{"tags":[{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-10-22T14:07:34.000000+02:00"},"message":"search rounds: record each web search and tie it and its result page to its space\n\nEvery search the websearch tile runs becomes a `text` item whose content is the\ntrimmed query, tagged `search-round`, with one item event per run carrying the\nengine id and the result URL in its metadata under `kind: 'search-run'`. The\nsame query run again is a second event on the same item.\n\nWhen the window the search started from is in a space, the search item is tagged\nwith that space and the result window opens in it. The result page is tagged by\nthe tile itself rather than by the spaces auto-tagger: page tracking creates the\npage item inside the window-open handler, before the new window's space reaches\nits context, so `features/spaces/background.js handleItemCreated()` reads no\nspace for a brand-new space window.\n\n`features/websearch/home.js executeSearch()` is now the single path every\nsearch takes, including the one from the search window's own UI. The websearch\nmanifest gains the datastore tables and the `mode` context read the recording\nneeds.\n","name":"spec/research-search-rounds/de19f3ca542376aae6b4676e3fd231d0b8dccac3","oid":"2a33f29d9a341a1a8d5730903abd33380223c852"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-10-22T12:29:53.000000+02:00"},"message":"time on page: fill item_visits.duration from front-of-user time\n\nA web page visit now carries the milliseconds the page was actually in front\nof the user — its window key, the app active, the window visible — instead of\nleaving the column at 0.\n\nvisit-dwell.ts holds the bookkeeping and nothing else: per window, the open\nvisit's id, the milliseconds counted, and the instant counting last started.\nThe clock is passed in, so it reads no time, touches no storage and names no\nwindow system. Front-ness survives a visit swap in the same window, so a\nnavigation while the page is in front starts counting the new visit at once.\n\nvisit-dwell-owner.ts supplies the three facts it cannot know. Page loads\nreport their visit from the four trackWindowLoad() sites in ipc.ts; the window\nmachine's own notification after each dispatch says which window is in front,\nwith the chrome overlay holding the key counting for its host; the result is\nwritten by datastore.ts setItemVisitDuration() in one UPDATE when the visit\nends — at the next tracked navigation in that window, when the window closes,\nor at the shutdown flush, which runs while the database is still open. A visit\nopen when the process dies keeps duration 0; there is no periodic flush.\n\nPEEK_VISIT_DWELL=off skips the observer and the recording entirely.\n\nPage load costs nothing measurable: median 112/137 ms with the wiring and\n123/130 ms without it over two runs of 20 loads each, a difference smaller\nthan the spread between two runs of the same setting. Input latency is\nuntouched because no code runs in the page.\n","name":"spec/research-time-on-page/02818fbc646fe915d9eb52505b7e5c1e78d44f51","oid":"e27f6e451f52f91ff3070afa60f169da4dd06b1d"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-10-21T10:30:22.000000+02:00"},"message":"feat(lookups): to-watch, to-read and to-listen items resolve to what they name\n\nA text item tagged `to-watch`, `to-read` or `to-listen` is usually a bare\ntyped title. The new built-in feature `features/lookups/` reads such a title,\nasks Wikidata which work it names, and writes `metadata.lookup` with the\nwork's Wikipedia page, its creator and the external links that say where to\nread, watch or listen — plus the tag `lookup:found` or `lookup:unresolved`.\n\n`resolve.js` holds every decision and is pure, so a peeklet can later run it\noff the desktop: reading the title, applying each tag's class set to the\ncandidates, preferring a candidate whose creator answers the hint, and\nbuilding the links. `background.js` does the three fetches — search, then\nentities, then every candidate creator's label in one call — through\n`api.network.fetch`, so the manifest's declared hostnames are what gates it\nand no page CSP has to carry a port.\n\nWikidata has no JustWatch property, and P8055, which the spec named as\nJustWatch, is the Amazon Prime Video ID. The link is built as `primeVideo`\nfrom that property's own formatter URL. All 14 class ids the spec lists were\nchecked against the live API and are correct.\n\nTests read 84 Wikidata responses recorded once by hand under\n`tests/unit/fixtures/lookups/`, keyed by request so the unit tests and the\ndesktop spec's local HTTP server share one tree. Nothing in the suite reaches\nWikidata.\n\nSpec: specs/to-tag-lookups.md\n","name":"spec/to-tag-lookups/f2a8b92773d057529ac176993ad31707b51e8689","oid":"b63502ab6010343a66865aabf8e44d1d8caef247"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-10-21T11:06:24.000000+02:00"},"message":"feat(connectory): follow event feeds and save new events as event:new items\n\nA new built-in feature checks items tagged `event:source` on an hourly\nschedule, reads each source as iCal or RSS/Atom, and saves each event it has\nnot seen before as an item tagged `event:new` carrying `metadata.event`. The\n`events` command opens the search window on `#event:new`.\n\n`events.js` holds every decision and is pure — no api, no window, no DOM — so a\npeeklet can later run it off the desktop: `parseICal()` unfolds lines and reads\nTZID, UTC and date-only starts plus escaped text; `eventsFromFeedEntries()`\nmaps plain feed entries to the same shape; `planNewEvents()` applies the\nidentity order (iCal UID, feed guid/id, link, title plus start), drops events\nalready over, projects a recurrence to its first occurrence still to come, and\nkeeps the newest 500 identities per source. `background.js` is the wiring, with\nthe only DOMParser use reducing an RSS/Atom body to entries before the pure\nlogic sees it.\n\n`metadata.event` names startDate, endDate and location the way\nfeatures/entities/extractors/structured-data.js names them for an `event`\nentity, so a later view over what is on reads both kinds with one shape.\n\nThe manifest declares `http://localhost:*` and `http://127.0.0.1:*` beside `*`\nbecause tile-csp.ts buildCSPForTile() turns network.domains into a connect-src\nlist where a bare `*` becomes `https://*` alone — without the loopback origins\nevery http source is blocked before the request leaves the tile, including a\ncalendar self-hosted on the same machine.\n\nTests: 41 unit tests over eight iCal fixtures, and a desktop spec serving an\n.ics and an Atom fixture from its own HTTP server that covers saving, a second\ncheck adding nothing, dismissal by removing `event:new` surviving a later\ncheck, and the `events` command's search window.\n","name":"spec/connectory-event-feeds/f2a8b92773d057529ac176993ad31707b51e8689","oid":"3ce7ab4b7fb6e46df87b7dca66055c27e59e15c6"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-10-21T06:46:32.000000+02:00"},"message":"research: keep or drop a page, with a one-line note\n\nA page's judgement is a tag on its URL item, `kept` or `dropped`, at most one at\na time, and the reason is that item's `metadata.notes` — the field the editor's\nURL rows already show. No tag means not yet judged. State is global to the URL\nitem, so it holds whether or not the page is in a space.\n\nThree commands act on the window in front: `keep [note]`, `drop [note]` and\n`unjudge`, which clears the state and leaves the note. A note replaces the\nexisting one; a keep or drop without a note leaves it alone. The Tags panel in\nthe page chrome gains a Keep and a Drop button, the one matching the page's\nstate shown as active, and clicking the active one clears the state. The chrome\noffers no note entry in this slice.\n\nEvery rule about which tag goes and which stays lives in\nrenderer/lib/page-state.js — `stateFromTags()` and `planPageState()` — which the\nfeature tile and the page chrome both call, so neither surface can drift from\nthe other. The commands live in the new lazy background tile\nfeatures/research/, registered synchronously in `init()` before any await so the\n`cmd:execute:*` publish that wakes the tile is not missed.\n\nFirst slice of docs/design/search-rounds.md; the research view, the seen-before\nline and rounds read what this writes. Peek item df3ffc86.\n","name":"spec/research-keep-drop/f6266c68ec843c54d1bd40bcf3175bd69034a9be","oid":"25bc440d114238ebe5634527cbf163e4b962506a"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-10-20T10:29:06.000000+02:00"},"message":"Tile APIs become Web Tiles protocols, starting with atproto\n\nA protocol is declared once in main/tile-protocols.ts with its name, the\ncapability that gates it and its methods. From that single declaration come\none IPC handler per method, the token and capability check on every call, and\nthe JavaScript module served at\npeek:///.well-known/web-tiles/.js, which a tile loads with a\ndynamic import. Every protocol module reaches the main process through one\ngeneric preload bridge, window.app.tileProtocol, because serving a module is\nnot the gate: any tile can call that bridge whatever modules it was served,\nso the check that matters happens per call.\n\natproto is the first API declared this way, and the features-manager publish\nwizard imports it instead of reading window.app.atproto. Both paths run the\nsame handler bodies and the same network gate; window.app.atproto and the\ntile:atproto:* channels stay while features/lex/atproto.js still uses them.\n\nA protocol whose capability the tile lacks is served nothing, and so is one\nthat does not exist, so a tile's import rejects identically either way and a\nrefusal is indistinguishable from an absent API. The legacy peek://ext/ host\ncarries no tile identity and is never served protocols; the live publish spec\nopens the wizard on its own host for that reason.\n\nThe tile manifest gains an optional protocols field mapping each name to\nrequired or optional. A tile that requires a protocol this host cannot give\nit is not opened, naming the protocol, through the same path that reports\nother manifest refusals.\n\nThe per-tile host-to-tile event queue has a named place in the registry and\nnothing in it: atproto pushes no events.\n\nDesign and the reasoning behind every choice: docs/design/tile-protocols.md.\n","name":"spec/tile-protocol-atproto/0968c12e5914a46cf260cedb7ff3ecfd4791ff78","oid":"05aff4da818a442aefad1b15dc83bf8c90d33d30"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-10-20T10:46:02.000000+02:00"},"message":"feat(reminders): a remind: tag brings an item back when it comes due\n\nTagging an item `remind:3d` asks for it back in three days. A manifest\nschedule publishes `reminders:check` every 5 minutes, and once at boot, which\nwakes the new lazy `reminders` background tile; when a reminder comes due the\nitem loses its duration tag, gains `remind:due`, and keeps\n`metadata.reminder` so `dueAt` stays visible. The `reminders` command opens\nthe search window on `#remind:due` through the search feature's own\n`cmd:execute:search` publish rather than a new list UI.\n\n`remind.js` holds every decision and is pure — no `api`, window or DOM — so\nthe job logic can run off the desktop. The clock starts when a check first\nsees the tag: tiles cannot read `item_tags.createdAt`, and a tag synced from\nanother device was not added here.\n\nItems whose reminder metadata must be dropped cannot be found by query —\n`ItemFilter` has no filter on `metadata` — so the ids with a started reminder\nare kept under the feature's `startedItemIds` setting and unioned with the\nids carrying a `remind:` tag on every check.\n\nThe `reminders` command sends the query under both `text` and `data.query`:\nthe search tile answers `cmd:execute:search` from two listeners that read\ndifferent keys, and its open guard drops whichever runs second, so a payload\nwith one key only opens a search window with no query.\n","name":"spec/remindme-tags/3d95aa669bb311eb060b0e5880d0edbceb318615","oid":"f856d0981dbac72662814671789f2e71df5fbccb"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-10-21T05:04:24.000000+02:00"},"message":"gate: lint test honesty over the whole tree, and fail on an empty scan\n\nThe desktop gate ran the test-honesty lint with --changed main, so a test that\nwas already dishonest never blocked it. All the honesty slices have landed and\na full-tree run is clean, so the gate now lints every unit test.