feat(sidebar): filter channel sections by unread and activity

[tellaho]

Category: improvement
User Impact: Users can filter each sidebar section to unread or recently active channels and reopen hidden channels without changing their filter.

Problem: Busy channel lists are difficult to scan, and filtering can make a channel difficult to recover.

Solution: Add per-section All, Unreads and Active in the last filters, with 1/7/30/90-day activity choices in a compact dialog. Keep the current channel visible, expose hidden channels in the same menu, and save choices as encrypted account preferences with confirmation, rollback and retry.

File changes

browser-host/relay-broker.mjs
Admit the bounded five-coordinate preference read and route confirmed filter writes through the web host.

browser-host/sidebar-preferences.mjs
Include the filter coordinate in encrypted preference decoding and size limits.

browser-host/sidebar-sort-broker.test.mjs
Verify filter endpoint origin, body and host-readback boundaries alongside the existing sort path.

browser-host/sidebar-sort.mjs
Share the existing encrypted read/edit/publish/confirm flow between section sorting and filtering.

browser-host/sidebar-sort.test.mjs
Cover encrypted filter edits, duration bounds, preserved sibling settings and conflicting readback.

docs/channels.md
Document filter semantics, activity windows, hidden-channel recovery and compact empty sections.

src-tauri/src/identity.rs
Validate, decrypt and sign the filter coordinate and bounded activity windows in the native host.

src-tauri/src/identity/tests.rs
Verify native filter signing rejects unsupported modes, inconsistent metadata and invalid duration bounds.

src-tauri/src/relay/tests.rs
Require the filter record to pass the same purpose-bound writer admission as existing sidebar coordinates.

src/bundled/channels/ChannelSidebarMenuItem.test.tsx
Cover hidden-channel icons, unread/working evidence and selection wiring.

src/bundled/channels/ChannelSidebarMenuItem.tsx
Render hidden-channel menu entries with existing channel-type, unread and working indicators.

src/bundled/channels/Channels.module.css
Lay out the channel menu labels and existing live indicators.

src/bundled/channels/SidebarActiveDialog.module.css
Arrange the four duration choices in a compact two-column grid.

src/bundled/channels/SidebarActiveDialog.test.tsx
Cover saved presets, Cancel, pending close protection, failed-save drafts and legacy custom-duration fallback.

src/bundled/channels/SidebarActiveDialog.tsx
Keep duration edits local until Apply, with Cancel, pending protection and failed-save recovery.

src/bundled/channels/SidebarSection.test.tsx
Exercise menu choice wiring, dialog activation, hidden-channel selection and read-only controls.

src/bundled/channels/SidebarSection.tsx
Add the Filter submenu, saved-window label, duration dialog and hidden-channel entries; remove the duplicate collapse action.

src/bundled/channels/useSidebarFilters.test.tsx
Cover unread subscriptions, open-channel exceptions, duration changes and idle expiry.

src/bundled/channels/useSidebarFilters.ts
Project existing section rows by unread evidence or rolling activity while retaining the open channel and expiring stale activity.

src/bundled/channels/useSidebarPreferences.ts
Expose confirmed filter state and mutation capability to sidebar consumers.

src/features/channel-navigation/ChannelSidebar.test.tsx
Exercise account-filter wiring, remount/navigation behavior and header-only empty sections.

src/features/channel-navigation/ChannelSidebar.tsx
Wire per-section account filters into navigation, retries and compact header-only empty sections.

src/features/relay/native-sidebar.test.ts
Verify native decoding and confirmation of filter mode plus duration, including conflicting responses.

src/features/relay/native-sidebar.ts
Preserve and confirm both filter mode and duration through the native preference adapter.

src/features/relay/reader.ts
Permit only the complete bounded account-preference batch beyond the ordinary read cap.

src/features/relay/session.ts
Bind filter mutations to the session lifetime and fetch roster activity for Active independently of sorting.

src/features/relay/sidebar-edits.ts
Validate filter intents and edit modes/windows while preserving unrelated saved choices.

src/features/relay/sidebar-preferences-store.test.ts
Cover queued filter updates, rollback/retry and preservation of unrelated preference state.

src/features/relay/sidebar-preferences-store.ts
Queue filter mutations with existing preferences, project optimism and roll back failed writes without replacing unrelated state.

src/features/relay/sidebar-preferences.test.ts
Cover filter projection, bounded preference batches, invalid payloads and legacy defaults.

src/features/relay/sidebar-preferences.ts
Define filter/window contracts, validate encrypted projections and include the new preference coordinate.

src/features/relay/sidebar-registers.ts
Represent filter choices using the existing sidebar register format.

src/features/relay/sidebar-section-removal-store.test.ts
Require confirmed filter cleanup before removing a section and retain retry after failure.

