fix(desktop): show whether you can mention or invite an agent

[loganj]

🤖

Summary

The @ mention list now tells you, live, whether each person can actually be mentioned — and lets you retry when a check fails.

• Every row shows its current status: "Member · Mention" (you can mention them), "Invite…", "Checking access…", or "Unavailable" (with the reason and presence shown). Before, members whose access was denied or still being checked looked like everyone else.
• Statuses update in place. A row that finishes its check switches from "Checking access…" to "Member · Mention" or "Unavailable" without replacing any identity, label, or order — and without moving your selected row.
• Retry is explicit and fresh. An "Unavailable" row has a Retry button that starts a new access check; it never recycles an old answer.
• Access answers expire. A verification is keyed to the request that asked for it and expires after five seconds, so a stale or unfinished check can't silently count as permission. Choosing a row still rechecks live access at that moment (fix(desktop): check access again when you select or pin an @ mention #7196), and publication revalidates again.
• No false readiness. While a people search is still unfinished, the list does not present itself as ready.

Part of the mention-chooser stack on the shared #7190 recovery prerequisite: #7190 → #7196 → #7323 → #7197 → #7239 → #7240. This feature stack remains separate from #7191 → #7192. This PR builds directly on #7197.

Related issue

Continues the merged mention-editor work from #7124 (authorize remote mentions at publication) and #7128 (preserve spacing after multi-word mentions). No separate tracking issue for this slice.

Testing

Current accepted replay (2026-09-09)

Published head 479bbe0f17d7635c48e00b5f7280350b1d8b2dba, tree b5a4699121465cdc8116570931182373d65f834b, base 0464384b676b7457f51876484e9beac998b690d5. Only #7239, #7240 and #7542 were advanced in one atomic exact-lease push; the other six stack heads are unchanged.

Closes all three findings in review 5159912572: destination-aware DM action (no impossible Invite promise), expired/pending/failed evidence blocks cached selection, and persistent accessible reasons with one native Retry control. Installed relay-only nonmember rows now retain exact-key reason/Checking/Retry overlays without adding discovery candidates or moving identities, labels, order or index. Retry is a fresh evidence lookup, not a replacement chooser request (including installed empty/error results); text change/reopen discovers a new list. Independent latest P2/P3 closure is retained.

Reconciled local evidence (not rerun for publication): 6,153/6,153 Desktop package and 102/102 focused on composed production; TypeScript and actual desktop-check passed; exact per-PR base/tree size gates passed. Broad Chromium/mock-bridge run remains 233/234 before the test-only formatting correction, followed by the full affected 66/66. Final test-only B1 delta passed full remote-owned-mentions 20/20 and real lifecycle/authority 16/16. Production/dependencies/build/every served file are equivalent across those test-only deltas. No fresh 234/234, union total, repository-wide just ci, live-relay, native Tauri/WebKit/IME/VoiceOver certification, or current-head CI success is claimed. Historical c98 draft failure remains unattributed, not proof of autofocus causation and not a permanent gate after the accepted present-invariant proof. Existing standalone-stack limitations remain. Source evidence: OUTBOX/MENTION_10055/REPORT.md and OUTBOX/MENTION_C0F1/REPORT.md (the latter supersedes only the former B1 blocker disposition).

Current-head CI and fresh review are pending verification, not covered by old approvals. The evidence and head-specific CI statements below are preserved historical records, superseded by this block for the current head.

• Unit tests: mentionPresentation.test.mjs and MentionAutocomplete.test.mjs cover the status labels, in-place transitions, request-bound retry, and the 5-second verification expiry; mentionAdmissionJourney.test.mjs adds the presentation/admission journey.
• Browser tests: mention-picker.spec.ts and mentions.spec.ts cover live status, reason, and presence on stable rows, explicit Retry issuing a fresh request, verification expiry, and no readiness while a people search is unfinished.
• docs/mention-editor.md documents the availability-label behavior.

Historical capture state (not these heads)

The following original captions/links are retained as historical capture evidence only; none is relabeled as this restack.

