The store detail sheet now carries a data-source block for source.*
modules: publisher, upstream url, the terms in plain words, and any
attribution the operator has to carry with the output. It sits above
maintainers and above the install button, because it is a decision
input rather than a footnote.
The values are selectable: compliance notes get written by copying,
not retyping. A note names whose terms these are, so nobody reads them
as the module's own licence. Four guards, including that an empty
attribution renders no empty row.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
Pulling a model moves gigabytes and could take fifteen minutes behind
a 14-pixel spinner. The model picker now follows the hub's pull stream
and shows a bar with the backend's own status and the megabytes for
the layer in flight.
The byte counts describe the current layer, not the whole model, so
the bar restarts per layer. That is deliberate and stated in the code:
the backend never says how many layers are still coming, so a single
overall number would have to be invented.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
Applying an update downloads and swaps a binary and takes minutes; the
doctor showed a spinner inside a disabled button for the whole time.
SystemActions gained a streaming CLI runner that hands each line to the
caller as it arrives, with CHAIN_PLAIN=1 set for the child so the CLI
emits one line per transition instead of its redraw-in-place block.
The update card now shows an indeterminate bar labelled with the
running step and an elapsed counter on its own timer, so the counter
keeps moving between lines that can be minutes apart. No invented
percentage: the CLI reports steps, not a measurable total.
The streaming path still defers to debugRunFaiOverride, so tests stay
hermetic and never spawn a process; three guards pin that.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
Both surfaces showed an indeterminate spinner for the whole install,
because the hub only offered a unary call. They now follow
HubAdmin/InstallModuleStream:
- The store's install dialog shows the phase in plain language, the
overall percentage, megabytes while the size is known, and a seconds
counter. The counter is the second, independent signal: it keeps
running even if the hub goes quiet, which is what tells 'slow' apart
from 'stuck'.
- The setup wizard shows the same bar per module instead of a spinner
inside the button.
- New strings in both locales for the phases, the byte line and the
elapsed counter.
progress_bar_visual_test writes the four waiting states to
build/progress/ in either theme, so the result can be judged without
launching the desktop app. Writing it turned up a real trap worth
recording: awaiting toImage() directly in a widget test leaves the
binding waiting forever - the file passed in six seconds, then sat
there until the ten-minute timeout failed the whole suite.
tester.runAsync() is the fix. Full suite: 186 passed.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
A waiting user asks two questions that a plain LinearProgressIndicator
answers as one: how far along is it, and is anything still happening.
The widget keeps them apart - the value may stand still for minutes
while a highlight driven by 'busy' keeps crossing the bar, so a
stalled percentage no longer reads as a frozen app.
Also: glides to new values over 600 ms so the polling interval behind
it stays invisible, refuses to walk backwards, renders indeterminate
rather than an empty bar when no value is known, stops animating once
the work ends, and honours reduce-motion.
Eight guards in test/progress_bar_test.dart cover each of those rules.
Writing them found a real defect: with busy: false the late-final
controller was first constructed inside dispose(), where the ticker's
context lookup is already unsafe.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
The anchor caption 'Projekt / Bereich' truncated uselessly at the
rail width — 'Kontext'/'Context' fits and the tooltip carries the
full explanation. workspace_shots_test renders the anchor, the
open menu (checkmark, aggregated why-line), and the switching /
in-area identity bar per theme as the visual-proof harness.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
Three connection-truth fixes on the flow surface:
* The editor now lists the CONNECTED hub's flows: inside a sealed
area Studio passes the instance's own flows dir
(~/.chain/sealed/<slug>/data/flows) — previously the editor kept
showing the shared hub's files whatever the connection, so a
sealed area's list was simply wrong (and runSavedFlow hit the
other hub's namespace).
* A connection switch replaces the editor state entirely (keyed by
the sealed slug): an open buffer from one context never survives
into the other — same privacy class as the switch race.
* Sample truth comes from the hub: listFlows' FlowSummary.sample
(regenerated Dart SDK stubs) feeds the editor's sampleFlowNames;
unknown (old hub / fetch failed) means no chips. Inside a sealed
area the empty list offers the deliberate 'import example flows'
action via chain flows import-samples against the instance's own
dirs; the shared hub gets no such offer (it seeds samples itself,
and a deliberate deletion is respected).
