LOD-WIRE-1: navigate nested graphs with clean focused buses

.agents/inbox/2026-10-28-browser-acceptance-needs-an-owned-session-bus.md

@@ -0,0 +1,91 @@
+# Browser acceptance needs an owned session bus when the desktop bus disconnects
+
+Observed 2026-10-28 UTC during the frozen nested LOD candidate validation. A
+search of `.agents/`, browser helpers and Playwright configuration found no
+existing D-Bus disconnection lesson. This is an infrastructure failure, not a
+passing browser run or evidence of an application regression.
+
+## Evidence
+
+```text
+2026-10-28
+xvfb-run --auto-servernum node tests/run-unified.mjs --sequence layout-recovery
+source: a311154bf154af977a238d4b5de55773efa4e2dc, clean and unchanged
+result: 8 passed, 1 browser case failed, 1 execution-evidence failure, exit 1
+Chrome: FATAL:dbus/bus.cc:1245] D-Bus connection was disconnected. Aborting.
+case: revoked graph writes and deleted graphs retain scoped recovery
+```
+
+Retained report/trace: `/tmp/graphdone-resolution-20261027/nested-layout-a311154-owned-env/`.
+The invoking process inherited a session bus address under `/run/user/`; that bus
+path existed during the subsequent check. The evidence does not identify what
+disconnected the bus, whether the session or system connection caused the fatal
+error, or another process responsible. Do not invent an attribution.
+
+A previous run at the same source failed the explicit owned-Neo4j credential
+precondition before that case performed mutations. Its eight passes and failed
+precondition remain in `nested-layout-a311154/`. Supplying only the three owned
+Neo4j variables corrected that setup error; it did not excuse this later abort.
+
+## Corrective rule
+
+Keep the source and index frozen, preserve the failed trace, and run the browser
+under `dbus-run-session -- xvfb-run --auto-servernum ...` with the same cases,
+assertions, budgets and zero retries. This gives the invocation its own session
+bus without changing the user's services or killing unrelated processes. Use
+only the owned database credentials and retain strict teardown. The isolated
+run still must pass; launching it alone is not acceptance.
+
+## Avoid desktop service activation in the owned bus
+
+The default private-session run also failed and remains retained in
+`nested-layout-a311154-private-bus/`: eight cases passed; the owned Chrome
+SIGKILL/restart case exceeded its unchanged 90s budget. Its two first app
+navigations took 26.353s and 27.587s. The log records desktop portal/secret-service
+activation reaching the default 120s service-start timeout. Review confirmed the
+portal was initially requested by ordinary Playwright Chrome, which already uses
+isolated password-store flags. These correlated observations do not prove the
+raw helper's missing flags caused the delays.
+
+The installed `dbus-daemon(1)` documentation and `/usr/share/dbus-1/session.conf`
+show that service directories enable automatic desktop-service activation. A
+narrower invocation uses a temporary private config with a Unix socket, EXTERNAL
+authentication, session type and same-user messaging policy, with no service
+directories or inherited configuration. It changes no desktop/system service.
+Retained `browser-session-bus.conf` and `browser-session-bus-preflight.log` show
+`ListActivatableNames` returning only `org.freedesktop.DBus`. The strict command
+adds `--config-file=/tmp/graphdone-resolution-20261027/browser-session-bus.conf`
+to `dbus-run-session`; all application/test source, cases, limits and retries
+remain unchanged. Actual resulting acceptance remains required.
+
+## Limits
+
+This local invocation adjustment does not prove the desktop bus root cause or
+prevent every system-bus/Chrome crash. It does not change CI policy or justify
+retrying unexplained application failures into a pass. No application code or
+browser timeout was changed for this incident.
+
+## Owner-directed workstation limits
+
+On 2026-10-28 the owner reported a window-manager crash and requested small visual
+checks without overloading the local PC. The minimal-bus run was interrupted at
+that point: 7 cases passed (including owned SIGKILL/restart and revoked/deleted
+access), 2 required cases skipped, and execution evidence failed. It remains
+incomplete at `nested-layout-a311154-minimal-bus/`; neither the earlier remote CI
+pass nor the seven local cases turn that interruption into a local suite pass.
+
+The host snapshot showed 45 GiB used RAM, 13 GiB swap used and load averages
+13.59/23.09/44.31. This is observation after the report, not proof that GraphDone
+or another process caused the desktop crash. The agent stopped its active test
+process group, 14 verified owned API/Vite/preview listeners and 3 owned containers.
+The owner's localhost 8540 and unrelated processes were left untouched. Retained
+fixtures/data and negative artifacts were not deleted.
+
+Use small deterministic geometry tests and static SVG rendering for iteration.
+Run scoped component checks serially at low priority, with one worker; no browser
+or database is needed for the basic wire-clutter gate. Put full build/database/
+browser/image matrices in CI. Bring up only the specific owned preview needed
+for a bounded inspection, then stop it. Do not accumulate obsolete previews or
+turn each uncertain timeout into another local full-suite run. Geometry metrics
+must include exact relationship accounting and useful visible content so hiding
+all wires cannot manufacture a clean result.