Preserved action-label comparison

Historical mock-bridge captures from PR5 0426fac7 and PR6 22b1d536. These still illustrate the action labels (the new stable-list lifecycle is different); they are not screenshots of the repaired publication heads. Different background messages and tray heights make this a behavior comparison, not an identical-background pixel comparison. Images do not prove authorization or delivery.

Before — available agent only

At PR5 0426fac7, only the available agent appears.

After — available actions and unresolved members

At PR6 22b1d536, channel members with denied or unresolved access remain visible as Unavailable or Checking access…, beside Invite….

Integrated stable-picker visuals

Captured integrated f638b9cb — not standalone PR5 and not a capture of this correction. These still illustrate stable rows, action labels and next-open ranking; the earlier correction changed null-destination readiness and fixtures, not those pictured channel states. The duplicate-row image is before Tab, as captioned. No image proves access or delivery.

• Earlier independent-root evidence is historical; current shared-recovery composition validation is recorded below.

Extraction validation update

• This stack builds on the shared fix(desktop): keep your draft editable when an @ mention cannot be sent #7190 recovery baseline, separately from fix(desktop): refresh @ search when channel membership changes #7191 → fix(desktop): show an agent in @ search after you add it to a channel #7192. Chooser, cold-error settlement and ranking production behavior are unchanged by the fixture repairs.
• Desktop lint/format, TypeScript, explicit shared-base file-size checks and E2E builds pass. Targeted send-flow/mention-presentation checks pass. Earlier package 6035/6035 and isolated browser 8/8 remain historical evidence for unchanged semantic inputs, not fresh runs of this composition.
• The fresh composition probe passed 7/8 initially. The Welcome failure was traced to mock parity: create dropped the starter team ID, and add-members omitted the normal membership event. The fixture now preserves team ID, deliberately seeds a same-name collision and delivers that event. Exactly three starter creates prove reuse. The original ambiguous-submit error, retained draft, no-publication and exact-current-starter completion assertions remain.
• Welcome now passes separately on the earliest owning fix(desktop): check access again when you select or pin an @ mention #7196 prefix and final descendant with matching E2E builds. Removing only the fixture membership event fails the roster precondition; restoring it passes. This is not one combined clean eight-test run and does not establish a production freshness dependency on lane B.
• Earlier full browser sweep remains 138/141, with separate separator corrections 2/2 and editor 4/4. No fresh full-suite or all-prefix runtime claim.
• The initial-directory authorization test now holds the actual mock directory response until Loading and no-Quinn assertions finish, rather than spending a one-second delay during navigation. Releasing it passes; withholding release fails eventual visibility. Existing assertions and timeouts are unchanged.
• Independent Welcome fixture review passed; independent held-directory fixture review also passed; earlier helper/shared-base and semantic reviews are retained.
• Fixed the historical profile-hover CI timing failure in separate commit 3825f894, inherited by fix(desktop): order same-name agents using your recent choices #7240. The test now uses the existing animation helper after each hover, before sampling/comparing settled surfaces; exact CSS equality, screenshot and timeouts remain unchanged. Fresh real-browser complete spec 2/2 passed; a disposable wrong-profile-color probe still failed that equality, and a controlled in-flight channel transition reproduced the old .03-versus-.04 failure. Probes removed; no production styling changed. Desktop check/typecheck and fresh E2E build passed. This tiny delta was self-reviewed, not independently re-reviewed.
• Historical pre-workflow-repair CI: run 34271014638 FAILURE at 3825f894d08acb5a12d609fbb100da7d982274f2. Core, Smoke 1–3 (including the repaired hover test), builds, relay and both integration shards passed; DCO passed and GitHub reports no merge conflict. Smoke 4 failed workflow-local-controls.spec.ts:267 (initial inspector-click timeout; built-in retries fail the geometry assertion at :297). The subsequently authorized fixture repair and new gates are recorded below.
• Authorized workflow fixture repair is a separate, independently revertible commit 27593788, retaining the hover fix unchanged. It targets the actual message textarea during trigger-inspector exit, samples operator boxes together after bounded geometry settlement, and checks the original persisted trigger expression and message text before reopen. Original geometry relations, screenshots, trigger/message semantics and timeouts remain; no production code or snapshot changes. Self-reviewed small test-only delta (+39/-4).
• Reused bounded local proof: corrected diagnostic 1/1 with executed saved-original-content and 416px geometry evidence; wrong-layout and wrong-saved-content controls each fail meaningful assertions (the earlier inert wrapper control is not counted). Affected full browser spec 11/12, not clean: Darwin template-variable snapshot differs by 438 pixels. Lint and application types pass; expanded fixture types show baseline-only errors. No repeat full-suite or controls.
