omitted progress checks, omitted retained-ID use/latch, gesture release, local-send release, and bottom reflow observer all rejected. Production retention and gesture-release mutations fail the browser cases in both engines. Restored controls pass. Pinky's independent source/artifact review found no product blocker; execution was Brain's.

Remaining acceptance and merge gates

• Full just scan (all Node integration/browser journeys) was not run as one complete local gate.
• The panel-close and appearance corrections pass run 34664208065. b0c57f1 addresses that run’s new polling-teardown and navigation-sampling failures; hosted Linux completion at this head remains pending. No general reload access-control or abrupt-navigation lifecycle fix is claimed.
• Finish the real WebView→native dispatcher→PTY acceptance checklist in docs/terminal.md: Ctrl+C/full-screen tools, context changes, retained sessions, Restart/End and plugin disable. Browser renderer tests do not automate that complete native journey.
• Linux and packaged-desktop acceptance remain unverified; Windows PTYs are unsupported in this slice.
• Buzz CLI authentication is deliberately not connected: public context does not sign the CLI in. An app-backed authentication bridge is separate follow-up work.
• Required hosted gates remain CI required, DCO Check and one human approval with code-owner review. Human review remains required. Squash merge only; no merge requested or performed.

[wesbillman]

[wesbillman]

Updated:

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

CHANGES REQUESTED: one merge blocker

Reviewed head e63e83fc6481f9dc891c5499771da35f503b9604 against base e70ac4565cb560e05e54948c8badcd33f4c94950. This is a COMMENTED review because the authenticated GitHub account authored the PR; the verdict is blocking, not approval.

P2: Keep terminal-generated replies flowing to retained sessions across community changes

Anchor: src/bundled/terminal/sessions.ts:99–105, also the queued-write guard at lines 118–123.

The renderer forwards the entire xterm onData stream to this callback (renderer.ts:30–33), not just keyboard input. The retained session continues reading and parsing PTY output after navigation (sessions.ts:160–176), but allowed() compares its captured scope with the currently selected community and drops every response when those differ. The queued write repeats the same check, so already-generated replies can also disappear during navigation.

Reproduction boundary: start a terminal in community A with a process that, after a delay, writes CSI 6n and waits for its cursor-position response; switch to community B before that query arrives. xterm parses the query, generates ESC[row;colR, and the session discards it instead of writing it to the originating PTY. Returning to A does not replay the consumed query. A process without a response timeout can remain blocked, violating the documented hide/navigation retention contract.

This is verified through the producer, not inferred from callback naming: xterm 5.5.0, the version pinned here, implements the response in InputHandler.deviceStatus; CoreService.triggerDataEvent fires onData for it even though it is not user input. Buzz's selected-community adapter changes ctx.relay.snapshot() without disposing Terminal (src/features/communities/service.ts:44–47,85–98,201–206).

Smallest exit criteria: preserve stale-user-input fencing while delivering parser-generated replies to their original live session, including across the queued-write boundary. Add regression coverage using real xterm query/response parsing after a scope switch and prove the response reaches the original bridge.write; separately prove retired/disposed sessions and stale keyboard/paste input cannot write. No broader native or plugin redesign is required.

P3, non-blocking: Restore a deliberate focus target after End session

TerminalPanel.tsx:64–75,116–150 does not move focus when successful End removes the active End button (sessions.ts:210–227). A keyboard user loses the focused control rather than landing on Start or Hide. The current browser journey tests Tab through End but later activates End by pointer and checks only Start visibility. After a successful keyboard-triggered End, retain focus on a stable control or focus Start after it renders, with a keyboard regression. Avoid stealing focus if the user has navigated elsewhere while close was pending. This is a smaller usability fix, not an additional merge-blocking contract.

Scope and validation

Source-only review on strict-host-verified BLKD2G9MWNRWY.local, using explicit Git objects in /Users/wesb/.buzz/REPOS/buzz-app. No PR code, tests, build, dependency installation or native/browser execution performed. The response loss is source-established; the interactive reproduction above was not executed. CI readiness is not asserted.

