[wmfeht]

Closes #35

Stacked on #34. The base is #34's branch (claude/friendly-cray-ftedea), whose watermark c94eeb0 is where this range starts, so the diff shows only the new range. When #34 (and #32 under it) merge, retarget this PR to main. This session could push only to its own branch.

Upstream range

c94eeb0020fa1154e11c741888f1b56d92ce70d6 → bf26829b4fd74c1f25ac170aad9521a633234a30: 8 PRs, no direct pushes. sources.yaml holds the new watermark.

gh is unauthenticated here, as in #28, #32 and #34. So drift and qa --pr ran on scratch data/prs.jsonl rows built from the local upstream clone: first-parent commit, file list, and UTC commit time. PR bodies, issues and comments were read through the GitHub MCP tools. data/prs.jsonl is not committed.

PR	Type	History row on
lgse/strata#1822 Enter target outline	feat(filter)	browser/search/filter
lgse/strata#1799 release notes grouping	chore(release)	none (ignored by drift)
lgse/strata#1789 opt-in STL thumbnails	feat(thumbnails)	browser/thumbnails/workers
lgse/strata#1827 folder in window title	feat(window)	app/window (scope)
lgse/strata#1829 ctutils RUSTSEC bump	fix(deps)	none (ignored by drift)
lgse/strata#1825 signed installer, default integrations	feat(installer)	app/packaging/installer
lgse/strata#1811 activation portal re-entry	fix(startup), triage	new integration/file-manager-interface/service-activation
lgse/strata#1800 reopen tabs + column moves	feat(browser), triage, batch	browser/tabs and browser/view-modes

Per node

New and promoted nodes

• Promoted: integration/file-manager-interface.md → file-manager-interface/index.md. The id is unchanged.
• New: integration/file-manager-interface/service-activation, "Launched-program GDK_DEBUG restore".
  • Origin {issue: lgse/strata#1810, pr: lgse/strata#1811}.
  • code: [src/child_environment.rs], tests: [src/child_environment/tests.rs].
  • It passes the Nest rule, so it takes the triage row. Its Behavior covers which launched programs get the original GDK_DEBUG. Its Design records the Flatpak rationale.
  • Added to site/unguided.yaml ("New since v1.0.0…"), per Sync step 4.

app

• app/packaging/installer (#1825). Summary, plus a rewrite of these sections:

  • Download and verification: the Ed25519 manifest checked with openssl, the size caps, the signature and digest failures, and the order of checks. The gh/.sha256 bullets are removed.
  • Setup menu: Recommended and Customize select everything offered.
  • Unattended: everything installs by default, with --without-* flags.
  • Releases without the portal or udiskie warn and skip when the option was a default, and still exit on an explicit --with-*.

  Design: the #731 and #331 bullets are replaced by #1817 comment rationale, the trust-root rule and the default-on rule. docs gains docs/signed-updates.md. The #334 gap is dropped (see Needs a person).

• app/infrastructure: new ### File manager activation group (#1811). It covers the --gapplication-service no-portals re-exec, which launches are untouched, flag detection, and reuse by later launches. Three Design bullets, and docs gains docs/packaging.md. No row: the row is on the new child.

• app/window: #1827 row. The false bullet "A browser window's title is 'Strata'" was dropped; title behavior lives on browser/tabs.

• app/shortcut-reference: the F1 "Reopen the last closed tab" bullet (#1800), with no row.

• app/packaging: reviewed_at only.