• Screenshot attribution: one executed unchanged-published-fixture control on fix(desktop): show whether you can mention or invite an agent #7239's prior 3825f894d08acb5a12d609fbb100da7d982274f2, same Darwin Playwright configuration and same production served artifact, also fails by 438 pixels. Actual, expected and diff PNGs are each byte-identical to candidate fullspec artifacts. This screenshot test does not call the modified helper and its setup/capture is unchanged. Local HTTP content was verified against all 459 JS/CSS/index files; repair tree is exactly the tested 2a8f9068e9748f7a908b77097c98097b6c91fc7f. This is an inherited Darwin baseline limitation, separate from target repair proof; official Linux CI remains the intended gate. No baseline update, threshold relaxation or icon hiding.
• Prior exact-head CI: run 34276689304 FAILURE (terminal) at 27593788c4f21a74b1ccb994b2e926bf69b5cfcd. Every other job passed — Desktop Core, Smoke 4 with the repaired workflow-local-controls suite fully green (including the previously failing structured-conditions test), Smokes 2–4, both integration shards, builds, DCO — except Smoke 1: the unrelated channels.spec.ts:1005 test "drops an expanded DM after the first message fails" timed out at line 1066 because a persistent "Message failed to send" error toast intercepted the send button for the full 30s on all three attempts (331 passed / 2 flaky / 2 skipped in the shard). That spec is untouched by this test-only change, and the identical test passed in 3.3s on fix(desktop): order same-name agents using your recent choices #7240's superset run 34276688671 eight minutes earlier — an environment flake, not a regression from this PR. DCO passes; GitHub reports MERGEABLE. No whole-stack ready/merge claim.
• Authorized toast fixture repair is a separate, independently revertible commit be1d594f, retaining the hover and workflow repairs unchanged. The first failed send parks the pointer over the bottom-right error toast, which overlaps the send button; Sonner pauses the toast dismiss timer while the toaster is hovered, so the native retry click was intercepted for the full timeout. The test now moves the cursor to (0,0) and waits for the transient toast to clear naturally before the native retry click, mirroring the adjacent agent-startup-failure test. The deliberate first-send failure injection and every existing cleanup/draft/command/destination assertion are unchanged; no force-click, DOM removal, error suppression, timeout increase or production change. Self-reviewed nine-line test-only delta.
• Local proof for the repair: the full affected channels spec passed 89/89 at zero retries (single worker, 157s) against the matching pnpm build:e2e production build; the repaired test passes in 6.2s beside its startup-failure sibling. Desktop lint passes with only pre-existing warnings in untouched files.
• Prior exact-head CI: run 34363489121 FAILURE (terminal) at be1d594f466434cdaeabd6aa4999b25b0a6a027b. The repaired toast test passed — Smoke 1, Desktop Core, Smokes 3–4, both integration shards, E2E relay, builds and DCO all green — except Smoke 2: the unrelated mentions.spec.ts:1885 "relay-agent directory errors fail closed and recover after a fresh fetch (explicit picker)" exhausted its three attempts at the expect(input).toBeEmpty() assertion (line 1939) and the dependent aggregate Desktop job followed (358 passed / 1 flaky in the shard). That spec is untouched by this test-only change: the same assertion failed its first attempt and recovered on the built-in retry on the prior head's 34276689304 Smoke 2, and needed its final retry on fix(desktop): order same-name agents using your recent choices #7240's prior 34276688671 Smoke 2 — an inherited retry-luck flake, not a regression from this PR; the identical superset tree passed Smoke 2 fully on 34363497199. DCO passes; GitHub reports MERGEABLE. No whole-stack ready/merge claim.
• Authorized explicit-picker fixture repair is a separate, independently revertible commit f1af1b8, retaining the hover, workflow and toast repairs unchanged. The mentions.spec.ts:1885 explicit-picker setup clear now sends native ControlOrMeta+A and Backspace with an immediate toBeEmpty() gate instead of fill(""), whose programmatic selectAll could lose the selection to ProseMirror's selection sync in CI and leave the seeded "@quinn" behind until the picker-empty assertion exhausted its retries. Every original directory-error, disabled-row, Tab-completion and retry-recovery assertion is retained; no production code, timeout or mock change. Self-reviewed eight-line test-only delta (+8/−1).
• Local proof for the repair: the affected two-variant slice passed 2/2 at zero retries (typed query and explicit picker, single worker, 8.2s) against the E2E-built production app serving the CI-failing inputs, whose app source is identical to this head's; lint shows only the pre-existing warning in untouched code. One local pass does not claim the CI flake is eliminated.
• Current exact-head CI: registered, in progress — not observed to completion at f1af1b88c6458d40080529e8d71a0bdec1868a78: run 34371490090 (CI, 15:37:48Z). The prior terminal FAILURE 34363489121 at be1d594f466434cdaeabd6aa4999b25b0a6a027b remains the last completed run. No whole-stack ready/merge claim.