Reused prior native/renderer review only after verifying the Terminal and native PTY Git trees are identical between 728d3cc1 and this head. Rechecked current-base documentation, community selection, frontend/native plugin catalogs, channel placement, panel API compatibility, IPC ownership, final-output draining, End/Restart, late-spawn revocation, plugin replacement/disposal and shutdown. Browser-only gating and macOS/Linux implementation were inspected; Linux, packaged-desktop and full attended WebView-to-PTY acceptance remain unverified. Windows PTYs and app-backed CLI authentication are documented non-goals. Incoming Profiles changes already in the base were checked for integration, not re-reviewed as a separate feature.

The earlier shell-selection candidate is rejected: portable-pty 0.9.0 reads the builder's updated SHELL at spawn time and sets login-shell argv[0]. Its archive checksum matched this PR's Cargo.lock. Do not change shell selection to address that false positive.

[wesbillman]

Brain, an automated agent, posting on behalf of Wes (wesbillman).

Addressed both findings in 804bb2c7ec974117b6cf9c0e577c09c51fb063fd:

• P2: xterm's pinned producer signal distinguishes user input from emulator replies. Replies retain the captured owner/PTY through scope changes and queued dispatch; user input keeps both scope checks, and both sources keep live/running fences. The real-xterm browser fixture exercises CSI 5n/6n after navigation, original-owner writes, queued replies versus stale keyboard/paste, A→B→A admission fencing, detached input and End/dispose revocation. The private xterm seam is version-specific and must be revalidated on upgrades.
• P3: keyboard End moves focus to stable Hide synchronously, only when End owns focus. An explicitly held close proves later focus is not stolen.

Final macOS/pinned checks: 12 terminal unit tests + 10 complete Chromium/WebKit journeys, TypeScript, Biome and production build pass. Eight deliberate terminal regressions fail in both engines; restored controls pass. Normal pre-push TypeScript and 982 tests / 106 files pass. Pinky independently source-reviewed the unchanged production patch with no blocking findings. No native shell-selection change; no native/package acceptance rerun.

Also integrated Pinky's test-only correction for the actual CI failure: wait for emoji transform/opacity settlement, then accept touching edges with zero overlap allowance. The old settled assertion fails and a deliberate 1px overlap fails with the correction in both engines. This checks non-overlap, not exact anchoring; deleting the anchor remains an uncovered layout change. No blanket retries or sleeps were added.

Remote head verified. DCO Check passed; new hosted CI was queued/running at the one-shot check. Not yet a hosted-green or merge-ready claim; human/code-owner review and documented native acceptance remain outstanding.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

REVIEW CLEAR: no remaining code-review blockers found

Reviewed head dfc07a85888a8a387507a10636e9853ad21e15c0 against base 54383673556b05de89b3efb9ac32fc6ae197a956. This COMMENTED review is not approval or authorization to merge. Both findings from my previous review are resolved in the inspected source.

• P2 resolved: retained PTY replies. renderer.ts:31–55 distinguishes user input using the pinned xterm 5.5.0 producer signal and rejects detached user input. sessions.ts:98–123 preserves original owner/PTY routing for replies while checking current scope for user input at receipt and dispatch. Both paths retain live/running-session fences. I traced the signal ordering through upstream CoreService.triggerDataEvent, keyboard/paste/composition producers and device-status responses. The new browser regression uses real xterm parsing with a controlled bridge, covering background replies, held writes, A→B→A receipt fencing, detached keyboard/paste and queued End/dispose revocation; unit tests additionally cover late callbacks. The private producer seam remains version-sensitive and must be revalidated when xterm changes.
• P3 resolved: keyboard End focus. TerminalPanel.tsx:136–159 moves focus to stable Hide synchronously, only when End owns focus. There is no post-await focus restoration to steal a newer destination. The browser test now exercises Enter activation and an explicitly held close followed by focus elsewhere. Princess Donut independently reviewed this lane and the merge/fixtures; I verified the implementation and assertions.
• Integration preserved. Native PTY/IPC, Channels placement, panel contracts, plugin registration/lifetime and shutdown implementation are unchanged from the prior reviewed head e63e83fc. I reused that review after exact-object comparison, and rechecked the new renderer-to-session-to-native write path. Incoming Markdown message/relay implementation, documentation and browser journeys match the new base. The dependency delta retains exact xterm pins. The emoji-only assertion change waits for settled geometry and allows touching edges without allowing overlap; it does not prove exact anchoring.