.agents/inbox/2026-10-28-bus-views-need-live-membership-and-total-budgets.md

@@ -0,0 +1,76 @@
+# Bus views need live group membership and one total routing budget
+
+Observed 2026-10-28 UTC during independent review of schematic candidate
+`a04fa2b9dfa580a4fe6c344cc00aa32bd6c8b83e`. Existing projection/ownership and
+snapshot-merge lessons were searched through the symptom index first.
+
+## Evidence
+
+```text
+2026-10-28, Node 22.18.0, single-worker scoped tests
+Before: schematic-review-component-negative.log
+  6 passed, 4 failed
+  open internal view retained a member moved to another group
+  new group member missing from the already-open internal view
+  open bundle retained old endpoint membership
+  Connections count omitted internal and unresolved relationships
+After: schematic-review-component-final.log
+  22 passed, 0 failed, no skips; 5.53s
+
+Before: schematic-budget-negative.log
+  6 passed, 1 failed
+  with one allowed attempt, an impossible first route did not prevent
+  a later successful search: expected zero routes, received one
+After: schematic-budget-final.log
+  8 passed, 0 failed, no skips; 0.24s
+  failed searches spend the invocation allowance
+  a one-state allowance stops remaining searches and retains every edge ID
+```
+
+Logs are retained under `/tmp/graphdone-resolution-20261027/`. The corrected web
+typecheck passed in the existing owned scoped probe (`schematic-review-typecheck.log`).
+No browser or database was started locally for these corrections.
+
+## Cause and corrective rule
+
+A named group is a live semantic selection, not a frozen list of member IDs.
+Store a stable hierarchy reference and whether it selects direct members only;
+resolve current hierarchy paths whenever source data changes. Derive current
+headings from that hierarchy. Explain when a selected group disappears. Test
+moves, newly added members, both endpoints of bundles and direct-parent subsets.
+
+A cap on successful routes does not bound failed searches. Count attempts and
+examined search states across the entire invocation, including failed paths.
+Stop further work when either allowance is exhausted and retain every remaining
+source edge in the explicit deferred partition. The current hard ceilings are
+32 attempts (12 on narrow views), 6,000 examined states and a 4,000-point grid;
+callers may lower them, not raise them. Those are deterministic operation limits,
+not a frame-time or 1k/10k capacity guarantee. Publish actual work counts with the
+small visual fixtures. The dense 112-edge fixture now routes 33 edges through 13
+branches and explicitly defers 79; all IDs remain accounted for.
+
+Counts must describe the whole partition they name. The Connections control now
+includes internal, unresolved-endpoint and deferred external relationships in
+its not-drawn total and explicitly names each denominator. Internal links do
+not need synthetic canvas loops to make that accounting truthful.
+
+## Rendered geometry is evidence too
+
+Actual CI 40629282719 failed its new schematic visual sequence: 3 cases passed;
+phone failed because Delivery's label ended at 259.265625 where the 8px-padding
+boundary was 259. The additional execution failure makes the strict sequence
+failed. Other runtime/quality success and Comprehensive 40629282743 do not erase
+that failure. Retained artifact 12790822057 includes the screenshot and trace.
+
+The source SVG generator now wraps at a narrower word boundary. The label's font,
+card size, padding assertion, timeout and retry policy are unchanged. Regenerated
+static pictures are review aids; only the next actual four-case CI run can prove
+this correction against the browser font metrics. Never widen the visual
+threshold to turn an observed overlap/padding failure green.
+
+## Limits
+
+These fixes do not complete focused-bus exploration or item-level wiring. Small
+geometry/component results do not establish full browser/backend acceptance,
+large-data loading or release readiness. Keep heavy local matrices stopped under
+the owner's workstation constraint and require reviewed exact-source CI.