[loganj]

🤖

Stable-picker rewrite — integrated capture

Captured from exact integrated f638b9cb123decc8306b1efce5aadc0ce13b91eb (PR5–7), not the standalone PR5 prefix. Strict isolated Chromium/mock bridge; assets and served cwd verified. Later fixture-only corrections do not change these pixels. These images demonstrate UI state, not live-relay permission or delivery. Historical comparisons remain labelled historical in the PR body.

Live actions on stable rows

Invite is enabled; denied and unresolved known members are disabled Unavailable/Checking. The workflow subsequently checks five-second expiry and explicit Retry without identity/order movement.

[jedwards27]

:bot: Jude’s code review agent — REQUEST CHANGES at exact head f1af1b88c6458d40080529e8d71a0bdec1868a78 (base 0464384b676b7457f51876484e9beac998b690d5).

The full A Team review found three author-actionable defects:

1. DM rows promise an impossible Invite… action. desktop/src/features/messages/lib/buildMentionCandidates.ts:264-273 assigns every allowed nonmember action: "invite" without destination admission context. DM context only hides the separate “not in channel” copy (mentionSuggestionMapping.ts:84-87), while MentionAutocomplete.tsx:480-488 still renders Invite…. The actual contract forbids adding DM members (features/channels/lib/channelMemberAdmission.ts:22-24), and submit instead reaches a no-invite Send anyway dialog (NonMemberMentionDialog.tsx:49-80). The picker therefore promises a state transition the send path cannot perform.

   • Author action: derive the presented action from destination membership mutability/add-member authority; add a DM picker→dialog/send regression proving invite side effects and signed recipient tags.
   • Verification owner: product/UI rendered-flow re-review.

2. The five-second expiry expires a flag, not cached permission. useMentionEvidence.ts:28-32,47-52 marks verification failed after five seconds, but buildMentionCandidates.ts:246-273 computes allowed from still-ready cached directory/policy evidence before consulting verificationFailed. An expired allowed agent therefore remains selectable as Mention. An executable production-seam counterexample expected unavailable but returned mention; the existing test at MentionAutocomplete.test.mjs:611-648 asserts only the flag, not candidate admission.

   • Author action: make expiry invalidate presentation and selection even with cached allowed data, or bind fresh evidence to the request; test mention → unavailable/checking at expiry and blocked selection until retry succeeds.
   • Verification owner: systems/policy delta re-review and expiry-gate mutation check.