\nlint:test-honesty:changed keeps the changed-only form for inner-loop use.\n\nThe lint also treated a missing scan root as nothing to do: run from\napps/desktop, its default roots resolved to nothing and it printed the success\nline having checked zero files. collectAllTestFiles() now exits 2 naming each\nroot that is missing or holds no test file, and prints the directory the roots\nwere resolved against. The check runs before the changed-only / full-scan\nbranch, so neither mode can pass by scanning nothing.\n","name":"spec/honesty-lint-full-tree/039571494140afd821cf8a7af78ede15ae6c2490","oid":"7360fb73b820bed6bdf67d03a2c9ecbbd18c30ed"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-10-20T10:44:01.000000+02:00"},"message":"specs: honesty-groups-and-item-actions points both tests at real code\n\n`features/groups/group-logic.js` is new: the groups feature's decisions with no\nDOM — URL normalisation and dedupe, tag metadata, filtering, sorting, pins, the\nactive-group record, suspend/restore/switch, and the command-palette listing.\n`features/groups/home.js` imports all 18 exports back and supplies its own\nstate, so each rule has exactly one definition. The two `let activeGroupId` /\n`activeGroupName` bindings became one `groupState` object, passed with\n`suspendedGroups` and `api` through `groupDeps`, so the functions that mutate\nthat state can live outside the renderer.\n\n`tests/unit/groups-quick-wins.test.js` is rewritten against that module.\n`tests/unit/peek-item-actions.test.js` is replaced by\n`tests/components/peek-item-actions.spec.ts`, which renders the real element:\nthe component's only state-free fragments are three expressions inside\n`render()` interleaved with Lit templates, so exporting them would have covered\ntwo expressions and left the button gating, the click-does-not-reach-the-card\nbehaviour, the null-item early return and the event flags asserted against\nnothing. The new spec covers all of those.\n\n`tests/unit/url-item-lookup-callers.test.js` has its `normalizeUrlForCompare`\nsource slice repointed at `group-logic.js`, where that definition now lives.\n\nProduct behaviour is unchanged. Cases that only passed because the inline copy\ndiffered now follow the shipped code:\n\n- `resolveCurrentGroup` — the copy read mode `'space'` with `metadata.spaceId`;\n the real one reads `'group'` with `metadata.groupId`, which is what the groups\n UI sets.\n- `closeGroup` — the copy returned `newActiveGroupId` / `newActiveGroupName`;\n the real one clears the active-group record in place.\n- `closeGroup` — the copy had no error handling around the snapshot save or the\n per-window hide; the real one swallows both. Two cases added.\n- `restoreGroup` — the copy returned `fallbackToOpen` and a `reason`; the real\n one calls `openGroup(groupName)` and returns its result.\n- `restoreGroup` — the copy returned the active-group fields; the real one sets\n them in place. A case added for a partial restore with no name to re-open with.\n- `sortGroups` / `sortAddresses` — the copies sorted a duplicate; the real ones\n sort in place and return the same array, which the render path relies on.\n- `filterGroups` / `filterAddresses` — the copies took the search text as a\n parameter while the real ones read module state. Same logic, now parameterised.\n- `highlightActiveGroup` — the real code skips the \"(active)\" suffix when the\n active group is already first; that case is kept against the real function.\n\nDeleted for want of a real counterpart:\n\n- `showAddresses does not set mode` (2 cases) asserted the opposite of the\n shipped `showAddresses`, which does call `api.context.setMode('group', …)` for\n a real group.\n- `suspended groups tracking` (4 cases) exercised a bare `Map`.\n- `managePins.sortPinnedFirst` (3 cases) matched neither real sort; equivalent\n pin-first cases now run against `annotatePinnedFirst`.\n- `managePins.add` / `.remove` returned new arrays; rewritten against\n `addPinnedId` / `removePinnedId`, which mutate the pin list and report whether\n it changed so the caller only persists on a change.\n\nVerified: `scripts/lint-test-honesty.mjs` clean (was exit 1 naming both files);\ndesktop build green; node unit 1525 pass / 0 fail; Playwright components 90 pass\n/ 0 fail (19 new); `test:grep \"group\"` 15 pass / 2 skip / 0 fail, identical to\nthe pre-change run on this branch.\n","name":"spec/honesty-groups-and-item-actions/039571494140afd821cf8a7af78ede15ae6c2490","oid":"80ab00f48faf838b01924be98acd0771fe7c30c7"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-10-20T09:37:55.000000+02:00"},"message":"specs: peeklet-schedule-wake, a manifest schedule that wakes a sleeping feature\n\nA tile entry may declare `schedule: [{ topic, everyMinutes }]`. One timer per\nentry lives in main (tile-schedule.ts), so a feature stays asleep between runs\ninstead of holding its own interval. When an entry comes due main publishes the\ntopic with `{ scheduledAt, lastRunAt }`; schedule topics join the lazyEvents\npredicate set in tile-lazy.ts, so the existing load-on-dispatch hook wakes the\nowning tile and delivers the publish to its handler. A tile already awake just\nreceives it.\n\nTimers arm in tile-arm.ts armLazyTile and clear in disarmLazyTile, so disabling\na feature stops its schedule; a schedule now counts as a wake trigger in\nisLazyTileManifest. Nothing fires until main.ts loadFeatures() calls\nstartTileSchedules(), once the loader has registered every tile.\n\nEach fire is persisted in the new tile_schedule_runs table, so a restart does\nnot reset the interval. An entry that has never fired, or is overdue by any\nnumber of intervals, fires once at arming; one that ran recently waits out the\nremainder.\n\nfeatures/feeds is the first user: its background entry declares `feeds:poll`\nevery 15 minutes and its background.js drops the setInterval and the 5 s first\npoll for a synchronous subscribe. Before this, feeds polled only after someone\nran a feeds command in that session.\n\nVerify: build clean; main-process unit 4399 tests, fail 0; node unit 1338 tests,\nfail 0; test:grep \"feeds|lazy-wake|lazy wake|lazyEvents|features-toggle\" 20\ncollected, 20 passed on two of three runs. The one failure,\nfeatures-toggle-lazy-rearm \"second disable/enable cycle is clean and\nidempotent\", passes in isolation and concerns the windows feature, which\ndeclares no schedule.\n","name":"spec/peeklet-schedule-wake/48210abe7daf51e5406d388f349622ae77992143","oid":"c71d95afe8170f24ecfd8d3be0fd58471fdb6a83"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-10-20T09:30:06.000000+02:00"},"message":"specs: honesty-mode-and-navigation-tests points mode tests at real code\n\nThree main-process tests asserted against inline copies of logic about window\nmodes and URL comparison. 41 cases now exercise the shipping module; 143 tested\na copy with no counterpart in the tree and are deleted.\n\nnormalizeUrlForCompare moves out of renderer/page/overlay.js into the new pure\nrenderer/page/url-compare.js (body verbatim), which overlay.js imports back.\ndatastore.ts updateModeForNavigation is deleted: it had no callers, and a\nwindow's mode is written once when the window opens (ipc.ts,\ninheritedModeForNewWindow, else detectModeFromUrl) and never rewritten.\n\nPointed at real code:\n\n- normalizeUrlForCompare — 18 cases from page-navigation.test.ts move to\n tests/unit/url-compare.test.js against renderer/page/url-compare.js. The copy\n was identical to the real function, so no case changed.\n- isSpaceTag (9), getSpaceDisplayName (7), toSpaceTagName (3) — 19 cases move\n from space-mode.test.ts to tests/unit/space-mode.test.js against\n features/spaces/config.js. The copies matched; no case changed.\n- detectModeFromUrl — 4 cases stay in main/space-mode.test.ts, now importing\n main/datastore.ts instead of a copy. The copy matched; no case changed.\n\nDeleted, by the copied function they tested:\n\n- shouldHandleNavKey (page-navigation.test.ts, 70 cases: 9 basic key mapping,\n 8 non-nav keys, 3 INPUT guard, 2 TEXTAREA guard, 2 contentEditable guard,\n 3 navbar guard, 3 widget-container guard, 40 nav-keys-pass-through). The\n renderer/page/page.js keydown listener it was extracted from was deleted in\n 2b14032d with the canvas renderer. The live pagestream listener\n (features/pagestream/home.js handleKeydown) has no input guard and no\n key-to-action table, so there is nothing to point the cases at.\n page-navigation.test.ts is deleted with the last case.\n- shouldPreserveMode (space-mode.test.ts, 5 cases). It restated the dead\n datastore.ts updateModeForNavigation, which is deleted here. The copy also\n differed: it modelled only space mode and counted a detected `default` as\n preserved, where the real function covered space and group and only treated a\n detected `page` as overridable.\n- shouldAutoTagForSpace (space-mode.test.ts, 5 cases). No such function exists.\n The real auto-tag decision is inline in features/spaces/background.js\n handleItemCreated, which reads window context and writes a tag through\n api.context / api.datastore / api.pubsub, so it cannot be lifted as a pure\n function without changing behaviour.\n- shouldShowSpaceBorder (space-mode.test.ts, 9 cases) and the\n resolveSpaceBorderColor copy it called. No function of either shape exists.\n Border visibility is decided by the impure background.js\n updateBorderVisibility(), which reads module-level appFocused and calls\n config.js shouldShowBorder(appFocused, isSpace) — a two-boolean predicate\n already covered by tests/unit/spaces-config.test.js. The colour comes from\n config.js resolveVividColor, which takes a theme id and selects from\n THEME_PALETTES rather than hashing into one fixed palette, and is likewise\n already covered there.\n- resolveGroupBorderColor (group-mode.test.ts, 10 cases). Same real counterpart\n and same difference as resolveSpaceBorderColor above.\n- shouldAutoTagForGroup (group-mode.test.ts, 8 cases). No such function exists\n in main/, and no pure group equivalent exists anywhere.\n- shouldInheritGroupMode (group-mode.test.ts, 8 cases). The real counterpart is\n main/ipc.ts inheritedModeForNewWindow, which is not exported and so not\n importable; ipc.ts is outside this spec's scope. The copy also differed: it\n had an explicit-group-option branch the real function does not have, and\n recorded inheritedFrom: 'opener' where the real one records the opener's\n numeric window id.\n- shouldResetGroupOnTagRemoval (group-mode.test.ts, 10 cases) plus the 2\n shouldShowGroupBorder integration cases that called it. The real counterpart\n is the impure background.js handleTagRemoved (the tag:item-removed\n subscription). It also behaves differently: it compares URLs with\n background.js normalizeUrl, which does not sort query parameters, and it sets\n mode to `page`, not `default` — so the copy's two query-param-order cases\n asserted a match the product does not make.\n- shouldShowGroupBorder (group-mode.test.ts, 16 cases in the focus-based border\n suite). Same real counterpart and same difference as shouldShowSpaceBorder.\n group-mode.test.ts is deleted with the last case.\n\nfeatures/spaces/space-logic.js is not created: none of the three functions the\nspec earmarked for it exists in background.js in a liftable form, as recorded\nabove.\n\nThe comment in tests/desktop/spaces-window-locking.spec.ts that credited\nupdateModeForNavigation with protecting workspace membership now describes mode\nas written once at window open.\n\nVerify: lint-test-honesty no longer flags any of the three (it still exits 1 on\nthe six files belonging to other slices); main-process runner 4205 tests, fail\n0; node unit runner 1375 tests, fail 0; hybrid-overlay.spec 51 passed, which\nexercises the new overlay.js import at runtime.\n","name":"spec/honesty-mode-and-navigation-tests/0644c167ba9a10462d51e399e2b21bd02854118a","oid":"9016f26c02eb6f61f18ffe50ba40e898c83988f8"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-10-20T09:39:00.000000+02:00"},"message":"test: point the cmd-panel, note-command and file-formatter tests at real code\n\n`main/cmd-chain.test.ts` and `main/cmd-logic.test.ts` reimplemented their\nsubjects inline, so a regression in the shipping code could not fail them.