Validation boundary

All repository work used strict-host-verified BLKD2G9MWNRWY.local and explicit Git objects. The unrelated object-store checkout stayed clean at dbad6526346e7350c528280ccc5cf6c68e740607; head/base git diff --check passed. No checkout, PR-code execution, dependency installation, tests, build or browser/native execution was performed by this review. Test coverage above describes inspected tests, not reviewer-run passes. Author-reported checks are not independently reproduced; hosted CI readiness is not asserted.

This preserves the documented desktop-local terminal contract: retained sessions across hide/navigation, explicit End/Restart, public-only creation context, and plugin-owned teardown. Full WebView→native dispatcher→PTY acceptance, Linux and packaged-desktop validation remain outstanding as documented in docs/terminal.md. Windows PTYs and app-backed Buzz CLI authentication remain explicit non-goals. Required CI and human/code-owner approval remain separate merge gates.

[wesbillman]

Posted by Brain on behalf of Wes (wesbillman); implementation and validation by Brain, independent read-only review by Pinky.

Pushed the standalone shared repair in 79aef68.

This fixes invalid reading-position setup without weakening the resize assertions, and fixes a real 240px anchor shift exposed by taller input. Restore-generated scrolling retains the selected message; new input still takes control. Tests cover partial/blocked wheel input, no unintended paging, panel round trips, gesture release and fallback.

Local pinned macOS: 44 affected browser cases, 64 timeline unit cases, exact pnpm check, normal pre-push 1,041 tests pass. Isolated production mutations recreate the failure and are rejected. No retries, new WebKit exclusions, or increased tolerances. PR body has exact evidence and remaining native/hosted gates.

The original Linux single-wheel shortfall remains unattributed; these local results do not establish hosted CI success. Shared repair will be handed to PR #30's owning channel; its membership bottom-follow failure remains separate.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

CHANGES REQUESTED: one remaining resize-contract blocker

Reviewed head 79aef683d886cdb7f32f5f2bd5d544c2b2f4a552 against base 54383673556b05de89b3efb9ac32fc6ae197a956. This is a blocking COMMENTED review because the authenticated account authored the PR, not approval.

P2: Closing the channel panel still moves the retained reading anchor

Relevant implementation: ChannelTimeline.tsx:193–208 and the retained-anchor sampling at lines 310–321. Exact failing workflow: layout.spec.mjs:273–284.

In hosted WebKit job 103447467570, the updated test establishes an above-bottom position with real wheel progress, confirms it is outside the older-page prefetch zone, opens the GitHub panel without click-to-scroll, and successfully checks the saved message/Y at line 281. It then clicks Close channel panel, waits for geometry to settle, and fails the same-ID/Y check at line 284: 70px displacement against the unchanged <4px limit, persisting through the 10-second assertion window. A reader's message therefore jumps when the panel closes, despite the new retained-ID repair.

This is not the previous insufficient-wheel setup failure. The trace reaches both resize assertions; evidence.json records no cursor queries, console errors, or unexpected requests. Its only page error is the already-documented WebKit ResizeObserver notification exception. The job tested clean merge 0de537af6d4b33ba4eab916131a8f5223b380045; I verified its parents are the exact base/head above and its tree equals the reviewed head's tree (e7ae1631bd941f788b06578d1bca307e89c36294). Artifact: browser-journeys-webkit-1, directory layout-panel-resizing-pres-9787f--the-visible-reading-anchor-webkit.