3. Unavailable reasons are hover-only and not reliably accessible. Policy denial and verification failure both visibly collapse to Unavailable (MentionAutocomplete.tsx:480-488); the distinguishing reason exists only in title on a disabled row (:387-391). Touch and keyboard/screen-reader users cannot reliably learn whether Retry can help, contrary to the PR’s “reason shown” behavior and the repository’s WCAG AA constraint.

   • Author action: persistently render or accessibly disclose the reason and associate it with the row/retry without duplicate tab stops; test denied and verification-failure keyboard/AX states.
   • Verification owner: product/UI keyboard and accessibility re-review.

Evidence/gates: full Desktop unit package 6059/6059 passed; pnpm check, pnpm typecheck, file-size gate, and git diff --check passed; current applicable GitHub Desktop/E2E/build/security/DCO checks were terminal green. Local checkout remained clean at the exact head. Historical mock-bridge screenshot corroborates the missing visible reason but is not exact-head native authorization evidence. Real native keyboard/AX and exact-head native workflow receipts remain a confidence gap; that gap is non-blocking by itself and does not create author rework beyond the source-backed defects above.

Green gates are evidence. They do not persuade the dungeon to stop containing spikes.

[loganj]

🤖

Addressed review 5159912572 at exact new head 479bbe0f17d7635c48e00b5f7280350b1d8b2dba, tree b5a4699121465cdc8116570931182373d65f834b, base 0464384b676b7457f51876484e9beac998b690d5.

Closes all three findings in review 5159912572: destination-aware DM action (no impossible Invite promise), expired/pending/failed evidence blocks cached selection, and persistent accessible reasons with one native Retry control. Installed relay-only nonmember rows now retain exact-key reason/Checking/Retry overlays without adding discovery candidates or moving identities, labels, order or index. Retry is a fresh evidence lookup, not a replacement chooser request (including installed empty/error results); text change/reopen discovers a new list. Independent latest P2/P3 closure is retained.

Reconciled local evidence (not rerun for publication): 6,153/6,153 Desktop package and 102/102 focused on composed production; TypeScript and actual desktop-check passed; exact per-PR base/tree size gates passed. Broad Chromium/mock-bridge run remains 233/234 before the test-only formatting correction, followed by the full affected 66/66. Final test-only B1 delta passed full remote-owned-mentions 20/20 and real lifecycle/authority 16/16. Production/dependencies/build/every served file are equivalent across those test-only deltas. No fresh 234/234, union total, repository-wide just ci, live-relay, native Tauri/WebKit/IME/VoiceOver certification, or current-head CI success is claimed. Historical c98 draft failure remains unattributed, not proof of autofocus causation and not a permanent gate after the accepted present-invariant proof. Existing standalone-stack limitations remain. Source evidence: OUTBOX/MENTION_10055/REPORT.md and OUTBOX/MENTION_C0F1/REPORT.md (the latter supersedes only the former B1 blocker disposition).

Please re-review the latest head above, not the superseded published head. This response records author closure and requests verification; it is not reviewer approval.

[jedwards27]

:bot: Jude’s code review agent — APPROVE at replacement head 479bbe0f17d7635c48e00b5f7280350b1d8b2dba (base 0464384b676b7457f51876484e9beac998b690d5). The prior review at f1af1b88… is superseded.

The full A Team re-review confirms all three prior blockers are closed:

1. DM action truthfulness: useMentions.ts:81,295-321 now supplies destination add-member authority, and buildMentionCandidates.ts:280-295 emits invite only when that authority is true; otherwise it emits actionable mention-without-invite. useMentionSendFlow.authority.test.mjs:253+ proves a DM sends directly with zero add-member effects and the exact mention recipient. Browser coverage also checks no dialog/add-member side effect and signed h/p tags.

2. Expired cached permission: pending evidence becomes checking and failed/expired evidence becomes unavailable before cached allowed data can admit the row (buildMentionCandidates.ts:280-295). Exact live-row settlement is fenced in useMentions.ts:491-575. A causal mutation removing the expiry branch made both member and relay-only nonmember journey tests fail behaviorally (mention/invite instead of unavailable), then restoration returned a clean tree.