\nBoth are rewritten as `tests/unit/cmd-chain.test.js` and\n`tests/unit/cmd-logic.test.js` importing the real modules.\n\nPure helpers extracted so a node test can reach them, bodies unchanged:\n\n- `renderer/cmd/panel-logic.js` (new) takes `mimeTypeMatches`,\n `findChainingCommands`, `buildExecutionContext`, `updateAdaptiveFeedback`,\n `getAdaptiveScore` and `getFrecencyScore` out of `renderer/cmd/panel.js`,\n plus `getTabCycleIndex` for the Tab-cycle index arithmetic that was\n duplicated in four action handlers. Panel state each one read is now a\n parameter; `panel.js` imports them back and passes it. The panel keeps thin\n wrappers where a caller needs the DOM, the machine state or persistence:\n `updateAdaptiveFeedback` still logs and saves, `executionContextFor` reads\n the input element, `chainingCommandsFor` passes the command registry.\n- `renderer/lib/note-tags.js` gains `parseTagset` and `detectType` from\n `renderer/cmd/commands/note.js`, which imports them back.\n- `features/files/formatters.js` (new) takes `jsonToCsv` and the markdown\n formatter out of `features/files/background.js`. The formatter had no name —\n it was inline in the `markdown` command's `execute` — and is now\n `formatAsMarkdown(input, inputTitle)` returning `{ markdown, docTitle }`.\n\nProduct behaviour is unchanged. `main/tile-preload.cts` is not touched.\n\nCases changed because the copy behaved differently from the real code:\n\n- `buildExecutionContext`: the copy took a `chainMode` flag and returned only\n `typed`/`name`/`params`/`search`. The real one also returns the live input\n field's `value`, matches the command name case-insensitively, and strips a\n partially typed name off the parameters. Cases restated against that, three\n added for the behaviours the copy could not express.\n- `updateAdaptiveFeedback` and `getAdaptiveScore`: the copy added 1 to every\n character prefix of the typed text and scored a command's share of the total.\n The real one decays existing weights by 0.95 and prunes below 0.1, credits\n sub-prefixes of each word of the command name 0.25 while skipping a word the\n typed text is already a prefix of, and scores `w / (w + 3)`. Five cases\n restated; two added for the prune and the saturation.\n- The markdown formatter cases destructure `{ markdown }`, since the extracted\n function also reports the document title the command uses as its output title.\n\nCases deleted, grouped by the copied function they tested:\n\n- `isTextMimeType` (5): no counterpart. The nearest real logic is the prefix\n table in `panel.js getDefaultPopupForMime()` and the `type === 'text'` branch\n inside `getRenderer()`; neither is a separable pure computation.\n- chain state tracking (3): asserted on an array the test itself built. The\n real push/pop is in `panel.js doEnterChainMode()`/`doChainUndo()`,\n interleaved with DOM updates.\n- `extractInlineHashtags` (5): `note.js` does no inline-hashtag extraction —\n only trailing tags, via `splitTrailingTags`. Mid-text hashtags are extracted\n by the datastore layer.\n- `getEscAction` (6): no counterpart. The Esc peel order is transition-table\n data in `cmd/state-machine.js`, selected by the `resultsVisible` and\n `textNonEmpty` guards, not a function.\n- `shouldBlockDrag` (10): the real one lives in the drag IIFE of\n `main/tile-preload.cts`, a sandboxed preload that may only\n `require('electron')`, so it cannot import a helper module.\n\nThe \"Settings command -- pane list integrity\" block no longer copies\n`SETTINGS_PANES`. It reads the list out of `renderer/index.js` and the\n`section-` ids out of `renderer/settings/settings.js`, and checks both\ndirections: a pane with no section, and a section no pane opens. `devices` is\ndeclared as a section deliberately not offered as a pane.\n","name":"spec/honesty-cmd-tests/039571494140afd821cf8a7af78ede15ae6c2490","oid":"11bded5902cce7a2f68e336db1ed796b22c9c0a8"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-10-20T09:31:15.000000+02:00"},"message":"specs: honesty-closed-window-stack moves the stack into closed-window-stack.ts\n\nThe reopen-closed-window stack now lives in a pure `main/closed-window-stack.ts`:\nthe LIFO store, the 50-entry cap, and `createClosedWindowEntry`, which decides\nwhether a window that just closed is worth remembering and builds its entry.\n`main.ts` imports them back and keeps what needs Electron and the database — the\n`feature_settings` persistence, the debug logging, the quit-time push\nsuppression, and the context/nav-history reads it feeds in.\n\n`main/closed-window.test.ts` drops its inline copies of `pushClosedWindow`,\n`popClosedWindow` and the entry builder and imports the real ones. Product\nbehaviour is unchanged.\n\nTwo differences between the copy and the shipped code, now that the cases run\nagainst the real function:\n\n- The copy typed the `mode` context entry's `value` as `string`; the real\n `ContextEntry` (datastore.ts) types it `unknown`. The parameter type follows\n the real one. The `=== 'space'` comparison is unaffected.\n- The copy had no back/forward trail at all. The shipped builder spreads\n `navHistory`/`navHistoryIndex` onto the entry when the window had a trail, and\n writes neither key when it did not. Two cases cover that branch.\n\nVerified: `yarn workspace @peek/desktop build` clean; main-process unit runners\n4387 tests / fail 0 / skip 1 (was 4385 / fail 0 / skip 1 before, +2 new trail\ncases); `closed-window.test.js` alone 39 pass / fail 0.\n","name":"spec/honesty-closed-window-stack/039571494140afd821cf8a7af78ede15ae6c2490","oid":"e1e22aaa5409f7a31a1a71851296102e86228996"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-10-20T09:50:39.000000+02:00"},"message":"tests: point tag-affordance and editor outline/preview tests at real modules\n\nBoth files tested inline copies and imported nothing from the product, so\nscripts/lint-test-honesty.mjs flagged them. They now import the shipping code.\n\napps/desktop/main/tag-action-affordances.test.ts is replaced by\napps/desktop/tests/unit/tag-action-affordances.test.js, which imports\nresolveAffordances and findAffordanceByKey from\nrenderer/lib/tag-action-affordances.js. The real rule shape differs from the\ncopy's, so the cases are rewritten rather than retargeted: a rule carries\nscriptId, config and display instead of triggerTag, actionType and actionConfig.\n\nBehaviour the copy had and the shipping module does not, so these cases are\ndeleted rather than rewritten (the shipped code is presumed correct):\n\n- An `icon` affordance type. The copy resolved actionType 'icon' into an icon\n descriptor; the module recognises only scriptId 'tag-swap' and emits only\n toggles. Three cases go (icon match, icon non-match, icon config defaults),\n replaced by one case asserting a non-tag-swap scriptId resolves to nothing.\n- A fallback from a missing config.activeTag to the rule's triggerTag. The\n module has no triggerTag concept and skips a rule missing either tag of the\n pair. The fallback case becomes a skip case.\n- A toggle label taken from the rule's name. The module always labels a toggle\n activeTag/completedTag. Asserted as the real behaviour, with a case proving a\n rule-level name does not override it.\n\nThe module also carries two things the copy did not, now covered: the\ndescriptor's rule id field is ruleId, and a single-character display.key is\ncarried onto the affordance (null for a multi-character or absent key).\nfindAffordanceByKey gains its own cases.\n\napps/desktop/tests/unit/editor-outline-preview.test.js drops its copies of\nparseHeaders, renderMarkdown and the highlight serialisers and imports\nfeatures/editor/outline-sidebar.js, preview-sidebar.js and highlights.js. No\nstub is needed: @codemirror/language, @codemirror/state and @codemirror/view all\nload under plain node with no DOM. The copies were textually identical to the\nproduct, so every case survives unchanged and the count is unmoved at 86.\n\npreview-sidebar.js gains one export: resolveImgSrc, which the file kept private\nand the test exercises directly in 20 cases. No other product change.\n\nCounts after the change: main-process unit 4370 pass / 0 fail, node unit 1359\npass / 0 fail. The main-process runner loses the deleted file's 15 cases and the\nnode runner gains the new file's 21; the editor file is measured at 86 both\nbefore and after.\n","name":"spec/honesty-retarget-affordances-editor/039571494140afd821cf8a7af78ede15ae6c2490","oid":"231baddfa835f12ecf83b1326a5123b8f38ee644"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-10-20T09:31:44.000000+02:00"},"message":"test(gate): settle three of the four Linux failures at 48210abe, record the run\n\nThe 2026-10-19 Linux gate failed seven tests, none of them in\napps/desktop/tests/gate-baseline.md. Three are intermittent and pass alone.\n\nThe spaces-delete confirmation now asserts the count names the one window that\nmoves; the space's own peek://spaces/home.html is spaces chrome and never\ncounts (features/spaces/config.js SPACES_CHROME_URL_PREFIXES). A unit suite\ncovers the chrome-only count and the one-real-page count straight off\ncountSpaceWindows and liveSpaceWindowIds.\n\ntransient-on-blur.spec.ts waitForHidden() passes includeHidden: true, so the\nlist it polls carries app chrome. Without it a chrome window is absent from the\nlist whatever its state, which reads as hidden and passes before anything hid\nthe window.\n\npage-translate-front-window.spec.ts stays failing and is untouched. A logged run\ncontradicts the suspected cause: page-overlay:active does name the target window\nwhen the test bridge's setActive is called, and 126 ms later the just-activated\npage host is hidden unasked, the other host returns, and the chrome detaches\nwith no active window. That is product behaviour, so it is recorded rather than\nworked around (Peek 57895545). The evidence and what it rules out are in the new\nbaseline section; the owner of that hide is unresolved and needs an op-source\nfield on the hide effect's [wm] line.\n\nmodal-self-close-on-blur.spec.ts stays failing as the known open defect Peek\n3bb9b6ab.\n","name":"spec/gate-1019-stale-specs/baf7336be45195964890f74feefce6871ea0d72e","oid":"337c5cbb8961e9602150846736eb5727d49b2e31"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-10-20T10:13:36.000000+02:00"},"message":"fix(entities): name a coordinate-only map place \"Location , \"\n\nA bare coordinate name such as \"52.3731, 4.8922\" is dropped by the entity\nmatcher as all-numeric, so an OpenStreetMap or Bing link without a name stored\nnothing. The map extractor now names such a place \"Location 52.37, 4.89\"\n(each coordinate rounded to 2 decimals); the full-precision coordinates stay in\nthe place's attributes.\n","name":"spec/peeklet-map-places/48210abe7daf51e5406d388f349622ae77992143","oid":"911a765020178bbc8a5a24b2af87468ac6e6ae34"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-10-19T10:57:44.000000+02:00"},"message":"feat(security): refuse a webContents with unsafe preferences in every build\n\nAn isolation violation was previously only logged in a release build, and the\ndevelopment-build throw left the offending window running too, since an\nuncaught exception inside an Electron event closes nothing. A violating\nwebContents is now refused outright, production included: window.open from it\nis denied, will-navigate, will-redirect and did-start-navigation are all\nblocked so no content ever loads in it, and its owning window is torn down.\nA refusal contains one window and never exits the app, unlike the sandbox\ncheck it sits beside.\n\nThe owning window is torn down on the first did-start-navigation, deferred to\nthe end of that turn of the loop. Creation is too early to know the owner --\na hybrid content view is created before registerHybridWindow -- and\ndestroying a window either from inside its own constructor or from inside its\nnavigation callback kills the whole browser process. Preferences unreadable\nat creation are re-read at that same navigation, before it commits, the shape\nsandbox-enforcement.ts already uses.