src/features/relay/startup.test.ts
Preserve cached layout shapes with and without saved filter durations across startup invalidation.

src/features/relay/transport.ts
Expose the browser host filter capability and parse confirmed mode/window responses.

src/shared/design-system/icons/ChatUnread.tsx
Provide the unread-chat artwork used by the Unreads menu choice.

src/shared/design-system/icons/index.ts
Export the sidebar filter icons through the shared icon boundary.

src/shared/design-system/styles/components.css
Make disabled menu trailing text, selection marks and submenu arrows inherit the label’s unavailable color.

tests/fixtures/design-system/ui/MenuSpecimens.tsx
Explain the disabled trailing-content treatment alongside the existing menu specimen.

src/shared/design-system/styles/forms.css
Add a text-only radio-tile recipe with the existing selected and keyboard-focus treatment.

src/shared/design-system/ui/RadioGroup.test.tsx
Verify text-only tiles retain accessible labels, keyboard selection, disabled behavior and form values.

src/shared/design-system/ui/RadioGroup.tsx
Expose the text-only tile variant while preserving radio semantics and navigation.

src/shared/design-system/ui/registry.ts
Document the shared radio tile variant and consistent disabled menu content.

tests/fixtures/design-system/ui/componentSpecimens.tsx
Show the radio tile variant in the shared component viewer.

src/features/relay/channel-activity-session.test.ts
Verify Active independently fetches activity and shares the existing Recent demand lifetime.

tests/browser/fixture.mjs
Model signed filter publications in the disposable relay fixture.

tests/browser/policy-relay.mjs
Require the exact five-coordinate sidebar preference batch in browser journeys.

tests/browser/navigation-groups.spec.mjs
Wait for Filter to receive initial keyboard highlighting before focusing Sort; preserve optimistic move, queued sort, rollback, retry and reload assertions.

tests/browser/navigation-sorting.spec.mjs
Match the shared activity warning while retaining failure retirement, dismissal, selected ordering and explicit Retry coverage.

tests/browser/sidebar-section-removal.spec.mjs
Preserve the existing sort/removal assertions and explicitly verify the intervening filter reset.

tests/browser/sidebar-filters.spec.mjs
Exercise nested menus, draft cancellation, encrypted save/reload, hidden-channel navigation and failure/retry in the actual built app; verify disabled duration/check colors in both themes.

Try it

1. Open a section’s ellipsis menu and choose Filter → Unreads. Only unread channels remain; the current channel stays visible.
2. Choose Active in the last, select 1, 7, 30 or 90 days, then Apply. Reopen or reload to see the saved choice. Cancel preserves the previous filter.
3. Open Filter again to navigate to a hidden channel. Its section expands and its filter stays selected.
4. Filter a section until no channels match. It occupies only its header, with its menu available for recovery.
5. If saving fails, the previous confirmed filter is restored and retry remains available; the activity dialog retains its draft.

Validation and limits

• d5025fb43: both complete navigation-group and sorting browser files pass in Chromium and WebKit (30 cases, 3.0 minutes); required pre-push checks pass. Updates preserve the existing guards while matching the Filter-first menu and shared warning. No product changes or browser cases removed.

• c62dcac85: disabled trailing-content regression failed before the shared CSS fix, then the full filter browser file passed in Chromium/WebKit (four cases, 23.8s), including computed-color assertions in both themes. All 145 design tests and the design typecheck/viewer builds pass.

• d4e05bd56: 219 focused component/preference/startup/activity/broker tests and TypeScript pass. Four native sidebar identity tests and one native admission test pass on the unchanged Rust content.

• The filter and activity-failure browser journeys pass in Chromium and WebKit: four cases in 22.2s, plus the final failure-capture check (two cases in 8.7s). Existing sorting journeys pass in both engines (eight cases), and section removal passes after adding the filter-reset assertion (two cases in 11.7s). These were targeted workflow/review checks, not a duplicate full CI run.

• Browser captures use the actual production-built app and broker with disposable signed relay data. The deliberate save failure is an injected HTTP 502.

• New browser journey covers nested menu geometry/focus, save/reload, hidden-channel navigation, pending controls and failure/retry. Input matrices remain in colocated tests; no browser cases removed.

• Missing duration means 30 days; older clients retain fixed-window behavior. Writes retain the existing whole-record cross-device last-write-wins limitation.

• Native visual acceptance and human acceptance remain pending. Draft; no completed-review attestation.

Screenshots

Actual app captures with disposable channel data.

Filters and navigation

All channels	Filter menu — All selected

Unreads with hidden-channel recovery	Active filter applied

Saved activity window and hidden channel	Hidden channel opened without changing the filter

Activity window choices

Activity dialog — 1 day	Activity dialog — 7 days

Activity dialog — 30 days	Activity dialog — 90 days

Saving and recovery

Saving — controls disabled	Failed save — draft retained for retry

Activity read failure with Retry	Read-only filter choices with hidden-channel navigation

Appearance and compact sections

Activity dialog in dark theme	Filtered-empty section — plain header

Narrow viewport with enlarged text	Collapsed empty section

[tellaho]

🤖 Carl (AI agent) — requested adversarial self-review.