3. Accessible unavailable reasons: reason text is persistently rendered and referenced through aria-describedby by both the disabled choice and Retry control (MentionAutocomplete.tsx:389-405,522-554). Retry transfers focus to the composer before unmounting. Unit accessibility assertions cover policy denial and lookup failure.

Exact-head validation: full Desktop unit package 6069/6069 passed; four affected composed suites 86/86 passed; pnpm check, pnpm typecheck, E2E build/type compilation, file-size gate, and git diff --check passed. Windows/macOS builds, Desktop Core, relay/integration suites, security scanners, and DCO are green. Local exact-head worktrees were clean, and the live PR remained at the pinned SHA immediately before this review.

Confidence gap / ownership: Desktop Smoke E2E (3) is red from an exhausted assertion in unchanged messaging.spec.ts:2437; two other tests passed on retry and were classified flaky. The reviewed source and run do not establish PR causation. An optional focused rerun was blocked by reviewer port contention. Author action: none. Verification owner: CI/reviewer for rerun or causal triage and continued observation of picker timing.

The code now says what it means. A rare and beautiful dungeon event.

[jedwards27]

:bot: Jude’s code review agent

Verdict: APPROVE
Reviewed: 0464384b676b7457f51876484e9beac998b690d5..479bbe0f17d7635c48e00b5f7280350b1d8b2dba (exact live head 479bbe0f17d7635c48e00b5f7280350b1d8b2dba)
Risk: high — desktop mention eligibility crosses live authorization evidence, destination member-admission authority, selection, signed recipients, and accessibility semantics.

Both assigned lanes completed and agree that all three prior blockers are closed.

1. DM action truthfulness: useMentions.ts:81,295-321 supplies destination admission from useCanAddChannelMembers; buildMentionCandidates.ts:280-295 emits invite only when that authority is true, otherwise actionable mention-without-invite. DM tests prove direct send, zero add-member effects, and exact signed recipient tags (useMentionSendFlow.authority.test.mjs:253+; mentions.spec.ts:3255+).
2. Expired cached permission: pending/failed evidence becomes checking/unavailable before cached allowed can admit it (buildMentionCandidates.ts:280-295), with exact live overlays and current-key/action admission in useMentions.ts:491-575. Removing the production verificationFailed branch caused both member and relay-only nonmember journeys to fail behaviorally; restoration returned green.
3. Accessible unavailable reasons: persistent reason text describes both the disabled choice and single native Retry control, and Retry restores composer focus (MentionAutocomplete.tsx:389-405,522-554). Unit AX assertions cover policy denial and lookup failure.

Author action: none.
Verification owner: CI/reviewer owns rerun or causal triage of the unrelated Desktop smoke failure; optional isolated Playwright/native keyboard observation remains reviewer/release work.

Exact-head validation on clean trees:

• Full Desktop unit package passed 6,069/6,069; four affected production suites passed 86/86.
• pnpm check, pnpm typecheck, E2E build, file-size gate, and git diff --check passed.
• Expiry mutation failed the intended two production journeys and was restored.
• Exact-head Desktop Core, smoke shards 1/2/4, relay E2E, both integration shards, macOS/Windows builds, DCO, and security checks are green.

CI confidence gap, not author rework: Desktop smoke shard 3 exhausted one assertion in unchanged messaging.spec.ts:2437 and classified two other rows flaky after retry. The PR does not change that exhausted file/spec, so no PR-caused required-gate failure is established. A PR-relevant keyboard/Options row missed once and passed its immediate retry in 2.5 seconds; no reproducible product defect was established.

Manual/native evidence: no native keyboard/AX run and a focused local Playwright attempt was blocked by occupied port 4173. Source, AX tests, full package checks, and exact-head CI are proportionate; these are reviewer/tooling gaps.

Residual risk: transient picker timing remains imperfectly characterized. No unresolved authorization, recipient-integrity, DM truthfulness, or accessibility defect was found. Any new head invalidates this approval.