\n\nTwo checks sit earlier than the created webContents: a window-open request\ncarrying nodeIntegration, contextIsolation, webSecurity or sandbox overrides\nis refused with an error before any window is built, and a attach\nwhose resulting preferences violate the policy is prevented. The decisions are\npure functions in web-contents-policy.ts; entry.ts and ipc.ts act on them.\n\nTests: the policy module gains the verdict, log-line and override-check\nsuites; no-raw-browserwindow.spec.ts keeps its three tests and gains a\nprovoked violation, the refused window-open override, and one per window-open\npath -- tile window, direct BrowserWindow branch, page host, popup from a page\nhost, chrome-extension window -- each asserting the resulting webContents is\nisolated, sandboxed and registered with the window system.\n","name":"spec/web-contents-refuse-unsafe/d48016f315660ecd0ce645d736f8cc917000761e","oid":"fb529474eb7db091476c43edb8eef82ad25ed57a"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-10-19T10:44:03.000000+02:00"},"message":"Every switcher card gets a close button that ends the window\n\nPressing a card's close button is an explicit request to end that window, so\nit closes for good — including a keepLive window, which an ordinary close\nanswers by hiding. Hiding there would only move the window out of the default\nlist, leaving the press looking like it did nothing.\n\nThe intention travels as a `force` option: `api.window.close(id, {force:true})`\nthrough `tile:window:close` and `closeOrHideWindow()` into the kernel's\n`CloseOrHideWindow` command, where it overrides the keepLive branch. It names\none window and reaches only that one — a cascaded descendant keeps its own\nkeepLive — and it does not override the app-lifetime refusal. Without the\noption nothing changes, and the capability check is the same either way.\n\nOnly windows the default list shows get a button: a card the hidden-windows\ntoggle reveals for the page-host overlay, a panel or a space marker has none,\nsince ending one of those is not a user action. In the fit view the header\noverlay is deliberately pointer-transparent so the whole card stays one target\nfor picking a window; the close button re-enables pointer events on itself.\n","name":"spec/windows-view-card-close/efd91598269dd086ed17008b3bc2273a1ff51b24","oid":"fb21c371a126504bfdad1becfa4cb659e1dc2a22"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-10-19T09:39:39.000000+02:00"},"message":"fix(mobile): the adb shim path keeps a separator when TMPDIR is unset\n\nsetup-adb-shim.sh built \"${TMPDIR:-/tmp}peek-android-shim\", which resolves to\n/tmppeek-android-shim wherever TMPDIR has no trailing slash — minimal shells,\nCI containers, test runners. macOS always sets a trailing slash, hiding it.\n\nThe base now has one trailing slash stripped and /peek-android-shim appended,\nso a trailing-slash TMPDIR still yields a clean single-slash path.\n\nspec: specs/mobile-adb-shim-path.md (peek a8ca2b89)\n","name":"spec/mobile-adb-shim-path/a1bba880fbbfcf8126371b1db4770ba932579d9a","oid":"6ea0d765c0f34de7efe9ded38fc587d59a04933a"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-10-19T11:03:45.000000+02:00"},"message":"Docs: re-bucket the atproto verification plan as historical, fix path drift\n\nThe plan is executed, so it is not a live proposal. atproto-source.ts\nresolveInternal() calls atproto-verify.ts fetchAndVerifyRecord()\nunconditionally with no unverified fallback; atproto-verify.ts carries the\nplan's named layout plus its Phase 2 PLC audit-log walk (buildKeyEpochs,\nselectKeyAtTime), covered by 23 tests in atproto-verify.test.ts. The one\noption the plan left open -- whether icons and screenshots belong in the\nlexicon -- was settled by taking it: space.peek.feature.release.json declares\nicon and screenshots, and peek://feature-blob/ serves them CID-verified. The\ndoc moves to docs/historical/ with its note line and leaves the index's\n\"Designs not yet built\" section.\n\nFive paths in docs/mobile.md and docs/profiles.md gain their repo-relative\nprefix or point at a file that exists: three src/App.tsx sites become\napps/mobile/src/App.tsx, the iOS App Groups entitlement is\npeek-save_iOS.entitlements rather than the removed tauri-app_iOS spelling,\nand the share-extension example lives under apps/mobile/.\n","name":"spec/docs-sweep/12a5fb368b21645dc6e5b91ac49a5598861df38f","oid":"b32fbdd98c501f2ece00fa4db01333a0dabe513b"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-10-13T11:39:33.000000+02:00"},"message":"Specs: correct seven claims in docs/features.md\n\nReview round 1 found one false claim and six imprecisions in the rewrite.\nAll were rechecked against the code before editing; two of the reported\nitems were themselves wrong and are left alone.\n\n- The undeclared-subscribe gotcha said it fails silently at runtime.\n Nothing filters subscribes at runtime: tile-ipc.ts tile:pubsub:subscribe\n does no allowlist check and the main.ts broadcaster delivers\n pubsub: to every tile window. manifest-subscribe-drift.test.ts is\n the whole enforcement. Silent runtime dropping is true of publishes only.\n- syncManifestRules is defined in rules.ts; feature-startup.ts calls it.\n- The drift test collects .js, .cjs and .mjs, not .js alone.\n- The todo/background.html block is a condensed sketch, not verbatim; it is\n labelled as one and names what the real file carries on top.\n- tiles[] keys now say where each is read: resident in tile-arm.ts, lazy in\n tile-lazy.ts, lazyEvents in three modules, keepLive handed to the window\n machine. keepLive IS read in createTileBrowserWindow, contrary to the\n review note.\n- capabilities.settingsForeign added; the table is the typo checklist, and\n both validateTileManifest() and resolveCapabilities() handle that key.\n- detectManifestVersion is stated as its three real steps, so\n manifestVersion: 2 short-circuiting to legacy before the tiles +\n capabilities sniff is no longer blurred.\n\nAlso corrected outside the review list: tiles[].key is destructured into\nthe window hints and never read again. Collapsing repeat opens onto one\nwindow is driven by the key passed to app.window.open in ipc.ts.\n","name":"spec/docs-features-rewrite/12a5fb368b21645dc6e5b91ac49a5598861df38f","oid":"5ea55e4f3ecf88c5577b010e736a4e75e49fbd86"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-10-13T07:15:48.000000+02:00"},"message":"Session restore keeps each page-host window's back/forward trail\n\nA relaunch reopened every page-host with a plain load of its leaf URL, so Back\nwas dead in a window the user had walked several pages into.\n\nThe snapshot now carries the trail per window. serializeSession writes\nnavHistory and navHistoryIndex onto the descriptor, after context and only when\nthere is a trail — spread rather than assigned, because an explicit undefined\nkey would change the descriptor's shape even though JSON.stringify drops the\nvalue, and the on-disk shape is pinned byte-for-byte against an oracle.\n\nThe trail comes from the per-window cache in nav-history.ts, never from a live\nwebContents read. A window restored beyond the eager count has not navigated\nyet and reports no entries at all, so a live read would erase the trail it is\nstill waiting to replay on every later save. Because the cache is kept current\nby the content webContents' own navigation events, the existing before-quit,\nautosave, window-lifecycle and manual saves all carry the trail with no new\nsave trigger.\n\nRestore hands the trail to the open as an open-time directive, the same route\nundo-close already used, so the eager path replays it through loadHybridContent\nand the deferred path seeds it into the cache. A deferred window's first\nactivation now goes through loadHybridContent too, with the seeded trail, so it\ncomes back with its history rather than just its leaf page. openHeldGroup opens\nfrom the same descriptors and gets the same directive.\n\nA before-quit save pushes the trail onto the closed-window stack with the\ndescriptor, so undo-close after a quit keeps it as well. A descriptor with\nneither key — every snapshot written before the fields existed, and every window\nthat never navigated — restores at its leaf URL exactly as before.\n\nA trail is local machine state: the session and snapshot feature_settings rows\nit persists into are not read by sync.ts, and it must not leave the device.\n\nTests: four session-projection.test.ts cases pinning both halves of the on-disk\npromise (both keys written with the given entries and index, in that order\nafter context; neither key present without a trail, including in the serialized\ntext), with the existing byte-identical sweep passing unmodified. New\napps/desktop/tests/desktop/session-restore-nav-history.spec.ts covers an eager\nA/B/C restore walked back through Back, a deferred window saved a second time\nwhile un-navigated and then activated — the case that loses history to a live\nread at save time — and a descriptor with no trail landing on its leaf URL.\n","name":"spec/session-restore-nav-history/19ea16a1eeea4351f6d34cd86c209871ba349e87","oid":"bc4567a4169dc9d29e7f178a1a7a0512c7fe67c6"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-10-13T11:07:39.000000+02:00"},"message":"feat(peeks,slides): open at a size relative to the display when none is set\n\nA peek or slide with no remembered resize and no size in Options sent 1024x768\nwhatever the display. It now sends a pair of work-area fractions instead, and\nmain resolves them against the display the window actually lands on: a peek\ntakes 0.60 x 0.80 of the work area, a slide 0.35 x 0.90 with an 800 px floor on\nthe width so a page in a slide stays above the usual mobile breakpoint.\n\nPrecedence at open is unchanged at the top: a remembered resize that still\napplies, then an Options width/height, then the display-relative size. A row\ncarrying exactly 1024x768 counts as no size set, because nearly every saved\nprofile still holds the value every item used to ship with; rows are not\nrewritten, so resize memory compares against the same numbers as before.\n\ncomputeInitialBounds now takes either a pixel size or fractions, resolving the\nlatter after it has picked the target display. The existing clamp to the work\narea runs last, so the slide width floor can never push a window wider than the\ndisplay it opens on.\n\nBoth feature config files and both settings-schema.json files drop the size from\ntheir defaults: the Options form and the settings defaults read only the JSON,\nwhile each feature's background script reads only config.js.\n","name":"spec/peek-slide-relative-size/fbc0000e70b093c8d5739fb30fa9c2c297bf35a2","oid":"d00665dd8ff76f5c091e949abe15ffa7b0ebaad3"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-10-13T11:12:45.000000+02:00"},"message":"feat(windows): the switcher opens with its search box focused\n\nOpening the window switcher left the caret nowhere, so filtering the\nlist needed a click first. `windows.js init()` now focuses the search\ninput right after its first render, which covers every entry point\nbecause each one opens the view the same way.\n\n`handleKeydown()` is unchanged: with the input focused it already lets\nletters through to the search and keeps ArrowUp, ArrowDown and Enter\ndriving the card list, so hjkl now type instead of moving the selection\nand arrows plus Enter still navigate and activate.\n\nNew `switcher-search-autofocus.spec.ts` covers the focused element after\nopen, typing filtering the list with no click, and ArrowDown then Enter\nstill activating a card. All three fail without the focus call.\n","name":"spec/switcher-search-autofocus/fbc0000e70b093c8d5739fb30fa9c2c297bf35a2","oid":"b112a040c6a8494e61ede7e4dbfd66e32e99b4af"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-10-13T10:25:12.000000+02:00"},"message":"Closing one of two windows on a tile entry keeps the other registered\n\nThe tile window registry held one BrowserWindow per `tileId:entryId`, last\nwrite wins, so a second `api.window.open` on the same entry overwrote the\nfirst and the FIRST close tore the whole entry down: `getTileWindow` went\nnull, `isTileLoaded` went false, the lifecycle record dropped to\n`registered`, and `unsubscribeAll` removed the survivor's subscriptions\n(pubsub keys them by source address, which both windows share).