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
The switcher used to be embedded per page (Flows/Runs/Audit/
Approvals) — invisible on the other five pages and sitting in a
different corner depending on the page (persona review 2026-08-27,
consensus finding). It now lives ONCE in the sidebar, above the
destinations: active project/area always visible, opens the same
menu everywhere, Cmd+P from anywhere. The shell listens to the
workspace, so the sidebar endpoint label can no longer lag a
sealed switch until the next health tick.
Also in this rebuild:
* Stopped sealed areas ask before starting ("Start area X?") —
a context switch must never boot a hub daemon as a click
side-effect; running areas keep switching with one click.
* The switcher tooltip told a wrong scope ("filters this view") —
it now says the choice applies everywhere and stamps new runs.
* The aggregated sealed row explains itself in place (names can
reveal client identities) and links to the Settings toggle
(Settings dialog gained an initialCategory jump).
* The active entry carries a checkmark in the menu.
* The Cmd+K palette knows projects and areas, ranked by recent
use; sealed names honour the privacy setting — while hidden,
the palette offers the guarded picker instead of the names.
* The runs empty state names the active project filter as the
cause ("No runs in project X" + show-all action) instead of
claiming the feature is off.
Tests updated to the anchor and made hermetic (scriptable
projects on the fake hub, sealed-area fake); new coverage for the
checkmark, the why-line, and the start confirmation.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
Two findings from the workspace persona review, both rated high:
* Switch race: the hub client re-pointed at a sealed area's hub
before the workspace announced the sealed context, so the 2 s
page pollers (runs, audit) could fetch and render that hub's
data without the sealed marking. Switches now run inside an
explicit switching window: opened before anything touches the
connection, announced optimistically in the identity bar
("switching…" + spinner, leave button hidden), pollers and the
shell health tick pause inside it, and pages drop replies whose
context epoch changed mid-flight. The sealed context is
announced only after the new hub answered healthy.
* Filter loss: entering a sealed area cleared the shared-hub
project filter and returning restored only the endpoint. The
filter is now parked on entry and restored on return; prefs
keep the parked value throughout, so live state and prefs agree
after the round trip (and after a mid-session relaunch).
Guard: workspace_switch_race_test pins both invariants
state-matrix-style against scripted hub + sealed-area fakes —
reconnects may only happen inside an open switch window, pollers
must stay silent inside it, and the filter must survive the round
trip. SealedAreaService gained a debugSetInstance seam so the
suite never scans a real ~/.chain.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
The hub copies the reviewer string a client sends straight into
decided_by (DecideApproval, ClearEventLog); nothing on the wire ties
it to the authenticated caller. Studio filled it from the OS account,
so an export read like non-repudiation while being an arbitrary
client claim — the legal finding of the 2026-07-26 usertest panel.
The real fix is hub-side (derive decided_by from CALLER_IDENTITY);
that contract is written down in docs/reviewer-identity.md and needs
a hub release. Until then Studio does the one thing it can do
honestly and marks its own claim as a claim, inside the record:
- data/reviewer_identity.dart is the single place that produces and
reads the value; wire() is idempotent, so page and HubService may
both normalise. Every write path funnels through HubService, so no
surface can send a bare handle.
- The inbox states before the decision who will be recorded, what
that attribution is worth on this hub (from AuthStatus), and the
literal string that lands in decided_by. An unreadable auth policy
stays unreadable — never optimistic.
- Reading back: a marked value shows its plain name plus an
unchecked flag; an unmarked one (legacy row, CLI decision, or a
future hub-derived identity) is not classified either way.
- The audit wipe seeds the same kind of marked attribution into its
chain.reset marker.
When the hub starts deriving the value it overwrites the field and
the prefix disappears by itself — no Studio release needed.
Guards: reviewer_identity_test (the value) and
approvals_reviewer_identity_test (every surface that writes or
renders it, against the hermetic fake hub). Visual proof for both
themes via the dialog-shot harness.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
A popup menu is width-capped at ~280px, so the full-sentence German
entries in the audit overflow menu ran past the edge. The clipped
tail of the reset entry was exactly the "(nur local/dev)" scope
that keeps it from reading as "delete evidence", and the label's
centre landed outside the hit box.
Guard in responsive_test: the page-level overflow sweep cannot see
popup menus (their width does not follow the window), which is why
this went unnoticed.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
Panel findings against the reworked approvals page, fixed in place:
- Never fabricate the request time: ApprovalRecord.createdAt is
nullable now; a missing created_at omits the line instead of
rendering DateTime.now() (which drifted on refresh). Guard:
approvals_origin_test pins the omit-on-null invariant.
- Copyable errors on approve/reject/batch via showChainErrorSnack
(the hard project rule) — batch surfaces the first real cause.
