feat(ui): explain the impersonation warning where a phone user can read it

[sanity]

Problem

#489 shipped the ⚠ impersonation warning on two surfaces, and on both of them the explanation lived only in a title= attribute. title= never fires on touch. So on a phone the feature conveyed "there is a ⚠ here" and stopped, and the reader's natural next move — tapping the name — opened a member-info modal that said nothing about it at all.

Separately, nobody had ever seen the badge in a browser. example_data.rs seeds a spoof nickname so the 🛡 shield is visible in dev builds, but nothing in it produced two members whose names fold together, so cargo make dev-example could not render a ⚠ under any circumstances.

Approach

The modal now explains the warning in visible text. It goes through impersonation_warning_for_display with privilege_in_view — the same entry point the member list and the conversation author line use — so this surface cannot show a badge the others do not, and it inherits the privileged/unprivileged tooltip branch rather than restating it. The chip's label is derived from the tooltip's own leading clause ("Impersonation warning" / "Name conflict") instead of being written by hand, so this surface cannot invent wording that drifts from the single definition in ImpersonationWarning::tooltip. The imitated name is shown here and nowhere else, as its own DOM node — safe for the same reason appointer_names is, since a comma inside an attacker-chosen nickname forges structure in a flat string but cannot span two elements.

This does pay for the whole badge map, which deputy_badge_for_viewer deliberately avoids. That cost is documented at the call site: the modal opens on a deliberate click and renders one member, and the alternative is not a cheaper warning but no explanation at all on a phone. The shield still uses the single-target helper so its Playwright-pinned behaviour stays on its own path.

Example data gains an impostor so the badge is visible in dev builds and reachable from a browser test. It is a plain member, not a second deputy — a second deputy would break member-info-deputy-tag.spec.ts, which asserts exactly one shield, and it would be the wrong shape anyway since the point is a member with no authority wearing a moderator's name. Its nickname is derived from the deputy's at fixture-build time rather than hardcoded, because those names are re-rolled every run and a literal lan Clarke would collide only on the runs where the generator happened to pick Ian Clarke.

Testing

Five Playwright tests (member-list row, conversation author line, the modal's visible explanation, the deputy's modal, and a 320px layout case) plus three Rust tests. Every new behaviour was checked by mutation rather than by trusting a green.

The 320px test was vacuous as first written, and passed against the clipping bug. This is the most useful thing in this PR for whoever reads it next. Reintroducing the regression that 7c2511e8 fixed (truncate back on the row button) and measuring the real DOM:

build	condition	badge right	row right	verdict
buggy	plain 320px	165	312	passed against the bug
buggy	row squeezed	230	143	RED
clean	row squeezed	130	142	GREEN

The fixture's generated nicknames are short, so at 320px the row never overflows, nothing can be clipped, and the assertion was measuring a condition that never occurs. The test now forces the overflow itself and carries a premise assertion that the name is actually being clamped, so it fails loudly rather than silently going vacuous again.

Two further corrections came out of the same exercise, both worth knowing:

• My first premise check measured overflow on the button, which is wrong — on a correct layout the button never overflows, because the name clamps instead. That version failed on the clean build.
• The premise originally ran before the property assertion. Putting truncate back on the button stops it being a flex container, which makes both child spans inline, and scrollWidth/clientWidth are 0 for inline elements — so the mutation check failed with "the name is not being clamped", which is true but describes a symptom rather than the clipping. The property is now asserted first and the mutation fails with "the ⚠ is clipped past the right edge of its row".

Adding a flagged member to example data broke an unrelated spec, and the mechanism is worth recording. getByRole matches the accessible name by case-insensitive substring, and a member row's accessible name includes the aria-label of every badge inside it. The warning's label reads "…but their name closely resembles one", so every row carrying a ⚠ now also answers to getByRole("button", { name: "Close" }). The Export Identity spec failed on a strict-mode violation at its Close button, pointing at a member row, with nothing to suggest this feature was involved. Fixed with exact: true, which is also simply correct for a button whose entire label is "Close". Found only by running the whole suite — the new spec passed throughout.

Also verified: breaking confusable_variant so the names stop folding turns both example-data tests red, and deleting the modal's visible sentence turns the modal pin red. every_example_room_shows_the_impersonation_warning asserts the fixture reaches its own premise in all three rooms — deputy badged, checker non-empty, exactly one member flagged, and that member not a badged deputy — which was re-run after the guard changes in #489 landed rather than assumed to still hold.

AGENTS.md gains a short note on telling whether a UI test measured the build you think it did: dx serve served a stale build during this work and reported a mutation check as passing, which inverts the one technique that proves a browser test is not vacuous.

