Add global search palette and dev reload shortcut

[wesbillman]

Implemented by Brain on behalf of Wes.

Delivered scope

• Shared-design-system global palette with Cmd/Ctrl+K, input-retained arrow selection/Enter, Escape/focus restoration, pages and joined-conversation choices. Wes confirmed the native arrow behavior works.
• One relay-ranked global prefix message query (kinds 9/40002, limit 20), without the explicit channel list that fails above the relay's 128-channel cap. No client batching or fabricated global ranking.
• Bounded signed channel/membership resolution for returned hits; public nonmember exact-message/thread opening is read-only. Signed membership also resolves actual members omitted from capped initial discovery, including private channels and DMs.
• Read permission is distinct from membership/write permission. No auto-join, manufactured sidebar/unread membership, all-open directory scan, or persisted public preview heads.
• Existing session owns transport, authority, cancellation, coordinated content purging and live interests; existing navigation/thread owners handle exact results. CLOSED suspends public previews until bounded revalidation; failed/cancelled revalidation stays hidden with the existing Retry. Regrant cannot resurrect purged content or copied palette hits.
• Dev-only Cmd/Ctrl+R uses the existing shortcut dispatcher. Remove redundant sidebar search/filter state and align the top-bar photo avatar.

Wes explicitly approved the wider global/public-search behavior and FOUNDATION session integration in the originating discussion. Latest pushed branch head: 16fafe999da2391c770995e6c148e4a4dd066f96 (remote ref verified). No app restarted or new native server launched.

Validation and review — current head 16fafe9

• Merged main 319635e in dfeb27f, then fixed CI in 16fafe9. Clean worktree and remote head verified. All outgoing commits have the effective Brain identity and DCO sign-off; hosted DCO Check passed at this head.
• 110/110 browser cases passed across complete app-style-order, emoji, reactions, typeahead, unread, thread-unread, live-status, global-search, message-navigation, gifs and product-ui files, Chromium and WebKit, two workers, no retries (~150 seconds locally). Source/test diff hash before commit: 895f5d702f1225e68b23b51b6aa3b9667da4d74ea61509989835562c418fd6cc. The staged hook subsequently only reflowed one live-status selector; the entire six-case live-status file passed again at committed 16fafe9. All other browser-tested source/test bytes are unchanged.
• Normal pre-commit/pre-push hooks passed at 16fafe9: TypeScript, 965 related unit tests / 68 files, design types and guards. Broad local/native suites were not manually duplicated.
• Hosted CI 35756232678 is pending on the post-push inspection, not claimed green. Windows native validation is intentionally skipped by the workflow; DCO passed. Required hosted checks and human/code-owner review remain outstanding.
• Pinky independently reviewed the earlier authority slice e7d6886; the latest narrow fixes were self-reviewed, not independently approved. Wes confirmed the native arrow behavior in the earlier UI iteration.

Latest CI cause and repair

Failing run 35750742940 checked 588c81e merged with main e9717dd. JavaScript, Rust/tool integration and browser measurements passed; all four functional browser shards failed (14 cases per engine). These were not the old search-label failure:

1. Standalone typeahead/emoji fixtures had writers but no signed membership, so the new composer/reaction membership gates correctly disabled their controls. Seed real signed fixture rosters/metadata and start existing discovery, retaining all production permission gates.
2. The strict modeled relay treated every two-filter query as sidebar preferences. Add an exact, bounded, relay-author/viewer-checked metadata+membership branch; retain strict unknown-request failures and empty-roster behavior. The public nonmember search journey now exercises this model through the production broker, not only the simpler fixture broker.
3. Recovery tests still selected the old “Retained messages remain readable” copy. The actionable warning was present with the access-safe “Only currently accessible…” wording. Update selectors and the transient-warning observer, preserving quota exhaustion/manual retry/EOSE assertions.
4. Fixing the model exposed a real startup race on restored conversation reload: early exact resolution published a one-channel list before initial membership discovery settled, starting readers that roster completion invalidated. ChannelsPage now waits while the initial list is idle/loading before resolving an omitted target. Existing unread/reload assertions remain; add an explicit no-premature-exact-roster assertion. Production repair: 6 added / 1 removed lines, including comments; no timers, retry policy or authority changes.

Reproduction: the original disabled-composer, reaction and warning failures reproduced in both local engines; unread mock failure also reproduced locally. The first repaired-fixture run was 108 pass / 2 fail, exposing the thread reload regression in both engines. The sequencing guard then passed the complete 20-case unread/thread-unread/search group; the final expanded run passed all 110. No timeouts relaxed, assertions removed, retries enabled or error allowlists broadened.

Process miss: previous validation covered search/navigation but not every consumer of the new shared membership gate. The older “Find a page” fix in 588c81e repaired one incoming-main selector, not these later failures. Contribution guidance now explicitly includes standalone composer/reaction fixtures, broker query contracts and complete restored-navigation/unread journeys when access gating changes; early mock failures can mask later product regressions.

Browser coverage accounting

Three original added scenarios (six engine cases), no scenario deletions: photo-avatar geometry, portal/keyboard focus/navigation, public nonmember exact-result opening. This follow-up adds zero scenarios, strengthens the existing reload assertion and upgrades public search to the production-broker lane. Browser justification remains real focus/layout and app/broker wiring; authority matrices remain in lower-layer tests. Warm local 110-case runs took ~144 seconds before the sequencing repair (108 pass/2 fail) and ~150 seconds afterward (110 pass); mixed outcome/cache/load means this is not an isolated performance comparison or hosted CI cost claim.

Limits and remaining checks

Ready to review, not certified merge-ready. Hosted CI is pending. Please try native Cmd+K → wes-crew → select a message/reply and confirm exact landing. The live human-identity journey and native cold/warm latency remain unverified; production broker with modeled upstream is not live relay/native evidence. Native IME/correction beyond confirmed arrows, visual mode/size sweep, and dev-reload/production-absence checks remain deferred. No running app was restarted for this fix.

Current community only; eight conversation matches and twenty message hits. No legacy forum kinds, search operators, people/agent DM creation, or deep-link/transport rewrite. Snippets reflect indexed content; opening resolves current content/deletion through the existing reader.

Scope accounting: before this CI repair the complete feature was 1,084 production insertions / 205 deletions across 20 source files; this adds 6/1 in ChannelsPage (tests/docs separate). The wider global/public-authority slice exceeded the original estimate, principally for access loss, read/write separation and recovery, not extra search features.

[wesbillman]

Screen.Recording.2026-09-22.at.9.50.37.AM.mov