- Reject requires a reason: ChainInlineHelp strip + confirm disabled
while empty, no more silent close-and-nothing-happens.
- Batch approve applies the same no-data confirmation as the single
path, naming how many selected requests carry no show: data.
- Plainer language: glossary "Vorgang (Flow)", history label FRAGE
(was PROMPT), no-data hint drops developer jargon.
- One-click copy of the run id; history payload pretty-prints like
the card.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
Approvals: the pending card now shows its full origin — flow, step,
run id (previously dropped at the Dart mapping layer), project, and
requested-at — under an ORIGIN heading, led by a one-line intro strip
that says what the inbox is and what Approve/Reject do. Approve/Reject
buttons carry tooltips; the history dialog gains project + run id.
Fixes the approvals doc drift (title/details/reviewer ->
prompt/show/timeout_seconds). Guard: approvals_origin_test renders the
card via the hermetic fake hub and pins every origin fact.
Runs: the "hub too old" state now leads with an in-place update button
(same `chain update apply` path as the Diagnose page), the Diagnose
deeplink demoted to secondary, with a CLI-absent fallback. Guard: two
new RunsLoadErrorView widget tests.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
Doctor: when the system AI uses an Ollama endpoint that no declared
host service covers (host:port match, /v1 suffix stripped), the
services panel says so in one sentence with a one-click 'declare as
host service' via the new DeclareService RPC — and states honestly
that it takes effect after a daemon restart (the restart button sits
on the same page). Pure suggestOllamaServiceEndpoint pins every
branch.
Shell: one slim, dismissible banner after connecting when the
release manifest offers a newer hub version; dismissal is persisted
per version so each release hints exactly once (pure
shouldShowUpdateHint + a widget test through the fake hub).
Deliberately manifest-based — Studio and hub versions are
independent counters, so a direct comparison would be wrong;
unreleased dev skew stays with the per-page classified states.
The probe stays inert under the test probe override: its timeout
timer leaked into hub_banner_test (the hermeticity class again).
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
The detail sheet always answers 'who maintains this?': one
selectable line per maintainer from the store index's new
maintainers list, or an honest 'not specified' when the index
names nobody (StoreMaintainersSection, public for the widget
tests). The install trust gate carries the same fact when
present and stays terse otherwise. DE+EN; dialog-harness proof
captured with the maintainer row.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
The night run pinned the editor by commit because its sandbox could
not create tags; the tag exists now (same tree, plus the changelog
commit), so the pin goes back to the reproducible tag form.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
Store snapshot is now nullable: until the first successful store
search (or after a sealed-area connection switch) the editor gets
null and claims neither 'installable' nor 'not in store'. The
snapshot reloads after installs and on connection switches — a
sealed switch previously kept the other hub's capability offers
alive on the mounted Flows page. Editor pin 2535c28.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
Mount the shared project switcher (same control as Audit, Approvals
and Runs) in the flow editor's toolbar via the editor's new
toolbarTrailing slot. The list filters by the active project with
'no key = general' display semantics, and new flows are stamped
with the active project's key. Editor pin moved to c4a39a3
(0.25.0 + project separation).
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
Even with the honest install badge the hub error stays reachable
(stale store snapshot, race with a store refresh, older hub). The
friendly-error mapper now gives it its own headline plus a hint
naming the three acquisition paths — local module install, adding
the providing store, configuring the MCP/n8n integration — in EN
and DE, with the verbatim hub message kept copyable. Matcher unit
tests EN+DE guard the classification.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
The capability set behind the flow editor's Install quick-fix and
the flow list's install badge ingested every store entry's
requiresCapabilities (dependencies, not provided capabilities) and
ignored entry status/kind. Clicking Install on such a capability
ended in the hub's "no store entry for '<name>'" error.
The set now mirrors the hub's install resolver (entry names only,
no planned or federated entries) via installableStoreCapabilities()
with unit tests for both classification states. Unresolvable
capabilities render the editor's 'not in store' state, which
explains the three recovery paths before any click; the editor pin
moves to 0.25.0 (commit-pinned until its tag exists) and the dialog
harness captures the badge states light+dark. Studio 0.78.0.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
The doc-verifier pass over the new trust/exposure surfaces came back
PASS with five improvements, all applied:
- the store policy notice gains a 'Learn more' into the security doc
(the notice named security.require_signatures but not where it
lives)
- 'blocked' disables the trust gate's install button — an active
button contradicted the 'install would be refused' statement right
above it (guard test added)
- the unknown-exposure tooltip now says what the operator can do
(check where the name resolves)
- dead l10n key verifPillUnverified removed (unverified is the
page-level notice, never a card pill)
- stale header comment in install_verification.dart corrected
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
The trust-gate dialog replaces its generic 'no per-entry status yet
(alpha)' note with the hub's classified verification statement —
pinned store key / trusted publishers (green), installs without
signature checking (amber), install would be refused (red), bridge
entry (neutral) — via one shared describeInstallVerification mapping.