browser

• browser/search/filter (#1822). code gains src/ui/enter_target.rs and tests gains src/ui/enter_target/tests.rs.
  • New ### Enter target group: the outline, pick rule, query edits, same-query updates, scroll-follow, Down, Space, and the 10xer off-switch.
  • The Results and Design bullets on kept selection are now limited to same-query updates and to search results.
  • Design gains the #1628 → #1643 → #1765 history and the pick rule.
• browser/view-modes/columns: Columns-specific Filter field bullets: Enter with no pick, Down, Right. These cite #1822 with no row.
• browser/thumbnails: new ### STL model thumbnails group (#1789). The false Formats bullet ("STL keeps its icon") is fixed. Four Design bullets. tests gains tests/qa/mutations/stl-thumbnails-live-preference.patch.
• browser/thumbnails/workers: #1789 row. One STL render at a time, a one-shot sandbox, and Quick Preview not waiting for the slot. Design gains the #1788 prototype figures.
• browser/tabs:
  • #1800 row and a ### Reopening group: Ctrl+Shift+T, 20 entries, per window.
  • ### Window title group (#1827/#1824).
  • Localized special names.
  • tests gains tabs/tests/reopen.rs.
• browser/view-modes: #1800 row for the column moves, because src/ui/browser_modes.rs is its code.
• browser/view-modes/list/column-layout: the false Reordering bullets (live swaps, saving on every swap) are rewritten for the 3 px insertion line and apply-on-release. They cite #1800 with no row.
• reviewed_at only: context-menu, folder-customization, navigation/startup-arguments, sidebar, view-modes/density, view-modes/list.

integration and devices

• integration/file-manager-interface (parent): Design gains the 25 s cold-activation wait (#1810) and a pointer to the child. The packaging bullet now says install.sh installs the service by default since #1825.
• integration/portal-file-chooser/setup: the Design "Replacement is opt-in" bullet now says the installer installs it by default (#1825).
• devices/volumes/udiskie-unlock: the Summary says the installer enables it by default on Arch-based systems with udiskie on PATH (#1825).
• devices/volumes/encrypted: the Design "opt-in handoff" bullet now cites the same default.
• reviewed_at only: 10xer-mode/file-chooser, 10xer-mode/search, open-with, open-with/terminal, portal-file-chooser.

preview, settings, operations, remote

• settings/themes: the STL model thumbnails switch: off by default, its subtitle and the saved key (#1789).
• settings/preferences: the 3d/mesh/printing search aliases (#1789, unverified).
• preview/preview-panel/model-views:
  • ### Background thumbnail renders: SIGKILL plus a detached reaper on cancel, the 12 s deadline, or a monitor failure.
  • Design: no wait for reaping.
  • Known gap: a stuck helper may overlap a later render (#1789 body).
• preview/preview-panel: drawer and Quick Preview models keep an opaque surface (#1789).
• preview/preview-panel/layout: Known gap from the #1822 body: after a query edit drops a previewed pick, Columns and Icons show "No preview for this selection" while List closes the drawer.
• preview/preview-panel/sandbox: related gains model-views.
• remote/file-providers/network-locations: the "window title" clauses in two #1726/#740 bullets are removed. The OS title is now owned by browser/tabs, and related gains browser/tabs.
• reviewed_at only: operations/progress/jobs, preview/preview-panel/documents, remote/file-providers/external, settings/preferences/storage.

Every node drift listed is now at reviewed_at bf26829. Nodes whose content changed are review: draft.

QA

All 8 sweeps' reviewed_at are now bf26829.

• app
  • Retired the .sha256 probe and the gh stub.
  • Setup: build signed-release fixtures by copying install.sh with the fixture key.
  • New installer cases:
    • one bad and one good signature;
    • the 32,768/32,769-byte boundary and a one-byte-longer archive;
    • openssl without Ed25519;
    • --with/--without ordering;
    • the SMB/RAW plan with the packages already installed.
  • app/infrastructure: cold OpenDirectory timing through xdg-desktop-portal 1.22.1, with GDK_DEBUG variants set through the activation environment; later launches.
  • The window-title probe is replaced by a hand-off to browser.
• integration
  • New ### …/service-activation probes:
    • children with a non-UTF-8 or an unset original GDK_DEBUG;
    • the udiskie toggle restart's environ;
    • a Flatpak app's chooser.
  • Hand-offs in both directions with app.
• browser
  • New probes for:
    • filter: long lists, remote shares and Trash, a pick on the top row during background updates;
    • STL toggles across views and the chooser, plus many STLs;
    • tab reopen after a 10xer close and while the location editor is open;
    • column-drag edges;
    • titles with shared basenames and locales.
  • The Escape mid-drag column probe is reworded.
• preview: an STL folder on NFS at a native path plus a local folder; Quick Preview during a backlog; a hung-NFS helper followed by a local render.
• settings: STL search aliases and locales; invalid stl_thumbnails values.
• devices: Scope and Hand-off name the installer default and --without-udiskie-unlock.
• operations, remote: reviewed_at only.