\n\nThe registry now holds a list of live windows per key in open order.\n`getTileWindow` returns the most recently opened one and `isTileLoaded` is\ntrue while any remain, so keyed lookups answer exactly as before.\n\nThe cleanup the three close handlers duplicated is now one exported\n`releaseTileWindow(tileId, entryId, win, reason, crashDetails?)`. Per-window\nwork always runs; per-entry work — the ready flag, the entry's pubsub\nsubscriptions, and the lifecycle transitions — runs only when no other window\nis registered for the key. It returns whether that per-entry teardown ran.\n\nThe gate is \"no OTHER window is registered\", not \"this window is still\nregistered and is the only one\", because `unloadTile` and `unloadAllTiles`\nde-register eagerly so callers see `isTileLoaded()` false at once. The real\n`closed` event therefore arrives with the window already off the list, and\nthat close is still what drives the entry's lifecycle home. Under the strict\nreading the entry stranded in `ready`, which has no LOAD edge, so a disabled\nfeature could never be re-enabled.\n\n`shutdownTile` signals and closes every live window for the key over one\nshared grace period rather than only the latest, so siblings still run their\n`api.onShutdown()` callbacks. `unloadTile` drops every window for the key.\n`relaunchTile` dedupes through `getTileWindow`.\n\nA crash of one window while a sibling is live does per-window cleanup only:\nno RENDER_GONE, since the entry is still running. The `tile:crashed` publish\nstill fires — it reports that window's crash, not the entry's death.\n","name":"spec/tile-window-sibling-close/1342418dc1f48359394ae956a87611d29c699a2b","oid":"52ae3e362b70a008bcf9843b821a6bb1318f3e6e"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-10-02T07:44:47.000000+02:00"},"message":"Swap the todo verbs so complete marks and done lists\n\nThe todo feature had `done ` doing the marking, which reads backwards:\na verb naming a finished state should show finished things. The two roles now\nmatch their names.\n\n- `complete ` marks an outstanding todo done. This is the former\n `handleDone` body unchanged -- same picker, same match rules, same todo->done\n tag swap, same `completed` item event, same `todo:done` publish -- renamed to\n `handleComplete` and reached by a new `cmd:execute:complete` subscriber. Only\n its usage string changed, to `Usage: complete `.\n- `done` is now a read-only list of `done`-tagged items, newest first, in the\n same `mimeType: 'item'` shape `todos` returns, so Enter on a row opens the\n item in the editor. An empty list says there are no done todos yet.\n- `todosListResult` takes an optional second argument carrying the heading noun\n and the empty-list message, so both list commands share one helper. The\n defaults describe the outstanding todos `todos` lists, leaving its call and\n its assertions unchanged.\n- `pickDoneTarget` is renamed `pickCompleteTarget` to follow the command it\n serves.\n\nThe manifest declares four commands -- the match param moved off `done` onto\n`complete` -- and lists `cmd:execute:complete` beside `cmd:execute:done`. The\nfeature is enabled, so `done ` stops marking items done with this change.\nThe README describes the four commands.\n\nThe stored tag name `done` is untouched, so existing data needs no migration.\n\nTyping the commands into a live panel is not covered by any automated test;\nonly the pure helpers in `todo-items.js` are unit-tested.\n","name":"spec/todo-verb-rename/3cb77f866fa45f44e080e8f67784f4847b400781","oid":"be0b21cd211d27b95714003055ca701fa2cdfe6d"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-10-02T05:14:17.000000+02:00"},"message":"docs(window-rules): correct two records the workspace-panel removal left stale\n\nBoth passages described code and a window that no longer exist, in a document\nthat is read as the current rule set.\n\n`docs/design/window-rules.md` said `closeCurrentWorkspaceWindows()` closes\nevery window `api.context.getWindowsInSpace` reports for the outgoing\nworkspace. It closes every live content-role window instead, and has since\n`0c4ac43e` — the reason being that only one workspace's content windows are\never on screen at a time, while a live mode tag can lag or be overwritten by\nan unrelated feature, so a window that failed the tag check was a window that\nsilently outlived every later switch.\n\nThe same file's \"The workspace panel\" section described the panel as a live\nglobal HUD window. It was removed in `59bbe921` together with\n`features/spaces/panel.html`, `panel.js` and `panel.css`. The section now\nrecords the removal and names the read-only surfaces that show the active\nworkspace today, while keeping the global-HUD-window reasoning the rest of the\nsection depends on as its worked example.\n\n`docs/design/window-manager.md` carried \"A single border flicker when the\nworkspace panel first appears\" as an open kernel defect. Nothing opens a\npanel-role window beside the border any more, so it has no trigger; the entry\nis marked moot and keeps the rule it illustrated, which is unchanged.\n","name":"spec/spaces-window-locking-regressions/a2fc5f0284b0783f5e213dbc184e7727cd33dc59","oid":"5c3106c7babb1fcbf2718f776ec55d263466dfcc"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-24T06:01:44.000000+02:00"},"message":"Add a todos list command and feed the done command from panel selections\n\nThe todo feature had no way to list outstanding #todo items, and `done`\nresolved its target by taking the first title/content substring match,\nwhich hits the wrong item whenever several match.\n\nA new leaf module, features/todo/todo-items.js, holds the decisions as\npure functions so node can test them: the handlers in background.js need\nwindow.app and cannot be imported. matchTodos() is the filter that was\ninline in handleDone(); todosListResult() returns no items as a failure\nmessage rather than empty output data, because the cmd panel's chain-mode\nguard reads an empty array as chainable output.\n\nbackground.js gains handleTodos() and a cmd:execute:todos subscription,\nand handleDone() takes the panel's selected item as a second argument —\nwith a selection an empty argument string is valid, and the \"other\nmatches skipped\" note applies only to a text match.\n\nThe manifest's done param becomes type \"item\" with tag \"todo\", which the\ncompleter in renderer/cmd/completers.js completeItem() already supports,\nso the panel offers the outstanding todos with Tab-fill. It stays named\nmanifest.json.disabled; enabling the feature is a separate change.\n","name":"spec/todo-list-and-done-picker/1f09ffcfb77df561b1ae29f6deb5906ec0b5ec63","oid":"2f83b33983ba4d9f442e2d932f2ef277d1126d45"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-24T06:01:43.000000+02:00"},"message":"Delete the canvas-era findWindowByUrl lookup and its window-open fallback\n\nEvery http(s) open that is not modal or overlay goes through the hybrid\npage-host, a BaseWindow that the BrowserWindow.fromId lookup behind\nfindWindowByUrl cannot resolve, and findHybridWindowByUrl already runs first\nin the window-open handler. No caller combines an explicit role 'content' with\nmodal or overlay, and the one non-hybrid role 'content' registration loads\nchrome-extension:// URLs, so the second lookup could never match.\n\nRemoves the function and its doc comment from main.ts along with the\nnow-unused normalizeUrl import, the re-export from index.ts, and the\nexistingByUrl reuse block in ipc.ts. findWindowByKey, normalizeForDedup and\ndatastore's normalizeUrl stay; the page:reload topic and its subscribers stay,\nonly this one publisher call goes.\n","name":"spec/remove-find-window-by-url/52fbfb9ea55e54ff753948ad69eeb8b83371172a","oid":"69d94ec8c722817e07d6aed8606d234cd3b56d6d"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-24T06:04:14.000000+02:00"},"message":"Add a pure back/forward-history snapshot module for reopen and session restore\n\nA closed page-host window comes back at its final URL only; its back/forward\ntrail is gone. Both restore paths (undo-close, session restore) need the same\npayload and the same rules for how much of a trail to keep and how to read one\nback from a persisted JSON row, so those rules land in one Electron-free module\nbefore either path is wired up.\n\n`nav-history.ts` holds:\n\n - `NavHistoryEntry` = url + title. Chromium's `pageState` blob runs 2-20 KB\n per entry and would inflate a session row by roughly two orders of\n magnitude, so it is dropped.\n - `captureNavHistory` over what `navigationHistory.getAllEntries()` and\n `getActiveIndex()` return, capped at 50 entries by a window that always\n contains the active entry: it starts at the tail and slides back only as far\n as the active entry. Slicing the last 50 and clamping the index instead\n points the reopened window at the wrong page whenever the user had gone back\n past the tail at close time.\n - `readNavHistory` for the other direction, defensive against a row with no\n history fields at all, a non-array, an entry with no url, a short trail, an\n over-long trail (re-capped with the same window rule), and a missing or\n out-of-range index (defaults to the last entry).\n - A per-window last-known cache (`seedWindowNavHistory`,\n `refreshWindowNavHistory`, `getWindowNavHistory`, `clearWindowNavHistory`).\n It exists because on a page-host close the content webContents is torn down\n before the close-finalize tail runs, so the trail cannot be read live at\n close time. A refresh from a webContents reporting zero entries leaves the\n cache alone, so a trail seeded by a deferred restore survives the window\n that is about to replay it.\n - `restoreNavHistory`, which answers false for a destroyed target or a\n rejected restore so a caller can fall back to a plain `loadURL`.\n\nNavigation history is local machine state: it is not part of any sync schema and\nis never published on a synced topic.\n\nNothing is wired into a window in this change. `main.ts ClosedWindowEntry`,\n`window-registry.ts WindowDescriptor`, `session-projection.ts`, `ipc.ts` and\n`session.ts` are untouched.\n\nSpec: specs/nav-history-model.md. Peek item 452cd2c2.\n","name":"spec/nav-history-model/6110848419bcc099383e7e3a7b38f919fc5a0bb2","oid":"ef8b6b9ab7ac569bf34e6d3d3511351730949896"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-24T05:49:29.000000+02:00"},"message":"Point noun-registry, completers and card-helpers tests at the real modules\n\nAll three re-implemented the code they claimed to test, so `yarn lint:test-honesty`\nflagged them as exercising no shipping module.\n\n- `main/noun-registry.test.ts` drops its inline `validateNounDef` /\n `generateCommandsFromNoun` copies and the local `NounDef` / `CommandMeta`\n interfaces, loading `renderer/cmd/noun-registry.js` through a computed dynamic\n import. A static import of the `.js` would not compile from `main/*.test.ts`\n (no `allowJs`, no declaration file). The stale `extensions/cmd/...` path in the\n header comment is corrected. Cases unchanged.\n\n- `main/completers.test.ts` becomes `tests/unit/completers.test.js`, under plain\n `node --test`: `renderer/cmd/completers.js` reads `window.app` at module top\n level, so it needs a `globalThis.window` stub that the electron runner has no\n reason to carry. The old file's `completeTag` copy took a tags array; the real\n one is async and fetches through `window.app.datastore.getTagsByFrecency()`\n behind a 5-second cache, so the stub answers with a mutable list and each case\n calls `invalidateCache()` after setting it. Two cases added for `completeEnum`'s\n rich `options` form, which the copy did not implement.\n\n- `tests/unit/card-helpers-favicon.test.js` imports `renderer/lib/card-helpers.js`\n instead of copying `TYPE_ICONS`, `extractTitle`, `formatUrl`, `extractUrl`,\n `_googleFaviconFallback` and `getItemDisplayInfo`. `card-helpers.js` gains\n `export` on `GLOBE_FAVICON`, `TYPE_ICONS`, `extractUrl` and\n `_googleFaviconFallback`; no behaviour change. Cases added for the `event` item\n type (icon, start-time subtitle, \"Event\" fallback) and the `thumbnailHash`\n return field, both of which the real module has and the copy lacked.\n\nNo case had to be changed to match real behaviour — the copies and the real code\nagreed everywhere the existing assertions reached.