fix: restore avatar presence controls and active-input sensing

[wesbillman]

Summary

Restore the own-avatar status indicator and compact account menu with Automatic / Away / Appear offline and Settings. Capture editor input before bubbling stops, count foreground return as activity, remove presence from message/thread rows, and omit unavailable profile presence instead of displaying Unknown or inventing Offline.

• Reuse the shared Base UI menu, Avatar, semantic colors and typography. Arrow keys move focus without changing status; Enter/Space selects. Settings receives page focus after menu dismissal. Existing DS colors remain unchanged by explicit product decision; no new palette or tokens.
• Restore one-to-one DM avatars from the existing profile selection and media sanitizer, with human/agent shape and image fallback. Group DMs show the number of other participants from the existing roster; self-DMs keep their icon. No new profile requests or passive presence subscriptions, and no DM presence dots.
• Preferences persist per viewer on this device and synchronize same-origin windows. The existing activity owner, authenticated publisher and socket handle intent and Offline retry/renewal. No relay/server change, new poller, socket, outbox or protocol. The avatar reports local intent, not delivery confirmation; other devices can overwrite relay last-writer-wins status.

Only protected edit is the previously authorized two-line communities/service.ts wiring. Combined production diff: 348 additions / 123 deletions, including the subsequently requested menu and DM work. Main through 12a957c2 is integrated: retain the new community rail and reaction controls, remove the obsolete CommunitySwitcher fixture, and keep presence off MessageRow.

Originating Buzz channel: 4a7aa498-1c58-4a1a-b568-f3845277ff5a, thread f5b1938186889172a76fa451f3db681f9e8cd6fcb45457d494eb69016a172c5d.

Validation

Delivered head: e9eb1548261cb36c1efeec6b43ef29481c006957.

• At integrated 59ed509b: full Vitest, 250 files / 2,563 tests passed (112.71s, macOS arm64, two workers); all 17 affected/merge-seam browser files, 168/168 passed in Chromium/WebKit (3.9m). Includes Settings/menu focus, avatar preferences and reload, DM profile recovery/no presence queries, responsive layout/navigation, and reaction/message-action integration.
• Final head changes only the group bubble to the complete caption type role and corrects test fixture typing. Exact-head follow-up: 50/50 Chromium/WebKit cases passed across full Settings, presence, DM-label and navigation-sidebar files (1.3m).
• Mandatory composed safety/repository hooks passed without bypass: staged formatting/lint, TypeScript, 105 related files / 1,366 tests, design types and all color/type/contrast/adoption guards. First push correctly stopped on fixture typing and custom font weight; both were repaired before the successful push.
• Earlier controlled DOM + real activity/publisher tests cover idle -> stopped-bubbling input -> Online, manual override through input, viewer isolation, denied storage, accepted Offline no-renewal, failed/unsent Offline retries and reconnect. Mutation evidence: changing capture to bubbling fails activity/publication assertions; restoring MessageRow presence fails no-byline coverage in both engines.
• Independent UI/a11y/proportionality re-review found no remaining defect after the focus/count changes and final type-role correction. Wes tried and accepted the live UI. No new colors were introduced.

Browser test accounting

Presence remains six cases per engine: replace the old byline snapshot journey with no-byline-render/no-demand plus explicit-profile observation; remove the obsolete 300-author byline/overflow journey; add one avatar preference/reload integration. Existing bounded-demand owner tests retain cap/priority coverage.

This UI follow-up adds zero browser cases: existing Settings coverage now exercises shared-menu arrow/Home/End navigation without accidental preference changes, Escape/outside/Shift+Tab dismissal and page-focus handoff at wide/narrow widths; existing DM-label recovery cases assert avatar recovery and no presence demand. Update Settings selectors across existing journeys from button to menuitem. The keyboard handoff failed in both engines before using the completed-close callback and passed afterward without weakening its focus assertion.

Browser-only justification: real app/broker/socket composition, storage and Web Locks across pages, native focus/keyboard/layout. Avatar image/sanitization/agent shape and count branches are tested in the colocated component test; status/failure matrices stay in owner tests.

Remaining gates and limits

GitHub reports this head MERGEABLE; DCO passes. Hosted CI and required human/code-owner review remain pending. No merge performed.

The browser evidence uses a real built frontend and production broker where specified, with modeled upstream and ephemeral identities. Native WebView/OS-wide idle, deployed capacity/cross-device availability and full production-broker browser idle -> publication are not certified. Broad hosted browser measurements and native/tool integration are left to CI; no release certification is implied.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

No actionable material defects found in the agreed contract. Reviewed head e9eb1548261cb36c1efeec6b43ef29481c006957 against base 12a957c238771545dee57e9b83f26171074578ec. This is a comment, not an approval. Another Carl session authored this implementation; Mordecai and Princess Donut supplied separate read-only state-machine and UI/accessibility reviews, which I reconciled with the integration paths.

• Verified saved intent before community acquisition, captured input/foreground activity, manual override, current-intent cancellation, Offline retry/no-renewal, broker/socket validation, profile-only demand, and reuse of existing DM profile/media ownership. No outstanding review threads existed at review time.
• One additional controlled-clock integration probe passed against exact-head production source plus a temporary test: a delayed obsolete signer cannot publish Online after Offline; a late Offline receipt cannot stop the replacement Automatic publisher; accepted Offline stops subsequent renewal. The socket, signer delay and Web Lock interface were fixtures, not a deployed-relay/native test. Existing hosted JavaScript validation passed 251 files / 2,600 tests on synthetic merge 5770dcc9aa996eb8d0edf0d9c7189089967e8eac (head merged with e9e557c5), not on the bare feature head.
• Remaining gates/limits: Rust/tool integration and four browser shards were still running at the last check; browser measurements, JavaScript, security checks and DCO were green, Windows validation skipped. Finish existing CI and normal reviewer requirements before merge. Native WebView/OS activity, deployed cross-device behavior and full production-broker idle-to-publication integration remain explicitly unverified; no new blocker is inferred from those stated limits.