Tier-1 plans (qa --pr N --tier 1). No plan lists "Unmapped changes".

• #1822: primary browser/search/filter (owner), view-modes, columns, list, app/window, 10xer-mode/file-chooser and search, app/infrastructure. Sweeps: app, browser, integration (src/style.css forces app).
• #1789: primary browser/thumbnails/workers (owner), thumbnails, preview-panel, model-views, sandbox, settings/themes, settings/preferences and storage, plus shared-test nodes. Sweeps: app, browser, preview, settings.
• #1827: primary app/infrastructure, browser/navigation/startup-arguments, browser/tabs. Sweeps: app, browser.
• #1825: primary app/packaging/installer, app/infrastructure. Sweep: app.
• #1811: primary service-activation, app/infrastructure, app/packaging, context-menu, open-with, terminal, jobs, documents, external providers, settings/preferences. Sweeps: app, browser, integration, operations, preview, remote, settings.
• #1800: primary browser/tabs, view-modes, column-layout, density, folder-customization, app/shortcut-reference, portal-file-chooser, settings/preferences/storage, app/infrastructure. Sweeps: app, browser, integration, settings (style.css, preferences.rs and locale triggers).
• #1799, #1829: app/infrastructure only.

Needs a person

Placements

• Column moves (#1800): the row is on browser/view-modes, which owns browser_modes.rs. The Reordering bullets stay on list/column-layout, as they have since #1651, whose code is only column_options.rs. Pick one node for both.
• STL admission (#1789): the one-at-a-time rule lives in src/ui/thumbnail.rs (browser/thumbnails), but it sits on workers beside the existing admission bullets, which already have the same mismatch.
• Window title (#1827): the row is on app/window by scope, while the bullets are on browser/tabs, which implements them. The initial "Strata" comes from src/ui/window.rs, which no node owns.
• stl_thumbnails key: it is saved in src/ui/preferences.rs, which no node owns. The bullet follows the show_thumbnails precedent on settings/themes.
• Reaper on model-views: src/sandbox/model.rs is model-views' code, so a background-reaping bullet now sits on a node about camera views.
• src/ui/chooser/tests/keyboard.rs: its new #1822 test, enter_in_the_filter_field_chooses_the_top_result_in_every_view, belongs to integration/10xer-mode/file-chooser tests, not to filter.

Proposed child, not created: browser/search/filter/enter-target. Origin #1643/#1822, its own module src/ui/enter_target.rs, and its own tests. It would promote filter.md to filter/index.md.

scopes.yaml: startup stays null. No new scope was added.

Possible upstream bugs, found by code reading. An lgse/strata issue search found none covering them; no issue was filed.

• udiskie relaunch keeps the portal-less environment. src/portal_setup/udiskie.rs:997-1008 (spawn_detached_with) does not call child_environment::restore_command.
  • Toggling encrypted-volume unlock in Settings, in a service-activated Strata, restarts udiskie with GDK_DEBUG=…no-portals and STRATA_ORIGINAL_GDK_DEBUG.
  • Its strata --udiskie-hook children inherit both too.
  • Lower-impact sites behave the same way: src/services/integration_catalog.rs:697, src/services/update_install.rs:763, and the lsblk calls in src/ui/window/drive_ops.rs.
• README contradicts install.sh. README.md:~417 says "Unattended installer opt-in is --with-udiskie-unlock", and README.md:63-64 says the file chooser and udiskie are opted into through the installer. Since #1825, both are on by default where supported.
• SMB/RAW shown when already installed. On every Arch system, resolve_default_integrations sets WITH_SMB and WITH_RAW, so an unattended plan prints "+ Windows network shares" / "+ Camera RAW support" even when the packages are installed. Recorded as (unverified) on the installer.