\n\nVerify: `lint-test-honesty` no longer lists any of the three (16 files still\nflagged, covered by other specs); main-process unit runner 3337 pass / 0 fail;\nnode unit runner 852 pass / 0 fail; `tests/desktop/event-item-type.spec.ts`,\nthe live spec that drives `card-helpers.js`, 2 passed.\n","name":"spec/honesty-retarget-renderer-copies/fd7cd423961e55f19f77e142fec8e87ac7e425d8","oid":"8a87ecab9c2c66b2c3752b1250831389aad6ffef"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-24T05:59:25.000000+02:00"},"message":"Reword the hybrid page-host comments that still describe a flag or a canvas branch\n\nThe canvas page-host and the flag that selected between it and the hybrid\npage-host were removed; the hybrid page-host is the only implementation. Five\nmain-process comments still described the old arrangement, sending a reader\nlooking for a flag check or a canvas branch that does not exist.\n\ntile-ipc.ts: the tile:window:open handler's URL-governance note and its\ndelegate-to-window-open note, the tile:window:close and tile:window:hide\nhandlers' hybrid-registry no-op notes, and the tile:window:list handler's\nparams note. hybrid-overlay.ts: the destroyFakeHybridWindow doc comment in\ninstallTestBridge().\n\nComments only — no identifier, import or string-literal change.\n","name":"spec/stale-hybrid-flag-comments/d90bcacd4d0cb999762952759afdad31f81be69b","oid":"e31b81a0ebd3018e06e47e76232610699ebf0d2e"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-24T05:31:49.000000+02:00"},"message":"Extract the adblocker fallback and download filename helpers to pure modules\n\nBoth main-process unit tests ran against inline copies of the code they claimed\nto check, because their product modules import electron and the runner\n(ELECTRON_RUN_AS_NODE=1) cannot load it. The adblocker copy had diverged to 5\nrules against the real ~30.\n\nNew leaf modules, byte-for-byte moves:\n\n- main/adblocker-fallback.ts holds BUNDLED_FALLBACK_FILTERS and\n buildFallbackEngine(), importing only @ghostery/adblocker-electron.\n- main/download-filename.ts holds resolveUniqueDownloadPath() and\n sanitizeDownloadFilename(), importing only node:fs and node:path.\n\nadblocker.ts and session-partition.ts import them back at their existing call\nsites, so initAdblocker() and the will-download handler are unchanged.\n\nBoth tests now import the shipping symbols. adblocker.test.ts drops its inline\nconstant and its \"a failing read + failing fetch both reach the catch block in\ninitAdblocker\" case, whose simulateInit stand-in exercised no product code, and\ngains a case blocking https://criteo.com/x.gif — a rule only the full list\ncarries, so the test cannot pass against a short copy again.\nsession-partition.test.ts drops both copies and the keep-in-sync header; its 15\ncases are unchanged.\n\nscripts/lint-test-honesty.mjs now flags 17 files instead of 19.\n\nSpec: specs/honesty-extract-main-pure-helpers.md (Peek item 57895545).\n","name":"spec/honesty-extract-main-pure-helpers/66290f2ec61afdf6a01685707fe4d31d33f0f423","oid":"3826251e1a37cfeda0ef4c10fc27542905d02820"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-24T05:30:56.000000+02:00"},"message":"Delete three tests of removed code and mark the subprocess-driven mcp test\n\n`yarn lint:test-honesty` flagged four files that need no product change.\n\nDeleted, because each covers code that no longer exists:\n\n- `apps/desktop/main/page-loading.test.ts` (7 cases) — defined and exported\n `shouldClearLoadingOnFail()` itself, described as extracted from a\n `renderer/page/page.js` that the canvas page-host removal took with it.\n Neither `shouldClearLoadingOnFail` nor `hasEverLoaded` appears anywhere\n else under `apps/desktop`; the test tested its own function.\n- `apps/desktop/main/tile-window-open.test.ts` (1 case) — one empty case\n pointing at `tests/desktop/tile-window-open.spec.ts`, which does not\n exist. It imported only `node:test` and asserted nothing.\n- `apps/desktop/tests/unit/page-maximize-layout.test.js` (22 cases) —\n inline copies of `computeWindowBounds()`, `positionPanelsMaximized()`\n and `updatePositionsMaximized()`, none of which exists in `main/` or\n `renderer/` now. The copies had also drifted from the shipping model:\n they assume an 8px margin and a stored `preMaximizeBounds`, whereas the\n chrome frame is `main/overlay-frame.ts` `expandToOverlayFrame()` /\n `OVERLAY_GUTTERS`, which `main/overlay-frame.test.ts` covers through a\n real import.\n\n`apps/desktop/tests/unit/mcp-write-response-shape.test.js` stays and its\nbody is unchanged: it spawns `features/mcp-server/server.js` as a\nsubprocess and drives `create_item` / `update_item` / `complete_task` over\nstdio JSON-RPC, so it does exercise the shipping server — the lint cannot\nsee that because nothing is imported, and `shapeItemForResponse()` is\nprivate. It gains the lint's `@no-product-import` line stating why.\n\nRunner totals fall by exactly 30: main-process unit 3357 -> 3349, node\nunit 817 -> 795, `fail 0` in both. The lint no longer names any of the\nfour; it still exits 1 while the other flagged files remain.\n","name":"spec/honesty-drop-dead-tests-and-hatch/3a99b83e6d9283cf3fb55600a7cc4399d2f14d91","oid":"08dde624e1ab3008be567a4f2afd3cdcf32b2896"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-24T05:33:14.000000+02:00"},"message":"Delete the canvas container-URL helpers from the session module\n\nextractRealUrl() and extractCanvasBounds() parsed the canvas page container\nURL (peek://app/page/index.html?url=&x=&y=&width=&height=), where the\ncanvas page encoded the webview's real URL and bounds. The canvas page-host\nthat produced those URLs is gone; the hybrid page-host keeps the real URL and\nbounds on the window itself.\n\nNeither function had a caller anywhere in the repo. main/session.test.ts\ncarried its own copies and tested those, so 11 tests in 2 suites covered code\nthat shipped nowhere: describe('extractRealUrl'), describe('extractCanvasBounds')\nand the standalone test 'canvas page URLs get real URL extracted'.\n\nThe test 'preserves canvas page bounds (not fullscreen) through save/load'\nstays — it is a plain bounds round trip through saveSnapshot/readSnapshot —\nwith its comment reworded to stop claiming the save logic calls\nextractCanvasBounds.\n\nThe peek://app/page handling in main/window-address.ts, ipc.ts,\nsession-partition.ts and tile-preload.cts is untouched: the overlay window\nloads peek://app/page/overlay.html, so those prefix checks are not dead.\n\nImplements specs/drop-canvas-session-url-helpers.md. Part of Peek item\nf1ea471d. Electron main-process runner 3357 -> 3346 tests, fail 0; node unit\nrunner 817 tests, fail 0.\n","name":"spec/drop-canvas-session-url-helpers/5d1acc6c74db0ae1adf64daf11b788def1871215","oid":"33da362f3179a74b04a9d8b648426e191f26721e"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-24T05:30:46.000000+02:00"},"message":"Scope an item command param to one tag in the cmd panel completer\n\nA command param of `{ type: 'item' }` could only ever suggest from a plain\n`queryItems` call, so a feature had no way to say \"suggest only items tagged\n`todo`\". `completeItem()` now reads a `tag` name off the param definition:\nit resolves the tag through the existing frecency cache, returns nothing when\nno such tag exists (rather than creating one), and otherwise draws its rows\nfrom `getItemsByTag()`. Without `tag` the query is unchanged.\n\nThe filtering and row-to-suggestion logic moves into a new leaf module,\n`renderer/cmd/item-suggestions.js`, with no `window` or DOM access, because\n`completers.js` reads `window.app` at import time and so cannot be imported by\na node test. The new module is covered directly by\n`tests/unit/item-suggestions.test.js`.\n\nImplements specs/cmd-item-param-tag-filter.md.\n","name":"spec/cmd-item-param-tag-filter/f5b67e6cdb33cab55e9dcdc2b3c723328d77edbc","oid":"743ba82f35536d6e7252cc53d27010c0a061e789"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-24T05:29:29.000000+02:00"},"message":"Gate chrome.tabs.create to http(s) URLs before openExternal\n\nThe create handler in the chrome.tabs polyfill forwarded any string an\nextension background page supplied straight to shell.openExternal, so a\nbackground page could ask the OS to open peek://, chrome-extension://,\nfile:, javascript: or data:. peek:// in particular re-enters the app\nthrough the OS protocol handler, outside the tile / capability path.\n\nA new electron-free module _external-url.js holds isWebUrl() and\nopenExternalIfWebUrl(), with shell injected so the unit test needs no\nelectron import. The handler warns with the extension id and the refused\nscheme only, never the full URL, and returns the same synthetic tab\nobject as before. The 'about:blank' default for a missing url is refused\nby the same rule.\n\nThe allowed set matches the setWindowOpenHandler in chrome-extensions.ts,\nwhich already routes http(s) only.\n","name":"spec/extension-tabs-create-scheme-gate/0067c0c5161cda588163659e202299779502eeb7","oid":"a59bdea1f60df93cff1480ad198867eedb15d648"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-24T10:05:07.000000+07:00"},"message":"fix(desktop): complete bake-off labeling cases\n","name":"spec/bake-off-labeling/4a6434dd047e153c9d7dd5b3926f0d46a09de329","oid":"260ca18b051f023e80b4f36d58a0b90754827172"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-24T04:52:16.000000+02:00"},"message":"Send only the Enter keydown in the cmd URL reuse test\n","name":"spec/cmd-url-window-reuse-teardown-race/6ea69e488cb0b2e1632d049cbb2698c9542a3675","oid":"713ccf8721116ee36b576697a9772a2b223ca235"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-23T21:23:54.000000+02:00"},"message":"Stamp the source a packaged build came from into the bundle\n\nA packaged Peek had no record of its own source: the root package.json\nversion is 0.0.1 and nothing else in the bundle named a commit, so a build\nin someone's hands could not say what it was built from.\n\nAn electron-builder afterPack hook now runs git and writes build-info.json\n(commit, short commit, commit time, build time, dirty flag, branch, checkout,\nversion) into the packaged resources directory, and on macOS rewrites\nInfo.plist so CFBundleVersion is the short commit, alongside PeekBuildCommit\nand PeekBuildDirty. Signing is disabled, so editing the plist after packing\nis safe. A hook rather than a package script means every electron-builder\ninvocation is stamped, including the test gate.\n\nThe interpretation of the raw git output lives in main/build-info.ts, which\nimports no Electron at module top level so the hook can reuse it from its\ncompiled form. A checkout under .worktrees/ is recorded as\nworktree:, a detached HEAD as a null branch.\n\nAt startup a packaged app logs one [build] line, unconditionally rather than\nbehind DEBUG, and says the build is unidentified when no stamp is readable.\n\nThe hook keeps packaging alive when git is unavailable, warning instead of\nthrowing; the resulting bundle logs the unidentified-build line.\n","name":"spec/build-identity-stamp/6ea69e488cb0b2e1632d049cbb2698c9542a3675","oid":"ef46ab88376cc52ede07092a8321c85d8f3566ca"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-23T21:22:39.000000+02:00"},"message":"Keep the address-bar ghost rejected after Backspace\n\nTyping a prefix in the page-host address bar shows an inline completion as\nnatively selected text. Backspace removed the selected suffix, but the\ndebounced query that followed rebuilt the same ghost and re-selected it, so\nthe rejection never stuck.\n\npeek-navbar.js _onUrlInput() now classifies each edit from the input event's\ninputType, the same per-event signal the cmd panel uses, and hands it to\n_triggerSuggestions() as isDeleting. While deleting, the query still runs and\nthe dropdown still refreshes; only the inline ghost is withheld. The next\ninserted character re-arms it through the unchanged path. A missing inputType\ncounts as an insertion.\n\nThe debounced callback also retires its own _ghostTimer handle on every exit\npath, which gives tests a settled signal that needs no sleep. It retires only\nthe handle it installed: a stale callback resuming after a newer trigger would\notherwise null the live timer and report settled while a query was pending.