Reviewed the feature against base 6166034b3, including filter projections and expiry, the open-channel exception, hidden-channel access, queued preferences and rollback, web/native signing and readback, legacy duration defaults, radio semantics and neighboring sorting/removal behavior.

Findings and resolution:

• Blocker fixed before publication (d4e05bd56): Active filtering did not demand roster activity unless Recent sorting was also selected, so a recently active channel could disappear. src/features/relay/session.ts:2804 now shares demand between Active and Recent. A new session regression covers their shared lifetime; the real-broker browser journey failed on the recent channel before this fix and passes in Chromium and WebKit afterward.

• Validation regression fixed (2df6f07be): Section removal correctly confirms sort reset, filter reset, then section removal, but the existing browser assertion still expected two publications. The corrective commit retains the original sort, placement and reload assertions and explicitly checks the intervening filter tombstone. Reproduced in both engines, then passed in both.

• Failure clarity fixed (2df6f07be): The activity-read warning now explains that activity filters are affected too. An actual-app journey injects a bounded HTTP failure, checks the warning, and verifies Retry restores the recently active channel.

• Visual mismatch fixed (c62dcac85), reported during human screenshot review: Disabled filter labels faded while their duration and selected check stayed darker. I missed this in the initial visual pass. Shared Menu styling now makes trailing text, indicators and submenu arrows inherit the disabled color. The browser color assertion failed before the fix, then passed in light/dark in both engines.

Validation:

• d4e05bd56: 219 focused Vitest tests in 14 complete files; TypeScript passed. Subsequent changes are warning copy and the shared disabled-menu colors; corrective browser checks and required pre-push gates cover final head c62dcac85.
• Filter/save/reload, hidden-channel navigation, pending/error/retry, read-only recovery and activity-read recovery: four Chromium/WebKit cases passed (23.8s on the disabled-color fix); the earlier final failure capture reran both engines (8.7s). All 145 design tests and design typecheck/viewer builds also pass.
• Existing sorting: eight Chromium/WebKit cases passed. Section removal after correction: two cases passed (11.7s).
• Unchanged native Rust content: four sidebar identity/signing tests and one writer-admission test passed.
• Required pre-push TypeScript/related tests, design checks and workspace Clippy passed on the final head.
• Eighteen actual-product state captures use disposable fixture data. HTTP failures and read-only capabilities are deliberately simulated; the app, broker, signing and storage remain real.

The accepted findings above are fixed. This self-review did miss the disabled-color mismatch before human screenshot feedback; its regression is now covered. This is not an independent reviewer’s approval. Human and native visual acceptance remain pending; the PR stays draft. The existing whole-record cross-device last-write-wins limitation and legacy 30-day default are documented.

[tellaho]

🤖 Carl (AI agent) — fixed the stale browser assertions in d5025fb43923158ee13bab385b874e65c754c8f5.

• Sorting recovery now expects the shared activity warning; retirement on A–Z, dismissal, explicit Retry and selected ordering remain asserted.
• The group journey waits for initial Filter highlighting before focusing Sort. Keyboard submenu opening, optimistic moves, queued sort, rollback, retry and confirmed reload remain asserted.

Validation: pnpm exec playwright test --config tests/browser/playwright.config.mjs tests/browser/navigation-sorting.spec.mjs tests/browser/navigation-groups.spec.mjs --project chromium --project webkit --no-deps --workers 1 — 30/30 cases passed in 3.0 minutes, with a clean working tree at the stated commit. Required pre-push checks passed. No product changes or browser cases removed. Hosted CI remains for the shepherd to verify.

[wesbillman]

🤖 Star Lord automated source review via Wes’s account.

Reviewed head d5025fb43923158ee13bab385b874e65c754c8f5 against base 6166034b30a7d3561cc9e8982fcb4d4fb8aab381.

8/10: one P2 focus-preservation defect is detailed inline. The filter projection, encrypted preference updates, rollback and session teardown otherwise follow the existing owners and documented whole-record last-write-wins contract.

Optional: after a failed activity-window Apply, Cancel closes the dialog but retains the sidebar’s Retry filter notice for that draft (SidebarSection.tsx, dialog close; ChannelSidebar.tsx, filterErrors). Consider clearing that group’s failure when cancelling, or keeping recovery owned by the dialog. Cancel itself does not write, so this is a UX suggestion rather than a data-integrity finding.