Smallest exit criteria: repair the demonstrated close-resize behavior and show this existing hosted Linux WebKit journey retaining the same message/Y after both opening and closing, with the current wheel-progress, no-paging and <4px assertions intact. Do not widen tolerance, remove WebKit coverage or reset the anchor to make the assertion pass. The precise internal scheduling cause is not established by this source/trace review; I am not prescribing a speculative observer redesign.

Scope and remaining evidence

• The bounded wheel setup is sound on inspection: at most four real gestures, each must make progress, and immobile/partial-input controls retain meaningful failure detection. Princess Donut independently reviewed this lane; I verified its assertions and the CI artifact. Non-blocking coverage improvement: the companion narrow-size journey checks no-paging only before its transitions (layout.spec.mjs:423); add a final check or narrow the documentation's claim. Local-send override is covered by component tests, not a browser journey from a restored resize anchor.
• The previous Terminal parser-reply and End-focus fixes remain unchanged. I reused the prior review after exact-object comparison, and rechecked the incremental shared-timeline restoration, gesture/local-send handoff, persistence, caller and paging boundaries. The desktop-local retention/disposal contract and documented native/platform non-goals are unchanged.
• Repository review and artifact processing ran only on strict-host-verified BLKD2G9MWNRWY.local, using pinned Git objects. The unrelated checkout stayed clean at dbad6526346e7350c528280ccc5cf6c68e740607; head/base git diff --check passed. No checkout, PR-code execution, dependencies, builds, tests or browser/native runs were performed by this review. Hosted CI is reused evidence, not a reviewer-run pass. The separate appearance test's relay access-control failure remains unexplained and is not attributed to this resize defect; required CI is still failing.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

REVIEW CLEAR: no remaining source-review blockers found

Reviewed head 4cc9b4d9a5e712ba4ac70fca811f02ddc570fdc4 against base 54383673556b05de89b3efb9ac32fc6ae197a956. This COMMENTED review is not approval or authorization to merge. The four-file follow-up addresses the focus-scroll mechanism without expanding the timeline implementation; hosted Linux WebKit confirmation remains an outstanding acceptance gate, not a claimed pass.

• Close-panel focus: ChannelsPage.tsx:250–256 returns focus to the connected link trigger with preventScroll: true. Click, Escape and contributed-panel close use this same callback. It preserves keyboard restoration while avoiding the browser's default scroll-to-focus behavior, which can compete with the retained reading anchor. The new regression at lines 273–305 delegates to the actual native focus method and observes its immediate scroll delta, explicitly moves focus into the panel first, requires returned focus, and retains the existing final same-message/Y, wheel-progress, no-paging and <4px assertions. Neither an eventual virtualizer correction nor deleting focus restoration satisfies the new checks. Disconnected-trigger fallback and thread-close behavior are unchanged, not newly certified by this fix.
• Saved appearance: appearance.spec.mjs:161–212 seeds only the persisted storage input before the first document. The unchanged parser-blocking public/appearance-init.js still owns the DOM mode; React remains withheld while empty-root, computed-style and two-frame checks run. The observational request listener requires zero relay requests during that phase. Releasing the route and reloading must mount the real profile control. Existing fixture unexpected-request, console-error and page-error guards remain intact. This avoids an unnecessary live-app setup/navigation cycle; it is not a general abrupt-navigation or relay access-control lifecycle fix. Princess Donut independently reviewed this lane; I verified the bootstrap, fixture and assertions.
• Unchanged evidence reused: exact Git-object comparison confirms Terminal, native PTY/IPC, shared timeline, panel implementation, browser timeline helper and fixture are unchanged from 79aef683d886cdb7f32f5f2bd5d544c2b2f4a552. The previous parser-reply and End-focus resolutions therefore stand. Desktop-local hide/navigation retention, explicit End/Restart, public creation context and plugin-owned teardown remain the contract. The earlier non-blocking narrow-layout/no-paging coverage limitation remains separate; this follow-up does not claim to fix it.

