Model screens, chat Enter to send, centred windows and Reconnecting (desktop part of #116)

[SashaMIT]

Part of #84
Part of #86

The desktop-visible changes that were in #116, split out as agreed so #116 is phone-only. Draft on feat/0.7.1-models (77c83c56d); merges after #80.

Model screens (#84)

• System → Models uses the standard pc2 cards and rows: Approval Lens, On this Home and Hosted sit in groups with the same type sizes as Security and Appearance; the hosted form puts its title first with label/control rows. IDs, copy and action order unchanged.
• System: a local model's first action reads Download (it fetches and verifies the files) and is painted with the accent, like Retry and Open in Assistant. Marketplace keeps its compact Get.
• Inbox: hosted route details read as label and value rows (same text); long values wrap.
• Marketplace: Models section intros, status lines and the Shared with me / Access through People cards use the store row type, and the cards stop at 640 px.
• Assistant: selected-model facts use muted labels and brighter values, like the picker, Inbox and Marketplace; the composer's model name stays on one line and ends in an ellipsis when the row is tight.

Chat (#86)

• Enter sends, Shift+Enter starts a new line; IME composition is ignored. On a phone, Return keeps adding a line.

Home (#92)

• Desktop windows open centred in the workspace instead of near the top left.
• Reconnecting: when the gateway stops answering, the host page reports it (only requests that never reached the gateway, or a proxy's 502/503/504), retries every 3 s, and the bar shows a dot and "Reconnecting…" in a live region; Notification Centre explains. The shell accepts the message only from its trusted parent. Unit-tested in verify (home-link-status.test.mjs).

How it was split

Each commit is the desktop part of the matching commit from #116. The phone-only parts of three of them (System and Assistant settings 44 px targets, the phone Reconnecting dot and its phone smoke probe) stay in #116 as their own commits. Asset versions: system-models-20260929a/b, marketplace-20260929a.

Gates

• home-entropy-check, vendor-ui-tokens.sh --check and git diff --check pass at every commit.
• Source gate 14/14; the non-Rust just verify steps; system-uiux-layout/-behavior, inbox-product-layout/-behavior, marketplace-product-layout/-behavior, chat-room-product-behavior and home-shell-regression smokes.
• model-management-browser-smoke and model-selection-browser-smoke time out at the same step on feat/0.7.1-models itself (waiting for Marketplace's Get button and the Assistant model menu); not changed here.

Made with Cursor

[andersalm]

@SashaMIT thanks for splitting this out of #116. Please add "Part of #84" and "Part of #86" to the description so it shows in those issues. When it leaves draft, request Irzhy for the Chat part (he owns #86).

[SashaMIT]

Added Part of #84 and Part of #86. It is still a draft, so I have not requested Irzhy yet.

[andersalm]

Independent adversarial review (Codex, 2 October 2026), exact head c4dddfbb51677cae28f7ffd522d6e6afe1777e36.

VERDICT: FAIL

Blocking findings:

• [P2] capsules/chat-room/browser/chat-chrome.js:112: Phone Return submits the draft. The guard uses dataset.elFormFactor, while this head supplies neither a setter nor a data-el-form-factor attribute. The exact candidate at 390px with its ordinary document setup submits once and prevents the newline. The refused-case assertion fails. Include phone detection and a Return test in this candidate before Home on a phone: Home screen pages, phone title bars and stage, sheets, 44 px targets (phone-only) #116 follows it.
• [P2] capsules/home/browser/home-link-status.js:48: After a 503 followed by an ordinary HTTP500 response, reachable() remains false and Reconnecting stays set. Host callers clear state only when their fetch resolves. The exact-module recovery assertion fails. Clear the connection warning when an ordinary gateway response arrives, while preserving its error/sign-in handling.

Checks: link tests7/7, existing Chat behavior smoke, Shift+Enter and IME guards pass. Message tests refuse a wrong source, opaque origin and foreign origin, and accept the trusted parent. Diff whitespace and read-only integration with develop@829a24ad pass.

Non-blocking notes: none.