\n\nPeek item 876200f9.\n","name":"spec/navbar-ghost-backspace-suppress/6ea69e488cb0b2e1632d049cbb2698c9542a3675","oid":"d3606b0c285fae127633ac05f327805b3d9c8fad"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-22T19:21:39.000000+02:00"},"message":"Stage Escape in the cmd palette: dropdown, then text, then panel\n\nEscape peeled two layers at once: a single press hid the auto-opened\nsuggestion dropdown and wiped the typed text together. Each press now\ntakes exactly one layer — hide the dropdown and keep the text, clear the\ntext, close the panel.\n\nA `resultsDismissed` flag in the machine's data suppresses the TYPING /\nIDLE auto-open rule in resultsListOpen(). The TYPING Escape entry gained\na leading `resultsVisible` branch; the RESULTS_OPEN Escape entry now\ndismisses the list too, because TYPING would otherwise re-derive it as\nopen whenever the combined lane total is above 1. The flag is owned by\nthe machine: internalActions is consulted by runAction() ahead of the\ninjected actions, since the unit-test harness proxies every action name\nand would otherwise shadow it. It clears on new input, on any exit from\nTYPING, and in reset().\n\ndropInlineGhost() in panel.js drops the URL ghost and restores the\ninput's value to state.typed with a collapsed caret — applyGhostSelection\nmay have overwritten the input with a completion, which would otherwise\nbe left on screen with no dropdown or ghost to explain it.\n\nSpec: specs/cmd-staged-escape.md. Peek item cc3532f6.\n","name":"spec/cmd-staged-escape/59ba766479f50fdb96bf7e2d71f37afd78e49cf0","oid":"77f216d5b6214e74764dc4a88239803197f0d476"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-23T21:34:39.000000+02:00"},"message":"Key the cmd panel opens in the URL ghost spec, skip the unfocused test off darwin\n\nEvery open in cmd-url-ghost.spec.ts passed no `key`, so main/ipc.ts\nwindowOpenHandler built a new panel window per open while getWindow kept\nreturning the describe's first panel — hidden by keepLive and still holding its\nprevious urlGhostSuggestion and urlMatches. The first test in a describe passed;\nlater ones passed only when the stale state happened to satisfy their wait. The\nopens now pass key: 'peek://cmd/panel.html', as renderer/cmd/background.js\nopenPanelWindow() does, so the one panel is reused and reset to IDLE by\nVISIBILITY_SHOWN. A new expectSinglePanel() helper asserts at each open that\nexactly one live cmd/panel.html page exists, so a regression to duplicate panels\nfails there instead of as an eight-second ghost timeout.\n\ncmd-url-unfocused.spec.ts pins key-without-activation, which is a macOS model:\noff darwin main/main.ts feeds kernelAppActivated() from browser-window-focus, so\nthe palette taking OS focus under Xvfb/openbox marks the app active right after\nsetAppFocusedForTest(false), and every assertion after that point assumes the app\nstayed inactive. The whole test now skips off darwin with that reason; no\nassertion changed, and macOS still enforces all of them.\n\ngate-baseline.md drops the three cmd-url-ghost.spec.ts rows from the\ndeterministic desktop table and records the cause and the fix.\n\nOn Linux, test:grep \"cmd URL\" now reports 15 collected, 14 passed, 1 skipped,\n0 failed. Main-process unit 3340/0, node unit 813/0.\n","name":"spec/cmd-url-linux-failures/1855f0e5adb448183a09402cbc3d45ff3c04df6d","oid":"42d428a07495c76a1f73b61d6c78f0cd1c476b5f"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-23T21:34:39.000000+02:00"},"message":"Key the cmd panel opens in the URL ghost spec, skip the unfocused test off darwin\n\nEvery open in cmd-url-ghost.spec.ts passed no `key`, so main/ipc.ts\nwindowOpenHandler built a new panel window per open while getWindow kept\nreturning the describe's first panel — hidden by keepLive and still holding its\nprevious urlGhostSuggestion and urlMatches. The first test in a describe passed;\nlater ones passed only when the stale state happened to satisfy their wait. The\nopens now pass key: 'peek://cmd/panel.html', as renderer/cmd/background.js\nopenPanelWindow() does, so the one panel is reused and reset to IDLE by\nVISIBILITY_SHOWN. A new expectSinglePanel() helper asserts at each open that\nexactly one live cmd/panel.html page exists, so a regression to duplicate panels\nfails there instead of as an eight-second ghost timeout.\n\ncmd-url-unfocused.spec.ts pins key-without-activation, which is a macOS model:\noff darwin main/main.ts feeds kernelAppActivated() from browser-window-focus, so\nthe palette taking OS focus under Xvfb/openbox marks the app active right after\nsetAppFocusedForTest(false), and every assertion after that point assumes the app\nstayed inactive. The whole test now skips off darwin with that reason; no\nassertion changed, and macOS still enforces all of them.\n\ngate-baseline.md drops the three cmd-url-ghost.spec.ts rows from the\ndeterministic desktop table and records the cause and the fix.\n\nOn Linux, test:grep \"cmd URL\" now reports 15 collected, 14 passed, 1 skipped,\n0 failed. Main-process unit 3340/0, node unit 813/0.\n","name":"spec/cmd-url-linux-failures/52117b5c987d80e0e4b987b2ebfaba07d52db4a5","oid":"42d428a07495c76a1f73b61d6c78f0cd1c476b5f"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-22T20:05:35.000000+02:00"},"message":"Note the key the feature-manager liveness map depends on\n\n`liveEntriesByFeature` is seeded under a feature id and updated under the\nlifecycle message's tile id. Every feature that ships today has the same\nstring for both, so the two paths agree; a feature that diverged them\nwould seed and update under different keys and its DevTools button would\nstop tracking. Comment only.\n","name":"spec/feature-manager-devtools-affordance/59ba766479f50fdb96bf7e2d71f37afd78e49cf0","oid":"ff1538098c7c8ee26b29358ea7fca6c4f634a840"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-22T19:19:48.000000+02:00"},"message":"Loopback hosts get http:// when a default scheme is added\n\nTyping localhost:3000 produced https://localhost:3000, which cannot load and\nstill leaves an unreachable row in history. Local dev servers are http-only, so\na scheme-less loopback host now defaults to http:// while public hosts keep the\nhttps:// default.\n\nurl-completion.js gains isLoopbackAddress() and withDefaultScheme(). The four\nsites that hard-coded 'https://' + str call them: cmd/panel.js getValidURL() and\nthe openUrlGhost branch of actionHandlers(), peek-navbar.js _normalizeUrl(), and\npage/background.js getValidURL().\n\nBoth getValidURL() copies also drop their narrow /^localhost(:\\d+)?/ recognizer\nfor isLoopbackAddress(), so 127.0.0.1:8080, [::1]:8080 and foo.localhost:3000\nare URLs rather than valid:false. isDomainPattern and its no-port limit for\npublic hosts are untouched; example.com:8080 is still not a URL in cmd.\n\nExisting https://localhost rows in the datastore are not migrated — that is a\nseparate piece of work.\n\nSpec: specs/loopback-default-http.md\n","name":"spec/loopback-default-http/59ba766479f50fdb96bf7e2d71f37afd78e49cf0","oid":"3a7f06c50df88428f6e56b2205600a9223191169"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-22T19:22:12.000000+02:00"},"message":"Replay pending permission requests to the overlay on every active handoff\n\nA web-permission request published before the shared overlay renderer\nsubscribed reached nobody — pubsub keeps no history — so the prompt stayed\ninvisible until window close auto-denied it. That happens at startup, and again\nwhenever the overlay renderer is re-created and starts with an empty queue.\n\nThe handoff is already the lifecycle signal, so the pending list rides it\nrather than a new topic: `sendActiveHandoff` adds `pendingPermissions` to the\nnon-null `page-overlay:active` payload, built from the read-only\n`listPendingForWindow` helper via `pendingPermissionRequestsForWindow`. The\nlive publish and the replay now share one payload builder so their shapes\ncannot drift. No new subscription, timer, poll or retry.\n\nThe renderer's reconcile is additive only: it never removes a queued entry,\nbecause a listing can predate a response already sent and because queued\nentries need not have a backend entry at all. A `settledPermissionIds`\ntombstone set — written on response and on `page:permission-resolved` — is what\nstops a stale listing re-showing an answered prompt.\n","name":"spec/permission-prompt-handoff-replay/59ba766479f50fdb96bf7e2d71f37afd78e49cf0","oid":"2a995aea315f0296757bae2f24634643252985c7"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-22T18:54:39.000000+02:00"},"message":"Isolate HOME in every setup.test.js helper that spawns setup.js\n\nrunSetup(), scaffoldProject() and runRefresh() inherited the invoking shell's\nHOME. setup.js refresh mode reads and writes join(homedir(), '.claude.json'),\nso 'refresh: errors when no existing install' found the developer's real\nuser-scope Peek entry, rewrote it into the ${PEEK_SYNC_URL} /\n${PEEK_MCP_TOKEN} form and exited 0 — failing its own assertion and breaking\nthe machine's Peek MCP connection.\n\nmakeTmpProject() now creates join(projDir, 'home'), and a new isolatedEnv()\nbuilds the child env with HOME pointed there. The three helpers derive HOME\nfrom projDir, so no caller signature changes and none can forget it.\n\nThe new describe 'setup.test.js helpers — HOME isolation' drives all three\nhelpers with process.env.HOME set to a sentinel home holding a user-scope\nremote Peek install, and asserts the sentinel's .claude.json bytes and\ndirectory listing are untouched.\n\nsetup.test.js: tests 28 / fail 0. Gate: main-process unit 3322 / fail 0,\nnode unit 784 / fail 0.\n","name":"spec/mcp-setup-test-home-isolation/e07cdb0ccf5adeba0b7d6be325ec10d468ae3565","oid":"5fe246768975101934270f52397c79b71e73f0e9"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-22T14:57:18.000000+02:00"},"message":"Shape create_item/update_item/complete_task MCP responses like get_item\n\nThe three write tools now return through shapeItemForResponse(), stripping\nfavicon and windowing content the same way get_item and get_task_context\nalready do. maxContentLength/contentOffset are added to each tool's schema\nand description, and stripped before the args reach the store write so a\nwindow param can never become a write.\n","name":"spec/mcp-write-response-shape/af107d970f8d09f1f416080d4df97f4f10f96183","oid":"4fc4e8316bf3d8ae21918a2493511a1b599313bc"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-22T14:44:53.000000+02:00"},"message":"Surface lazy-tile wake failures on the feature-manager card\n\nA lazy tile's background script failure at wake time (command dispatch,\nlazyEvent dispatch, or shortcut backfill) never reached the feature-manager\ncard's load-error display -- only boot-time load failures did. Move the\nper-session load-error map out of feature-startup.ts into a new\nElectron-free feature-load-errors.ts (avoiding a tile-lazy -> feature-startup\nimport cycle through tile-loader/tile-compat/tile-arm), and have\ntile-lazy.ts's ensureTileLoaded() record a wake failure there and clear it\non the next successful load, including on unregisterLazyTile().\n","name":"spec/lazy-tile-wake-failure-surfacing/af107d970f8d09f1f416080d4df97f4f10f96183","oid":"ea72d7e1b764aefa67775b920569428b2274e374"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-22T14:54:52.000000+02:00"},"message":"Suppress cmd URL ghost fill/select on leading or trailing whitespace\n\nA trailing (or leading) space in the cmd panel's typed text meant the\nuser had moved past extending a URL, but the ghost completion still\nfilled the input and rendered a highlighted suffix keyed off a\ntrimmed anchor, so a following keystroke replaced a native selection\nin a value the user never saw. inlineCompletionFor centralizes the\nforward-prefix test against the untrimmed anchor so the overlay's\nsuffix offset always matches the input's fill offset.\n","name":"spec/cmd-url-ghost-trailing-space/af107d970f8d09f1f416080d4df97f4f10f96183","oid":"c0babf91807e6a11639007bbf1eceeaf328138aa"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-22T14:39:28.000000+02:00"},"message":"Mint a device key for the desktop sync test suite\n\nsync.test.ts's setup() helpers authenticated with a raw users-table API\nkey, which only ever worked through the shared-key fallback resolveDevice()\ndropped in 2df023f5/9d577c39. Every setup() now keeps the createUser() call\n(the user row still has to exist) and mints the credential with\ncreateDevice(userId, 'sync-test').apiKey instead, matching the pattern\napps/server/test.js's route tests already use post-cutover.