Add optional channel templates, teams and personal group defaults

[wesbillman]

Opened by Brain on Wes’s behalf, at his request.

Summary

• Add optional Templates & teams, off by default. Reuse the existing new-channel buttons; manage recipes and personal groups in Settings. Recipes combine multiple reusable teams, individual agents and starting Canvas. Group defaults seed new intent only; moving channels never rewrites membership or Canvas.
• Put the Canvas editor and Save as template in channel settings. Save-as copies the saved Canvas and eligible agent identities, disclosing incomplete inventory rather than inventing a linked team.
• Unify native/legacy agent choices under the session-owned projection, so native-only/stopped agents appear consistently without making a partially available inventory count as complete inference evidence.

Ownership and safety

• The optional plugin owns recipe UI. Channels owns form/placement UI. Two small Cordis contribution slots revoke stale callbacks by registration and mounted lifetime.
• The existing session owns accepted setup, Canvas, private catalogs and recovery; the existing outbox owns all delivery. No new socket, signer, runner or retry loop. The broker prepares encrypted private kind-30078 catalog bytes before normal outbox signing/publication.
• Creation is ordered: channel → starting Canvas → verified agent membership → personal group. No welcome-message side effect. Frozen accepted intent survives provider replacement/disable, changed catalogs and restart. Unknown delivery is distinct from terminal rejection; membership acceptance is not treated as verified membership.
• Canvas drafts retain their original revision, including empty edits. Stale/StrictMode completions are fenced; conflicting edits require reconciliation. Relay revision preflight is not atomic CAS, so it cannot eliminate every concurrent-writer race.
• Original Buzz preferences are untouched. Copying visible original groups is an explicit draft action; no implicit migration or fresh-agent provisioning.

Architecture details: plugin ownership, shared agent selection. Independent bounded source review covered the ownership/recovery boundaries; it is not runtime certification.

Validation

Current repair head: 355642ad791b843b852cc208358ec713e5f2f0a6.

• Hosted CI at e0bf6bee narrowed both browser-engine failures to mentions.spec.mjs:329: the removed-member send entered an unnecessary asynchronous composer lock. The helper's managed-only guard now runs at its sole caller before setSending/await; refreshed enrollment and session membership checks remain intact.
• Strengthened the existing real-session composer regression to assert immediate rejection without a disabled interval, including a mixed removed-person/native-agent send. Both cases failed on the old production code and pass with this repair. All 73 tests in the composer file passed; browser assertions and fixtures were not changed.
• At the repair head, normal pre-commit and pre-push hooks passed: TypeScript, 233 Vitest files / 2,443 tests, design types and design-system guards. Hosted DCO passed. New hosted CI is running; browser resolution is not yet verified. No local server, desktop or agents launched.

Initial preflight head: 993f5953f0b7eaf307e3dd3803aa294497272c38, based on a47ddaf452e605a59056476d2091146e1f3902e8.

• Normal pre-commit: formatting/lint, icon boundary and secret scan passed; hooks were not bypassed.
• Normal pre-push: TypeScript, 233 Vitest files / 2,438 tests, design types and design-system guards passed. This includes real create-dialog → session/outbox wiring, app plugin enable/disable composition, accepted team retention, encrypted-host admission, held outbox hydration, and Canvas stale-read/StrictMode regressions.
• Initial gate failures were repaired, not suppressed: archive evidence now reloads after discovery invalidates it; fixtures retain stable store/session identities and supply the new registered services. A gated discovery-after-archive regression covers the lifecycle failure.
• Rust file formatting check passed. Rust tests/Clippy, full frontend build, Node tool integration, Chromium/WebKit journeys and browser measurements are left to hosted CI.
• Browser cases added/removed: 0. New behavior matrices use actual React mounts and real session/outbox with controlled transports in Vitest; no browser geometry/native-paint claim.
• Wes exercised the evolving desktop UI. Final packaged/native, cross-window/live-relay recovery and comprehensive desktop acceptance remain unverified. No app/server was launched during finalization, per his instruction. Draft until broader checks and review clear.

Try it

Use the existing brain/channel-templates worktree, run just desktop, enable Templates & teams under Settings → Plugins, then manage recipes under Settings → Messages. Test blank/template/group-default creation, Calvin selection, plugin disable/re-enable, and Canvas save/conflict recovery.

Originating Buzz channel: cc91c278-816b-46af-8445-ab6d5a143ac4
Discussion root: da31c66b145025929eba4a02eb8cdac574a890b32cda02e50f0ac1ddadd0f987

[wesbillman]