Pop-out windows: Slack-style thread windows at parity with the main view - #2896

Adopt the composer's existing draft-conflict contract, make Open in main a
focus (not a move), add per-window binding/incarnation, a real thread read
projection, reading-lease based unread, and cite Slack's official help.

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

…exits, delayed reading IPC

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

Presentation-only companion windows (popout-<uuid>) modeled on the Huddle
window: main owns identity, relay, signing and read state; each window is
bound to one target and session incarnation; watch/action/download are
gated per label; guarded close asks the companion; Cmd+W closes a focused
pop-out; a main renderer reload detaches companions instead of leaving
them able to act.

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

Main-window owner projects a session-owned thread view into a pop-out
companion, reusing the Huddle composer bridge (now with thread reply and
thread draft keys) and a shared companion row projection/renderer. The
companion mounts the real composer, reports held work for native close
guards, and measures reading with useReading over a lease proxy whose
leases live in main. Entry point: message menu → Open thread in new window.

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

…d S1 deviations

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

- Reading moves to a request/response BroadcastChannel bridge: a companion
  observation completes only when main's read-state save is durable, so the
  earned lease outlives the save; a disposed lease answers no late request.
- Replies are offered and admitted only once the exact verified root of the
  thread is loaded in its channel; channel availability stays separate.
- A window is owned before native creation: scope change or disposal during
  the await retires it and destroys what native created; failed creation
  releases the reader and composer.
- Web links in a pop-out go to the OS opener; only buzz: links go to main.
- Image review hides Copy image (no media_copy_image authority).
- Linux/Windows: closing main destroys unguarded companions and asks
  guarded ones first; main destruction closes every companion.
- Native tests: caller gating, per-label download isolation, guarded
  close interception, capability contents.

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

… before closing any companion

A companion lease request carries the read-intent revision its event saw;
main grants it only while that revision is current, so intent formed before
a manual unread cannot become a new read when it arrives late. Views carry
main's revision and refresh on unread changes. On Linux/Windows main close
asks guarded companions first and closes nothing until accepted.

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

… thread tabs

FOUNDATION edit authorized by jaw (thread buzz-feature-popout-window,
2026-11-04): conversation.registerTabAction adds an entry to a conversation
tab's menu after the host's own actions, shown while its matcher passes for
that tab's {channelId, threadRootId?} target. The Pop-out windows plugin
registers Open in new window for thread tabs.

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

…; pop-out windows register theirs

FOUNDATION edits authorized by jaw (thread buzz-feature-popout-window,
2026-11-04). The communities service owns exit holds: select() waits as a
pending selection while a registered feature holds work a community exit
would discard, and runs its continuation only once selected. The shell
shows one Switch community? dialog for pending selections and, through the
existing single-slot departure guard composed with unsaved Settings, for
navigations that would change community before their route commits; Keep
working preserves route and community. Navigation-driven selection forces
because the guard already asked; the invite path sequences its open after
selection; the sign-out confirmation lists the holds. Pop-out windows
report held companions (native now forwards the guard action) and
register them through communityReader.holdExit.

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

…vigation; join keeps selection pending; organization sign-out asks

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

…ts session revision

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

…enabled by default

The desktop catalog comes from the native plugin manager, not the frontend
bundled list; without this the plugin never activated on desktop.

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

…nce too

No second copy of the colour literals: a view reporting only dark builds a
bare Appearance and asks it, so the pinned test covers that path as well.

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

The header shows the icon the conversation's tab has (hash, lock, the DM's
person, the Solo bubble; the thread mark for a thread frame) with an
accessible kind label, and a DM is named by its people as tabs and Inbox
name it. The native title carries the kind where no icon can: "#design",
"Ada (DM)", "Planning (Solo chat)", "Thread in …". Main projects kind and
the DM picture; the native DTO validates both.

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

…lugin chat icons

Signed-off-by: Jonathan Andrew Wolter <[email protected]>

Main projects a bounded member preview (count, up to three to picture —
agents for a Solo chat, people otherwise, pictures first, names through
the identity service) and requests their profiles as its own header does.
The companion renders the same avatar stack; choosing it opens the
conversation's members in the main window (the conversation itself for a
Solo chat, which has no Members surface). New companion action openMembers.

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

…ed before filtering

AvatarStack takes an optional total so a sample of a larger set shows the
right overflow without placeholder items. The projection requests the
bounded roster's profiles as main's header does, so a late agent flag or
picture changes the preview and count.

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

Main projects the agents working in a frame's conversation from the same
live evidence its indicator reads (current activity, stop controls, step
and status text, thread scope), bounded for the native DTO. The companion
renders the same incoming-message placeholder with the current step, a row
per agent (View activity opens in main) and Stop. Stop is a composer-bridge
operation admitted by the top frame, which re-derives the controls at that
moment and refuses work that has already ended.