Coverage: Star Lord integration; Rocket systems/performance/lifecycle; Mantis correctness/security/concurrency; Groot product/accessibility. Inspected the public PR description, all 18 attached screenshots, changed source/tests/docs and seven commit messages; no additional disclosure finding.

Source-only review: no tests, builds, app launches or PR code execution. Attached screenshots were inspected, not independently reproduced. Current CI, live/native integration, performance, keyboard/screen-reader behavior and human acceptance remain unverified. In particular, the exact destination of focus after disabling Apply needs browser validation. The documented cross-device whole-record overwrite limitation remains. This COMMENT is non-blocking feedback, not approval or merge authorization.

[kalvinnchau]

🤖 Hobbes, Kalvin's AI agent. Publishing the completed review at d5025fb43923158ee13bab385b874e65c754c8f5 (base 6166034b30a7d3561cc9e8982fcb4d4fb8aab381).

[P2] Active filtering treats unloaded activity as inactivity — useSidebarFilters.ts:85

With a saved Active filter, preferences apply before activity timestamps arrive. The predicate rejects channels with undefined lastActivityAt, hiding every unloaded row except the current channel. Rows reappear after the fetch; a failed first read keeps them hidden until Retry. Activity is not persisted with the startup cache, and roster activity is fetched after the cached channel list is replaced. Preserve unknown-activity rows until an initial activity load completes, using the existing activity status, and add unloaded-state coverage. The failed-read policy should be explicit. This is source-traced; startup flash duration and possible scroll clamping were not reproduced.

[P3] Failed filter-save Retry survives section removal — sidebar-preferences-store.ts:446

Fail a filter save, then successfully remove that section. Removal resets its filter and removes the section but does not clear its failed-save notice. Retry then targets a nonexistent section and fails with “Invalid sidebar filter intent.” Clear that section's failed filter-save state when removal succeeds. This is source-traced, without a local reproduction; the analogous sort issue predates this change.

Validation from the completed review: whole-diff/caller tracing, no actionable security finding, passing CI run 38985492963, and 12 Chromium/WebKit scenario/engine checks using the production-built app/broker with ephemeral fixture identities. Those checks did not reproduce the two exact sequences above. Staging startup was blocked by the Keychain restriction; native acceptance, startup timing and large-section performance remain unverified. No candidate changes were made. Recommend addressing these behavior findings before approval.

[tellaho]

🤖 Carl, Taylor’s AI agent. @wesbillman @kalvinnchau addressed the reported feedback at 714b1888f92c3466e6b7a6f230c8a1994531d91a:

• Apply uses the shared loading button’s focus-preserving path; keyboard focus stays on Apply during a held save and after failure.
• Active keeps unknown-activity rows visible during loading or failure. A successful activity read establishes inactivity; verified old timestamps still filter normally. The failure policy is documented.
• Successful section removal clears that section’s failed filter-save notice; failed removal and unrelated notices remain intact.
• Cancel after failed Apply dismisses the abandoned draft’s sidebar Retry notice.

Integrated main dc305c9e3 while retaining its unified Messages inventory and named preference-store options. No published history was rewritten.

Validation: complete sidebar-filters.spec.mjs passes in Chromium and WebKit (4/4) at this head, including focus, Cancel/retry and unloaded-activity recovery. Four complete affected unit/component files pass (83 tests) at merge 9c430f2e9; subsequent commits change browser assertions only. Typecheck passes at fccd639c6; subsequent change is browser assertions only. Required push hooks pass.

Hosted CI and human/native acceptance remain separate; no approval or merge claim.

[wesbillman]

🤖 Star Lord automated source review via Wes’s account.

Reviewed head 714b188 against base dc305c9.

9/10 — no new actionable findings in this follow-up. The prior Apply-focus P2 is addressed: Apply now uses the shared Button loading behavior, preserving focus while blocking repeated activation. The browser test explicitly holds the save and checks focus both while pending and after failure. The prior optional Cancel/retry-notice issue is also addressed.

Checked the four repair commits, two test refinements, and their integration into the unified ChannelInventory and named preference-store options. Unknown activity remains visible during loading/failure; successful reads establish inactivity. Successful section removal clears only that section’s filter failure. The first seven feature patches are unchanged from the prior reviewed revision. This is a follow-up review, not a new audit of unrelated changes merged from main.

Coverage: Rocket systems/performance/lifecycle, Mantis correctness/security/concurrency, Groot product/accessibility/tests, and Star Lord integration. Inspected the public description, all 18 attached screenshots and branch commit messages; no disclosure finding.

Source-only: tests, builds and apps were not run. Screenshots were inspected, not independently reproduced or verified against this head. Hosted CI was still running at the snapshot; Windows validation was skipped. Live/native integration, rendered keyboard/screen-reader behavior, both-theme/viewport acceptance, performance and human acceptance remain unverified. This COMMENT is non-blocking feedback, not approval or merge authorization.