Full suite green: 649 Rust tests, 5/5 Playwright, cargo fmt and prettier clean.

[AI-assisted - Claude]

[sanity]

Review — Light tier + adversarial read

Tier: Light. Additive UI + fixture + tests, no protocol/contract/wire surface, no WASM change (both migration checks pass untouched). But the modal wiring is non-trivial logic on a trust surface, so it got a full adversarial read rather than a rubber stamp.

External model unavailable — Codex is out of credit; Gemini CLI remains deprecated. Claude-subagent substitution, same as #489. Recorded so the weaker signal is visible.

Verdict: no BLOCKING findings. Three IMPORTANT, addressed before publish.

Clean, and verified rather than assumed

• The modal passes the right member. member_id is the modal target; target_nickname uses the identical canonical → display_nickname derivation MemberList uses, so the two surfaces cannot disagree on the string they compare. self_member_id appears nowhere in the warning path. This was checked specifically because feat(ui): warn on names visually confusable with a moderator's #489's reviews found that swapping it at a render site compiles, passes everything, and puts ⚠ on the genuine owner and every real moderator.
• Attacker-controlled text is contained. No dangerous_inner_html anywhere in the file (security: stored XSS via member nickname rendered in dangerous_inner_html #227 stands). The imitated name is its own DOM node, never interpolated into a sentence, and arrives already glyph-stripped so it cannot forge a 🛡 or 👑. The chip's label is derived from the tooltip (split(':').next()) rather than hand-written, so it follows the privilege branch automatically and this surface cannot invent wording that drifts.
• The exact: true fix is complete. The sweep was re-done independently and wider than the original: 121 name-based locators across the suite — getByRole, getByText, getByLabel, getByTitle, getByPlaceholder, filter({hasText}) — matched against all three tooltip wordings. Exactly one collision, "Close", matching both "Impersonation warning" wordings via "closely resembles". Anchored patterns are structurally immune.
• The derived-impostor rule is provably tier-1. Branches 1 and 2 hold for any input, because I and l both map to the same sentinel in fold_bar_class and every later step then operates on byte-identical strings. Branch 3 holds for ASCII, and both name pools are verified pure ASCII.
• No existing spec's counts break. Each was checked individually, including the one asserting exactly one 🛡.
• Four of the five new specs cannot pass with the feature broken. The fifth is a pure negative, sound because it is paired with a positive in the same file — and it is what catches the id swap end-to-end.
• Perf at ~135 members is fine. The modal builds the deputizer maps twice per render, all O(members); well under a millisecond, and smaller than a sweep the modal already ran.

Fixed before publish

1. The modal's 4th argument was pinned by nothing. The other two surfaces each carry an argument pin whose own comment calls the id swap "the worst mutation this feature has". In this fixture both the impostor's and the viewer's privilege_in_view are None, so swapping member_id → self_member_id there changed nothing observable in any test. The failure it allowed is the sharp one: a viewer who is themselves badged — every moderator in Freenet Official — opens an impostor's modal and reads "Name conflict: … Both are real; check the member ID", the wording for a legitimate clash, shown for a genuine impersonation, to the people most likely to act on it.
2. The authoritative surface list said "two surfaces" and named the modal among those NOT rendering it — in the same paragraph that congratulates itself for not being the stale comment this file's credibility depends on. This PR makes the modal the third.
3. The uppercase "fallback" was the majority case. Exhaustively: branch 1 6.5%, branch 2 42.1%, uppercase 51.4%. More than half of dev-example runs showed BOB SMITH (MEMBER) flagged against Bob Smith (Member) — correct by the fold, but it reads as a false positive and trains developers to distrust the badge, the inverse of the fixture's purpose.

Worth carrying forward

A badge's aria-label becomes part of its whole row's accessible name, and Playwright matches names by case-insensitive substring. That is how a member row came to answer to getByRole("button", {name: "Close"}) and broke an unrelated Export Identity spec — a failure pointing at a member row with nothing to suggest this feature existed. Now that the sentence is also visible text, getByText/hasText are collision surfaces too. The mitigation note lives on ImpersonationWarning::tooltip, where someone rewording it will actually see it.

Also noted, not a finding: playwright.config.ts sets retries: 2, so a genuinely flaky spec reports green as "flaky" — worth remembering when reading green CI here as evidence.

On the 320px test

It was vacuous as first written and passed against the reintroduced clipping bug: the fixture's generated names are too short to overflow at 320px, so the assertion measured a condition that could not occur. Found only by mutating. It now forces the overflow and asserts the name is actually clamping as a premise, and the collision was re-demonstrated on the static release harness — the one CI uses — not just through a dev server.

[AI-assisted - Claude]