\n","name":"spec/profile-key-cutover/2df023f51c2701b7c090dda8b0d371842c7f2c50","oid":"aaac69b5373f532c1d39873ba61fe86fd371c875"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-22T14:18:57.000000+02:00"},"message":"Shift+Tab cycles the command palette backward in RESULTS_OPEN and URL mode\n\nRESULTS_OPEN's transition table had no SHIFT_TAB entry, so the event\narrived and did nothing. URL mode's Tab handler never read e.shiftKey,\nso Shift+Tab advanced forward just like Tab. renderUrlResults also\nreset matchIndex to 0 on every render, which zeroed out any Tab/Shift+Tab\ncycling before it could be observed; the reset now happens only where\nthe URL list is replaced (enterUrlMode, filterUrlModeItems).\n","name":"spec/cmd-shift-tab-reverse/af107d970f8d09f1f416080d4df97f4f10f96183","oid":"9eebcea5202ab30e37a1071b8ac20cd858fa9516"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-22T14:17:13.000000+02:00"},"message":"Stop pruning builtins whose manifest fails to parse or validate\n\nsyncBuiltinFeatures now tracks on-disk paths alongside on-disk ids, so a\nbuiltin registered under a path that still exists survives sync even when\nits manifest.json is invalid JSON, fails schema validation, or is a\nnon-tile manifest. Only a builtin whose directory or manifest.json is\ngenuinely gone is still pruned.\n","name":"spec/builtin-manifest-error-keeps-registration/af107d970f8d09f1f416080d4df97f4f10f96183","oid":"a43feb4883615a29da3bd1a1c76a7bdf5145a0df"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-22T14:16:21.000000+02:00"},"message":"Make the hybrid window closed-listener a fan-out list\n\nhybrid-page-host-registry.ts kept exactly one closed-listener in a\nmodule-scoped variable, so a second registrant would silently replace\nthe permission-deny wiring the seam exists for. Replace the slot with\na Set; registerHybridWindowClosedListener now returns an unsubscribe\nand notifyWindowClosed fans out to a snapshot of listeners, each in\nits own try/catch, so one throwing or unsubscribing listener never\naffects the others.\n","name":"spec/hybrid-window-closed-listener-list/af107d970f8d09f1f416080d4df97f4f10f96183","oid":"16c279524d9c929731e88f2b2717b79bcd2093cb"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-22T11:45:04.000000+02:00"},"message":"Fix three enrolment-code/device-revoke edge cases\n\nWrap enrolment-code redemption's check/mint/mark-used in a single\ntransaction so concurrent redemptions can't both pass the used_at check\nbefore either writes it; keep the just-spent code's row alive through\nopportunistic pruning so a retry sees \"already used\" rather than \"invalid\ncode\". Widen the revoke-device IPC handler's local-key-clear guard to fire\nwhenever the server reports the current device as revoked, fresh or not,\nmatching the server's already-idempotent revoke response. Check the result\nof the post-enrolment key persist in settings and surface a retryable error\ninstead of reporting false success on a failed write.\n\nAdds a device-settings.spec.ts case for retry-after-self-revoke and a\nserver test.js case for sequential double-redemption.\n","name":"spec/enrolment-code-edge-cases/c7b1f46c38a7ee368894aafd8ea22e4f44c9a861","oid":"8a48599debe23bd39b443042a0a80c18725d589e"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-22T11:21:19.000000+02:00"},"message":"Guard DOMContentLoaded registration in nine feature tiles\n\nEach file's top-level document.addEventListener('DOMContentLoaded', init)\nnow checks document.readyState first and calls init() directly if the\nevent has already fired, matching the pattern already used in\nspaces/home.js and other previously-fixed tiles. Defense in depth against\na future change that adds an await before the registration; none of these\nnine currently race.\n","name":"spec/feature-tile-readystate-guard/c7b1f46c38a7ee368894aafd8ea22e4f44c9a861","oid":"417bfa538a4b5fb49d962ab8cce6d61623e820ed"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-22T11:46:35.000000+02:00"},"message":"Resolve hybrid-page-host-registry.test.ts's repo root from its own file location\n\nrepoRoot() used process.cwd(), which resolved to a doubled apps/desktop path\nwhen the suite ran with cwd = apps/desktop instead of the repo root. Derive it\nfrom the compiled test file's own location via fileURLToPath(import.meta.url)\ninstead, matching the __dirname convention already used by entities.test.ts\nand settings-defaults.test.ts in the same directory. Verified 41/41 passing\nboth from the repo root and from apps/desktop.\n","name":"spec/hybrid-page-host-registry-cwd-fix/c7b1f46c38a7ee368894aafd8ea22e4f44c9a861","oid":"4d67085a53204a7a84c6b8cf3b3c1b312e4a4586"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-22T10:27:22.000000+02:00"},"message":"Skip no-persist descriptors on session restore; add real-boot panel relaunch spec\n\nrestoreSessionSnapshot()'s validWindows filter dropped role:'overlay'\ndescriptors but not role:'panel' or persist:false ones, so a snapshot saved\nbefore feature chrome carried the no-persist property (or by any path that\ndoesn't yet respect it) could still reopen the workspace panel as an orphan\non restore. Add a matching skip clause, mirroring the overlay check.\n\nAdd a desktop spec that quits inside a named workspace and relaunches under\na tmp- profile (isTestProfile() false, unlike the test-* profiles the other\nspecs in the file use) so it drives the real boot restore path instead of a\ntest bridge, asserting zero panel-role windows at boot and exactly one after\nre-entering a workspace.\n\nThe panel's create/close lifecycle itself (requirements 1-3) was already\ncorrect in the landed workspace-session-snapshot dependency spec and needed\nno change.\n","name":"spec/workspace-panel-orphan/1bd299eddded3cb75b8061ffb4832525a36c0bbc","oid":"56b23f439bae8703433d1df93ec064128c0cc0a2"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-22T10:27:22.000000+02:00"},"message":"Skip no-persist descriptors on session restore; add real-boot panel relaunch spec\n\nrestoreSessionSnapshot()'s validWindows filter dropped role:'overlay'\ndescriptors but not role:'panel' or persist:false ones, so a snapshot saved\nbefore feature chrome carried the no-persist property (or by any path that\ndoesn't yet respect it) could still reopen the workspace panel as an orphan\non restore. Add a matching skip clause, mirroring the overlay check.\n\nAdd a desktop spec that quits inside a named workspace and relaunches under\na tmp- profile (isTestProfile() false, unlike the test-* profiles the other\nspecs in the file use) so it drives the real boot restore path instead of a\ntest bridge, asserting zero panel-role windows at boot and exactly one after\nre-entering a workspace.\n\nThe panel's create/close lifecycle itself (requirements 1-3) was already\ncorrect in the landed workspace-session-snapshot dependency spec and needed\nno change.\n","name":"spec/workspace-panel-orphan/38ce153e7b1a6213961989aaf58df1b0ff64e19d","oid":"56b23f439bae8703433d1df93ec064128c0cc0a2"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-22T07:25:27.000000+02:00"},"message":"Move this repo to spec-driven tracks\n\ntracks.json declares specWatch: specs live in specs/, at most three tracks at\nonce, one failed review before a track parks. The verify gate becomes the\ndesktop unit tests run from the repo root, because the full electron gate has\nknown failures on the coordinating machine and takes longer than the gate\nrunner's two-minute limit, and because yarn test:unit runs from apps/desktop,\nwhere hybrid-page-host-registry.test.ts resolves its source paths against the\nwrong directory and fails.\n\nFirst specs: the workspace persistence rework (Peek 5ccc51fc), the orphaned\nworkspace panel that depends on it (2b37ac30), the HUD profile migration\n(a9970bfb), and the space-tag visibility change (f3c36483), disabled until the\nhidden-tags framework it needs exists.\n","name":"spec/hud-profile-migration/38ce153e7b1a6213961989aaf58df1b0ff64e19d","oid":"38ce153e7b1a6213961989aaf58df1b0ff64e19d"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-22T07:25:27.000000+02:00"},"message":"Move this repo to spec-driven tracks\n\ntracks.json declares specWatch: specs live in specs/, at most three tracks at\nonce, one failed review before a track parks. The verify gate becomes the\ndesktop unit tests run from the repo root, because the full electron gate has\nknown failures on the coordinating machine and takes longer than the gate\nrunner's two-minute limit, and because yarn test:unit runs from apps/desktop,\nwhere hybrid-page-host-registry.test.ts resolves its source paths against the\nwrong directory and fails.\n\nFirst specs: the workspace persistence rework (Peek 5ccc51fc), the orphaned\nworkspace panel that depends on it (2b37ac30), the HUD profile migration\n(a9970bfb), and the space-tag visibility change (f3c36483), disabled until the\nhidden-tags framework it needs exists.\n","name":"spec/workspace-session-snapshot/38ce153e7b1a6213961989aaf58df1b0ff64e19d","oid":"38ce153e7b1a6213961989aaf58df1b0ff64e19d"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-22T10:08:15.000000+02:00"},"message":"Fix 12 defects in the workspace session-snapshot pipeline\n\nAmbient saves (autosave, before-quit, window-lifecycle, manual) write the\nACTIVE workspace's row instead of always the default's: session.ts tracks\nthe active workspace, the spaces feature reports it through the new\ntile:session:set-active-workspace channel, and a switch is bracketed by\ntile:session:begin-workspace-switch so the debounced window-lifecycle save\ncannot record a half-switched, empty workspace. Crash bookkeeping stays in\nthe one app-level metadata row regardless of key, so a quit inside a named\nworkspace is not read as a crash at the next boot.\n\nA window pinned across every workspace lives in the default workspace's row:\nserializeSession derives its exclusion from a named key (the\nexcludeGlobalPins flag is gone from the API, IPC and projection), a save\nunder a named key refreshes the default row's global-pin descriptors, and\nat cold start the pins restore even when the restoreSession preference is\noff or the crash dialog is declined (entry.ts still opens the startup\nfeature when nothing beyond the pins came back).\n\nAlso: the crash-recovery dialog is gated on cold start rather than on the\ndefault key, so returning to the default workspace live cannot raise it;\nenterWorkspace() judges success by the count of windows that opened, not\nthe count the snapshot asked for; readSaveContext() reads the pin and mode\ncontext keys independently so a global pin with no mode row keeps its\nscope; the workspace-snapshot save handler passes allowInTestProfile (only\nthe test-profile skip) instead of the test-only _forceForTest, so the\nmid-restore guard and invisible-window filter stay in force in production;\ncheckSessionAllowed() enforces the default-key refusal for\nget-workspace-snapshot-info centrally, with DEFAULT_WORKSPACE_KEY moved to\nthe Electron-free session-projection.ts so the enforcement module can use\nit.\n","name":"spec/workspace-session-snapshot/1bd299eddded3cb75b8061ffb4832525a36c0bbc","oid":"1e25435e9242789e11c91bfe539f040aa6027948"},{"author":{"email":"me@burrito.space","name":"dietrich ayala","when":"2026-09-22T07:42:45.000000+02:00"},"message":"Add one-shot migration removing deleted HUD data from profiles\n\nCleans stale peek://hud/ and peek://ext/hud/ window entries out of the\nsession snapshot, closed-window stack, and per-workspace snapshots;\ndeletes hud/hud-widget/hud-overlay feature_settings rows, the hud\nmanifest_cache toggle row, and any HUD-tile-keyed context_history rows.\nRegistered in datastore.ts's migration sequence, recorded in the\nmigrations table so it runs once per profile. Peek item a9970bfb.\n","name":"spec/hud-profile-migration/1bd299eddded3cb75b8061ffb4832525a36c0bbc","oid":"e8bb45c531b331426c5a9629faae2a5b13ca2444"}],"total":64}