Not checked: installed Home, real phone/IME behavior, browser UX and full verification. The current Chat smoke omits Enter coverage. Sasha retains repair and merge ownership.

[SashaMIT]

Both Codex P2 findings are fixed at d7897bd73. This is round 2 of 2; please re-review.

1. Phone Return (chat-chrome.js): 5970f9a4e

• On this candidate alone, the device screen now stands in for the form factor. A screen 640 px wide or narrower, or a coarse pointer with a screen 640 px high or lower, counts as a phone. This is the same phone class the Home shell uses. Chat cannot use its own window width, because on a desktop that width belongs to the app window.
• When the shell sets html[data-el-form-factor] (Home on a phone: Home screen pages, phone title bars and stage, sheets, 44 px targets (phone-only) #116), that value decides.
• scripts/chat-room-enter.test.mjs covers:
  • desktop Enter sends through Send;
  • Shift+Enter, IME Enter (isComposing, keyCode 229) and a disabled Send keep the message;
  • phone Return adds a line, upright and sideways;
  • the shell's form factor takes over.
• The phone test fails on c4dddfbb5 and passes here.
• A real-browser check ran in Chromium and WebKit. On desktop, Enter sends once. With iPhone 14 emulation, upright and landscape, Return adds a line and sends nothing.

2. Reconnecting after a 503 then a 500 (home-link-status.js): 97d38c0f7

• Any HTTP status other than 502, 503 or 504 is a gateway answer. reportFailure now clears the link state for it and cancels the retry. It still returns false, so the caller keeps its error and sign-in handling.
• The new test sends a 503 followed by a 500, 401 or 404. It fails on c4dddfbb5 and passes here.

3. CI: d7897bd73

• source-gate now runs home-link-status.test.mjs and chat-room-enter.test.mjs with the other product UI source proofs.

Checks run locally

• The source-gate product UI proofs pass, as do both entropy checks and ci-release-policy-test.py. The branch merges cleanly with develop@fe033fea6.
• These browser smokes pass with Playwright Chromium: Inbox, Marketplace, Documents and configured Chat layout.
• The People, Archive and Library layout smokes are fixed by ci: run the browser layout smokes in test-capsules #135; their old expectations fail on develop too.

#116 carries this fix through merge 7a339beaf. Sasha retains checks, integration and merge ownership.

[andersalm]

Independent adversarial review (Codex gpt-6-astra, 3 October 2026), exact head d7897bd.
VERDICT: PASS

Blocking findings: none.

Round 2 of 2. Both round-1 P2 findings are fixed:

• Phone Return: chat-chrome.js:104-132 uses the device screen until the shell supplies a form factor. The new phone test passes here and fails against round 1 with true !== false for Return prevention. In Chromium with the candidate's actual Chat assets and local fixture responses, Return inserted a newline with zero submissions at 390x844 and 844x390, without a shell form-factor attribute. Desktop Enter submitted once through Send.
• Reconnecting: home-link-status.js:42-60 clears the warning and cancels the retry on an ordinary HTTP error, while returning false for caller error handling. The new recovery test passes here for 500, 401 and 404; it fails against round 1 at the 503-to-500 assertion with false !== true. A Chromium probe using the exact fetchJson, link-status and shell-rendering modules received real local HTTP 503 then 500 responses: the rendered warning appeared, then cleared; zero retries fired over the next 3.2 seconds.

Local checks: node --test scripts/home-link-status.test.mjs scripts/chat-room-enter.test.mjs passed 12/12. node scripts/chat-room-product-behavior-smoke.mjs passed. For the negative checks, I ran the current tests against c4dddfbb51677cae28f7ffd522d6e6afe1777e36 with only their module URLs redirected in memory; exactly the two regression tests failed. Both temporary worktrees stayed clean and were removed.

The six-file delta since round 1 changes device detection, link recovery, tests and CI/verify commands. It changes no gateway routes, CSP or frame policy. The published source-gate check is successful.

Non-blocking notes:

• Browser proof used local fixtures. Installed Home, hardware phone/IME behavior, WebKit and the sign-in UI were outside this review. Sasha retains checks, integration and merge ownership.