Deferred or limitations with no issue (not recorded as gaps):

• The window title carries the folder basename, not the full path the #1824 comment asked for.
• No maintained cold-activation regression test (#1811 comment).
• A closed tab's BrowserView is still alive 5 s after close (#1800 review).
• The README's default bootstrap still pipes main/install.sh into bash. The old gap cited the now-closed Strengthen Strata’s installer and self-update security lgse/strata#334, so it was dropped.

Site (for the release docs run, not this sync):

• site/src/reference/preview-sandbox.md:~124: "There is no geometry thumbnail for STL".
• site/src/reference/install.md: gh/.sha256 verification and opt-in defaults.
• site/src/reference/portal-file-chooser.md:~116: "installer opt-in".
• Ctrl+Shift+T is undocumented.

(unverified) claims added (33):

• app/infrastructure: a no-portals flag in any separator or case.
• installer:
  • the "stay unchanged" plan condition;
  • the other six required commands;
  • the 134,217,728-byte message;
  • the explicit-flag exits for the portal and udiskie;
  • the default-skip path and its warning;
  • English error lines;
  • SMB/RAW planned when already installed.
• shortcut-reference: the 10xer outside-chooser condition.
• filter: deselect returns to the top; the 10xer off-switch.
• columns: Down selects the top result and makes it the pick; Right moves the caret.
• tabs:
  • every close path records the tab;
  • closed tabs are not saved;
  • right end past the old index;
  • blocked or last-tab closes record nothing;
  • modal keeps the history;
  • a deleted folder gives a Retry tab;
  • ~ and / titles;
  • a background tab leaves the title alone;
  • full names over 22 characters.
• thumbnails: #cccccc shading and the default camera; .STL case.
• column-layout: line placement before a heading and at the end; a no-op drop.
• service-activation: a process not re-exec'd passes GDK_DEBUG through.
• model-views: the monitor-failure kill.
• settings: search aliases; switch position and missing-key default.

Review loop

Three rounds, with fresh reviewers each round. I checked each blocking finding against the code or sources before accepting it.

• Round 1: 4 reviewers. Blocking findings, all confirmed and fixed:
  • #1811 placement: it passes the Nest rule, so the new node now takes the row instead of the fallback.
  • Launched-program scope: the claim was narrowed to the listed launch sites, after confirming the udiskie relaunch is not covered.
  • Archive size: an oversized archive fails the download step (curl --max-filesize), not the digest check.
  • Filter history: its Design order was wrong (#1628 → #1643 → #1765).
  • Filter selection: the Design claim on kept selection contradicted the in-place filter.
  • udiskie default: it requires an Arch-based system.
  • STL search placement: the search bullet was on settings/themes, while search.rs is preferences code.
  • Reaper Design: a sentence described a pre-merge revision.
• Round 2: 4 reviewers. Blocking findings, all confirmed and fixed:
  • Behavior placement: the re-exec bullets live in src/main.rs, so they moved back to app/infrastructure. The child keeps only the restore.
  • Pick bullet: "a pick moves the outline" was false; a pick removes it (PR How-to-test step 3).
  • Preview gap placement: the drawer gap moved from preview-panel to layout, which owns session.rs.
• Round 3: 2 reviewers.
  • Duplicate fixed: the transparent-thumbnail bullet appeared on both preview-panel and browser/thumbnails.
  • PR description only: the udiskie relaunch bug (above).
  • Minors fixed: wording scope, unverified marks, splitting long sentences, the network-locations "window titles" clause, and probe duplicates.
• Disputed, left as is:
  • Manifest size message. Round 2 said current curl aborts oversized downloads mid-transfer, so the bullet that described install.sh's own size message was dropped. Round 3 said that message still fires when the size is not known up front (install.sh:1023-1029). The node now says only that curl's cap fails the download step.
  • Layout gap. A reviewer read the #1822 "existing behaviour… left unchanged" note as not a gap. It stays, as a limitation stated in a merged PR body.
  • Workers Known gap. Round 2 asked for a Known gap on workers for the helper overlap. Round 1 had dropped it as a duplicate of the model-views gap, so only the Behavior qualifier was added.

check: 0 errors and 25 warnings, all site-release staleness (v1.0.0 against v1.1.0). Unit tests pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Fazi6bx93e32CsuE8zqzMx