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

…main's state owner

A conversation frame now includes work in its threads, as main's channel
indicator does (only a row's own live bubble takes it over there, which
companion rows never have). The stop operation answers as main's interrupt
does ({lifecycle, running}) and the companion drives useWorkStops with it:
lifecycle stops complete, hosted work waits the bounded retry window with
main's notices, nothing-running is reported.

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

A plugin's chat icon can now describe itself in data (ChatIcon.describer:
describe + watch), so a host can draw it where the component cannot run.
registerChatIcon takes the describer as a second argument and validates
it. The GitHub plugin describes its linked pull request's state; the
pop-out projects a Solo chat's first describing contribution, watches it
while the frame lives, and the companion draws the design-system artwork
with the sidebar's tone colours.

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

…n; watches and lookup made safe

Only the first chat icon contribution is shown, as in the sidebar; one
that describes nothing leaves the default. Watches are reconciled on every
projection, so a Solo chat converted to a channel releases its watch at
once. The catalog lookup is an own-property check, so a prototype key in a
projected token draws the default instead of failing the renderer. Merged
pull requests take the sidebar's purple.

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

…ontract now requires

Post-rebase fixup: main's ReadStateStorage gained capture().

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

…ut confirmation too

While server discovery is pending or failed, the root account's own row
is the only one shown; it now receives the exit holds like the listed
rows, so a pop-out's unsent reply is named before signing out.

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

…indow

The channel header menu shared the sidebar's action builder and already
had it; the Solo header built its own list. Contributed conversation
actions now render through one shared ConversationActionItems in the Solo
header and the Solo sidebar rows, right after Copy link in each.

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

… too

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

… as its header does

The Solo access dialog lives in the main-view header, not on a route. The
pop-out shows the chat in main, then hands the header a session-fenced
request (soloAccessRequests, like message-action handoffs) that only the
header showing that chat in that session takes.

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

… it, as main's row does

Main presents work tied to a request message as a live bubble under that
row (step, status, Stop) and keeps its footer indicator for agents no row
presents; the pop-out projected only the footer, so a hosted agent's work
on a request showed as "Only typing updates" with no Stop. Rows a live
turn or local request names as trigger now carry live[], computed with
main's requestWork/workStop; the companion renders the same bubble under
the row; the footer leaves those agents to their rows; Stop admits row
controls too.

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

stopWork searched only the replies for row controls; a hosted turn whose
retained trigger is the thread root showed Stop but refused it once its
raw records were trimmed. The root is now searched with the rows; test
covers a hosted turn with a retained trigger and no raw records.

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

…channel window; the page no longer scrolls past its content

Main's channel view shows a thread's live work on the thread root; the
pop-out matched only the exact request message, which is not a channel
row, so a request made in a thread had no bubble or Stop there. Live
requests are now mapped to the shown root in conversation frames, with
Stop scoped to the exact request. The companion document is pinned to the
viewport (html/body/#root overflow hidden) so only the message list
scrolls.

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

With a waiting and a working request in one thread, the bubble showed the
working one while Stop addressed the first local entry. requestScope now
prefers working, then waiting, then failed, as requestWork does.

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

… it, as main does

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

…editor once it connects

The companion composer connects to main asynchronously, so a focus moved
when the thread frame appeared landed on the log. The thread frame now
rests focus on its log and passes that owner through MessageComposer's
autoFocus handoff, which focuses the editor when it is ready and yields to
any focus move meanwhile; covered with the real owner/client bridge.

Co-authored-by: Jaw-fable51-pi <27b9430246cf506d04fedbbb39d0126ad17496a0e41bd82d39e35860de80f3d0@buzz.block.builderlab.xyz>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>

Main saves each open pop-out's target, drilled frame and screen frame per
origin:viewer partition and reopens them unfocused where they were once the
relay session is ready and the roster still has the conversation. Closing a
window forgets it; quitting keeps it. Native reports moves and resizes after
they settle and sends no closure notice while the app exits, so a quit never
clears the saved list.

Co-authored-by: Jaw-fable51-claude <7b068d2e5c4ec472d16a8b1241b9d1431d28caef5fa40cd5c0f9c12344b9a08d@buzz.block.builderlab.xyz>
Co-Authored-By: Claude Fable 5.1 <[email protected]>
Signed-off-by: Jonathan Andrew Wolter <[email protected]>
Co-authored-by: jaw-gpt56sol <ea4d48fe3c0a6de67bdc4128679b983e511642f2579429941cfcdf0eede927fb@buzz.block.builderlab.xyz>