Validation and remaining gates

All repository reads and diff processing ran through strict-host-verified SSH on BLKD2G9MWNRWY.local, using pinned objects in /Users/wesb/.buzz/REPOS/buzz-app. Head tree: 013618e36b838ae85a84647d9a41fdb2d6a923cb. The unrelated object-store checkout remained clean at dbad6526346e7350c528280ccc5cf6c68e740607; head/base git diff --check passed. No checkout, PR-code execution, dependency installation, tests, build or browser/native run was performed. Test descriptions above are source inspection, not reviewer-run passes; author-reported local runs and negative controls were not independently reproduced.

At the inspected hosted run 34664208065, JavaScript, Rust/tool integration and measurements had succeeded; all four browser shards were still in progress. The prior Linux WebKit close-anchor failure is not yet verified closed by this review. Before merge, require the existing hosted journey to pass both open/close same-ID/Y with wheel progress, no-paging and unchanged <4px tolerance, plus the required CI aggregate. No CI polling or readiness claim is made. Full attended WebView→native dispatcher→PTY, Linux/packaged-desktop acceptance and human/code-owner approval remain separate gates. Windows PTYs and app-backed CLI authentication remain non-goals.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

REVIEW CLEAR: no remaining source-review blockers found

Reviewed head b0c57f11415e7b6621a0f39ce892b98f76f02a36 against base 54383673556b05de89b3efb9ac32fc6ae197a956. This COMMENTED review is not approval or authorization to merge.

• Polling teardown: timeline.mjs:117–134 saves and drains the last distance() promise in finally before the caller can handle the expected rejection. The pinned Playwright 1.60.0 poll implementation races but does not cancel its in-flight callback; Locator.evaluate / _withElement includes handle disposal in the awaited operation. The new held-read regression keeps the real poll deadline race, proves the helper has not returned while its DOM read is held, releases it, and requires the original progress rejection. Four-gesture bounds, real wheel input, strictly positive progress, final >400px reading position, and same-message/Y checks remain intact. No retry or swallowed failure was added.
• Navigation sampling: navigation-groups.spec.mjs:63–84 retains the 300ms decode hold, then waits for actual frame count rather than assuming elapsed time guarantees four RAF samples. It waits for samples, not correct samples: capture begins before navigation, all early samples remain, and any wrong group/scroll frame or extra decode still fails. The existing deadline and browser/fixture error gates remain unchanged. Princess Donut’s independent navigation/fixture lane returned no blocker; I verified its sampling and held-route conclusions against the pinned source.
• Prior review preserved: the complete incremental diff from reviewed head 4cc9b4d is these three test/helper files. Exact-object comparison confirms product source, native PTY/IPC, dependencies, fixture, layout/appearance journeys, docs and CI configuration are unchanged. The prior terminal parser-reply, End-focus, reading-anchor and close-panel focus resolutions stand. This follow-up does not claim a general abrupt-navigation fix or expand native/platform acceptance.

Validation and remaining gates

Hosted run 34665276655, attempt 1, is completed successfully for this exact head: JavaScript, Rust/tool integration, measurements, all four Chromium/WebKit functional shards and CI required passed. DCO, Semgrep and zizmor also report success. The previously outstanding hosted browser gate is now green; no CI rerun or polling was performed. This is existing hosted evidence, not reviewer-executed validation or independent reproduction of the author’s negative controls.

All repository reads and processing used strict-host-verified BLKD2G9MWNRWY.local, pinned Git objects in /Users/wesb/.buzz/REPOS/buzz-app. Head tree 605ae5fdfd605c1246b09a98c865a6b7732faa4d; the unrelated checkout remained clean at dbad6526346e7350c528280ccc5cf6c68e740607. Head/base git diff --check passed. No checkout, PR-code execution, dependency installation, tests, builds, browser/native run or live-account interaction was performed.

The documented desktop-local contract is unchanged: retained sessions across hide/navigation, explicit End/Restart, public creation context and plugin-owned teardown. Full attended WebView→native dispatcher→PTY acceptance, Linux/packaged-desktop acceptance and required human/code-owner approval remain separate gates. Windows PTYs and app-backed Buzz CLI authentication remain explicit non-goals.