Against a pre-0.23 hub the field is empty and the old honest wording
stays (pinned by test).
Information architecture: policy-off is a GLOBAL fact, so it appears
as ONE ChainInlineHelp notice above the store grid instead of a
warning pill on every card (card noise); only 'blocked' — a genuine
per-source anomaly — earns a card pill. Doctor's host services show
the hub-classified network reach per endpoint (local only / private
network / publicly reachable with a protect-it hint / reach unknown).
Verified end-to-end against the live dev hub (guide harness): the
wire field arrives, the store page shows exactly one policy notice
and quiet cards; trust-gate variants captured via the dialog
harness. Suite 123 green.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
New ChainInlineHelp (intro strip: what this is + what will happen, with
an optional 'Learn more' into the doc sheet) and ChainFieldHelp /
ChainFieldLabel (a '?' affordance per field). First applied to the
add-satellite dialog, which asked for a bare 'name' with no hint of
what a satellite is or does (usertest): it now leads with a plain
explanation + a federation 'Learn more', and the name field carries a
'?'. Both widgets are quiet by design.
Verified: field_help_test covers the widgets + that the dialog explains
itself; dialog_shots_test.dart (a reusable headed dialog-capture
harness) proved the layout in light + dark. Studio 0.76.0.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
The Federation and Runs help buttons opened the architecture doc:
federation.md/runs.md existed as assets but had no _DocEntry, so
showFaiDoc resolved the unknown slug to _kDocs.first. Register both
(onWelcome: false, so they don't clutter the newcomer grid but are
reachable), split the Welcome grid onto the curated subset, and make
the unknown-slug fallback assert in debug instead of silently opening
the wrong topic.
Guard (no-bugfix-without-a-guard): doc_help_wiring_test.dart scans
lib/ for every showFaiDoc('slug') call and asserts each has a
registered entry AND both assets/docs/<slug>[_de].md files. Exposes
kKnownDocSlugs for the test.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
The switcher listed sealed areas by name ('lbs', 'stromnetz') on
any glance or screenshot — but the names themselves often carry
client/mandate identity (usertest security finding). The sealed
section now renders one aggregated row ('2 sealed areas') with a
deliberate 'Show names' reveal per menu opening; selection still
pops the regular s:<slug> value. Settings -> Security gains 'list
sealed areas with their names right away' (WorkspacePrefs,
SidebarPrefs pattern, default off).
The aggregate row wraps to two lines — popup menus cap their
width and action texts must never be truncated (the first cut
showed '1 abgeschotte…' in the proof shot). Guard: switcher tests
cover aggregated-until-reveal and the Settings toggle; the old
direct-listing test now asserts the reveal contract. DE+EN.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
The same single-select choice pattern appeared as four widgets:
audit's hover pills, the store's SegmentedButton, the store filter
dialog's ChoiceChips, and the approvals TabBar (usertest finding
#14 / night-log decision 'pill segment as canon'). The audit
pattern is promoted to a shared ChainSegments widget (optional
icons, hover, selected border, button+selected semantics) and all
four sites use it; approvals switches lists via IndexedStack so
both stay alive and switching does not refetch.
Guard per the no-bugfix-without-a-guard rule: widget tests for
selection + semantics, plus a canon sweep that bans
TabBar/TabBarView/TabController/SegmentedButton/ChoiceChip from
lib/ (comments exempt). Deliberately out of scope: the flow
editor's Graph/Text/Run tabs live in the separate editor package.
Studio 0.75.0; guide images regenerated, dark + light verified.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
Walks every sidebar page against an older, released chain binary
(hermetic fixture hub) and fails when any page claims 'unreachable'
although the hub answers, or renders raw error text. Run via the
platform repo's scripts/skew-smoke.sh as a Studio release gate.