.agents/inbox/2026-10-28-fixture-extras-must-share-cancellation.md

@@ -0,0 +1,50 @@
+# Additional fixture edges must share ownership cancellation and draining
+
+Observed 2026-10-28 UTC during independent review of
+`2df89e003327cc5065ca48ea2fe0e89fcd6f4d47`. The existing cold-fixture and ownership
+lessons were searched first. This is the same timeout class at an extra-write
+boundary, not a reason to raise a browser test timeout.
+
+## Evidence
+
+The reviewed nested fixture added four batches after `ownedGraphIds.seed()` had
+resolved. Those writes were outside the owner's AbortController/pending-task set.
+Review identified that a setup timeout could start cleanup while later batches
+continued. This race was found in source review; it was not observed against a
+real database and is not claimed as a reproduced production incident.
+
+```text
+2026-10-28, Node 22.18.0, browser-free child runner
+node --test --test-name-pattern=late-edge-response tests/lib/runner/owned-graph-fixture.test.mjs
+  before seed support: 0 passed, 1 failed (1.59s)
+  old seeder ignored additionalEdges; child succeeded instead of exercising
+  the required delayed extra-edge timeout
+
+node --test tests/lib/runner/owned-graph-fixture.test.mjs
+  corrected final source: 4 passed, 0 failed, no skips (6.07s)
+  observed order: create graph, create nodes, request two edges, finish response,
+  unroute, delete edges, delete items, delete graph, verify graph absent
+  no subsequent edge batch after timeout
+```
+
+The regression runs the actual owned fixture/seed helper through Playwright's
+runner with a fake Page. It launches no browser or database. Retained logs:
+`schematic-owned-extra-edges-negative.log` and
+`schematic-owned-extra-edges-final.log` under the owned evidence directory.
+
+## Corrective rule
+
+Pass additional typed edges as source/target indices into the existing seed
+operation. Validate indices before writes, resolve IDs after node creation, and
+append the extra edges to the same bounded, signalled batch loop. Verify every
+batch's returned count. The owned fixture then aborts future batches and drains
+the in-flight response before edge-first cleanup. Do not create a second, untracked
+mutation loop after a tracked seeder has resolved.
+
+## Limits
+
+The small regression proves lifecycle ordering under a controlled delayed response,
+not backend correctness or browser acceptance. The 72-node real CI fixture must
+still prove all 71 hub neighbors, exactly one self-loop, exact internal/bundle
+partitions and unchanged final API readback. Preserve its existing fixture/test
+budgets, one worker, zero retries and strict cleanup. No heavy local stack is needed.

.agents/inbox/2026-10-28-lod-return-needs-hysteresis-and-focus.md

@@ -0,0 +1,70 @@
+# Restoring a LOD camera also requires its hysteresis and focus state
+
+Observed 2026-10-28 UTC during independent review of nested LOD candidate
+`43ada01ffeb213006289db5e20d3e36cebf2464c` for #215 / PR #216.
+Existing renderer-ownership and title-refresh lessons were searched first; this
+incident concerns history-dependent display cuts and focus after replacement.
+
+## Dated evidence
+
+The candidate passed 18 model cases, two strict real-browser journeys and
+independent randomized conservation checks, but those did not exercise Auto
+inspection return inside a hysteresis band or focused-parent replacement.
+
+```text
+2026-10-28
+npm run test -w @graphdone/web -- src/components/SemanticGraphOverview.test.tsx
+before correction: 4 failed, 1 passed
+entry camera scale .4, original [System]
+inspect at 1.2, Back at .4 -> [System/A, System/B]
+focused System at .4, Auto zoom .46 -> document.activeElement BODY
+live removal of focused summary -> BODY
+entry overview at1.1, inspect1.2, Back1.1 -> summaries remain hidden
+```
+
+The actual desktop browser negative against the same application source restored
+the exact entry camera but failed `2 groups · 72 items` after Auto Back: the cut
+had expanded. Existing 5s assertion and 10s action limits remained unchanged.
+Evidence is retained in `/tmp/graphdone-resolution-20261027/` as
+`nested-review-all-unit-negative.log`, `nested-review-browser-negative.log` and
+`nested-review-browser-negative-artifacts/`. Independent actual-component probe:
+`/tmp/graphdone-review-nested-32eoo5dq/negative.log`.
+
+After correction the focused component/model run passed 23/23; types passed.
+The final frozen candidate and real-browser regression still require their own
+strict validation and independent review in PR #216. A local probe is not
+published acceptance evidence.
+
+## Cause and corrective rule
+
+The saved camera and manual cut omitted Auto's previous depth and overview
+visibility. Hysteresis makes the same scale yield different states depending on
+the path taken. Save both state machines at inspection entry and restore them
+with the camera. Test both the nested-depth and overview-visibility bands.
+
+Auto expansion removes the focused DOM button. Preserve an owned focus receipt
+with canonical member IDs, then reconcile it to a surviving visible descendant
+or ancestor (or the complete group list) when that element disappears. Do not
+move focus when another control owns it. Test expand, collapse, live removal
+and deliberate focus movement independently of mouse navigation.
+
+## Validation resource correction
+
+Later full coverage at frozen1baac30 timed out the 40-member component fixture at
+its existing5s limit; concurrently the 301/370 desktop browser exceeded its
+existing120s interaction limit. Retain both failures. Five component assertions
+need only four members under one parent/two children: a clean installed isolated
+worktree proved the smaller fixture still fails the same four old-source bugs
+and passes all five on corrected source with coverage. This does not reduce the
+72-item/301-item browser datasets. Run CPU-heavy local coverage and browser gates
+serially after observing interference; do not raise limits or accept a retry as
+proof of a fix. Fresh exact-source serial validation remains required.
+
+## Limits
+
+This restores view state only. It must not write source positions or turn summary
+IDs into persisted nodes. Removed items cannot retain nonexistent representatives;
+use an accessible fallback. It does not establish progressive loading, physical
+phone performance, per-region spatial budgets or graph capacity. Carry the lesson
+and regressions through normal review; do not equate this local note with a
+completed integration.

.agents/inbox/2026-10-28-schematic-gates-must-see-painted-wires.md

@@ -0,0 +1,72 @@
+# Schematic acceptance must see painted wires, not only clean coordinates
+
+Observed 2026-10-28 UTC in independent source review of
+`41127f064f6f755b357dcbdbcd0761f3143fafea`. The symptom index and prior display
+ownership/bus-budget lessons were searched before recording this incident.
+
+## Evidence and cause
+
+```text
+2026-10-28 source review
+git show 41127f0:tests/lib/schematicOverview.ts
+  required two card elements and at least one path
+  checked intersections and represented/not-drawn accounting
+  did not require positive visible card bounds or actual wire paint
+
+git show 41127f0:tests/e2e/graph/nested-semantic-lod.spec.ts
+  button name /Request delivery/ matched both the member control
+  and the new aria-label="Relationships of <same title>" control
+
+Correction 41b8a03c4c08b750c501e9cbcedf52086e2ed0c4
+  independent exact-source review: no remaining findings
+  no local browser execution; actual extended CI remained pending
+```
+
+These were source-review findings, not claimed browser reproductions. A hidden
+diagram can have zero clutter, and new adjacent controls can make a formerly
+unique accessible-name substring ambiguous. Screenshot attachments alone do
+not cause automated acceptance to fail.
+
+## Corrective rule
+
+Require visible card bounds inside the viewport and painted paths, including
+ancestor display/visibility/opacity, stroke paint, width and nonzero path length.
+Retain positive route/count requirements and geometric clutter checks. An
+intentional opacity-zero wire in the real CI journey must trigger the named
+visibility assertion, then be restored in `finally`. Verify actual original
+source/target port placement and arrows when incoming buses are introduced.
+
+Select the member inspection control by its actual visible title, while testing
+the adjacent relationship control independently. Keep strict locators; do not
+silence the ambiguity with an arbitrary `.first()`.
+The existing semantic overview journey's 38-member count needs the same visible
+text distinction: relationship buttons include the item title in their accessible
+name. Keep the expected 38 source members, and count the actual member controls.
+
+## Limits
+
+These checks detect a basic class of visual regression. They do not establish
+pleasant spacing, meaningful system grouping, full item/path routing or scale.
+Inspect the retained screenshots and exact-source CI reports. Under the owner's
+workstation constraint, use small serial local tests and remote browser gates;
+discovery-only evidence is never a passing browser journey.
+
+## Exact control names and exported evidence
+
+Actual CI 40633460829 at source88d0115 / tested merge025288dafa5fcbefb282fc2c5a313a58dcddebd2
+passed static visual4, smoke6, new-user42 and semantic-LOD2. Both nested cases then
+failed at `getByLabel('Relationship type', { exact: true }).selectOption('BLOCKS')`;
+the strict sequence correctly failed with its process-exit evidence. Screenshots
+showed the control present. The installed Playwright label selector reads the
+wrapping label's descendant text, including select options. Explicit accessible
+names now keep type, direction and depth labels stable. The exact selectors,
+10-second actions and zero retries remain unchanged. Thirteen scoped relationship
+component cases passed in 5.48s; corrected browser execution remains required.
+
+The same artifact exposed an evidence-export gap: the unified Playwright adapter
+imports path attachments, while the new tests used body-only PNG/JSON attachments.
+Those did not appear in the normal passing report's attachment list. New producers
+write owned output files and attach paths, with distinct overview/outgoing/incoming
+names. Inspect the next actual report for all pictures/geometry, not just success
+counts or images buried inside a failure trace. The adapter's accepted file boundary
+is unchanged. Earlier artifacts and failures are retained.