Verified against the real pair hub 0.21.0 vs workspace 0.22.0: all
invariants hold. Two timing notes are handled explicitly: real-async
settles between navigations and an app teardown before the fixture
teardown keep grpc-dart's data-after-cancel race (unguarded
_responses.add, call.dart:395) from failing the walk spuriously;
the final fake-time pump drains the channel's 5-minute idle timer.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
The widget suites used to talk to whatever listens on the real
endpoint — results depended on the operator's machine (a running
hub fed real data into a11y/responsive runs and its gRPC channel
timers caused the historic flake). Hardening round:
- HubService.instance is now injectable (debugSetInstance);
FakeHubService (test/support/fake_hub.dart) answers every member
the pages touch with healthy-empty defaults and scripts per-RPC
failures (UNIMPLEMENTED / UNAVAILABLE / detached gate) through a
GrpcError-shaped fake. Unimplemented members are recorded and
fail the sweep with the exact list.
- state_matrix_test.dart pins the app-wide invariants for every
sidebar page x hub condition: healthy => no unreachable claims
and no raw error text; hub gone => honest unreachable states;
UNIMPLEMENTED => never 'not reachable' while the sidebar shows
connected; detached gate => plain-language feature-off state.
- a11y + responsive sweeps now inject the fake (hermetic); the
6-minute idle-timer drain workaround is gone with the cause.
Real bugs the new sweep caught immediately:
- every data page (store, doctor, audit, approvals, federation)
folded ANY load failure into 'hub not reachable' — the runs-page
bug class; they now share HubLoadErrorView, which classifies
into unreachable / needs-newer-hub / load-failed-with-copyable-
detail (new generic DE+EN strings)
- the approvals page's hidden tab had no future listener: a load
failure there surfaced as an uncaught async error
- the audit status bar rendered the raw gRPC error wall verbatim;
it now shows the classified friendly headline (still selectable)
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
Doctor findings used to be dead-end statements — 'approvals
waiting for review' left the operator to find the approvals inbox
on their own. Every finding with a dedicated surface is now one
tap away from it:
- summary tiles: modules -> store, approvals -> approvals inbox,
audit chain -> audit log (chevron affordance, tooltip + semantics
button; the services tile stays plain — no dedicated page)
- modules/approvals panel rows link the same way
- the event-log headline opens the audit page next to the
existing verify button
- host-services empty state gains a 'view the configuration'
button opening the in-Studio config viewer the hint refers to
- the update banner's release-notes URL is now an underlined,
clickable link instead of dead text
Tiles and the panel are public callback-driven widgets so the
widget tests pump them without a live hub. New DE+EN link labels.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
Finally caught with a creation stack trace: when the last gRPC
stream closes, Http2ClientConnection arms the channel's 5-minute
idleTimeout timer — even on a shut-down connection — so the
test's 1-minute drain never covered it and the framework's
pending-timer invariant tripped whenever the arm landed inside
the test window (frequent while a real hub listens on 50051).
The suite now closes the channel in real-async space at the end
of the body (new @visibleForTesting HubService.debugResetChannel;
shutdown is deliberately not awaited — it wedges on a mid-connect
socket, but cancels its timers synchronously) and pumps past the
idle timeout so the timer fires inside the test. 6 consecutive
full-suite runs + 3 isolated runs green; before, roughly 1 in 3
full runs failed.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
The onDone handler armed an anonymous 3 s reconnect timer that
nothing could cancel; when the stream closed right before the page
was disposed (no hub, connect ends in onDone instead of onError),
the timer outlived the tree. The a11y suite caught this as the
rare 'Timer is still pending' flake noted in the night log — the
failure reason is now captured and the timer lives in a field that
dispose() cancels.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
The runs monitor folded every load failure into 'hub not reachable',
contradicting the sidebar's green connected dot whenever the hub
answered but the RPC failed — most visibly against a pre-0.22 hub
whose version predates the ListInvocations RPC (UNIMPLEMENTED).
Classify the failure instead (top-level, unit-tested):
- UNIMPLEMENTED -> 'this view needs a newer hub version' with a
doctor-page link (the update banner lives there)
- FAILED_PRECONDITION from the detached gate -> the regular
feature-off empty state with the guide button
- UNAVAILABLE / DEADLINE_EXCEEDED / socket-level failures -> the
honest 'hub not reachable' state (unchanged)
- everything else -> a load-failed state with the friendly error
and a copyable detail box
The error view is a public callback-driven widget so the tests pump
each variant without a live hub. New DE+EN strings for the too-old
and load-failed states; grpcCodeOf/grpcMessageOf exposed from the
friendly-error mapper instead of duplicating the duck-typing.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
The menu so far only exported the current view (type + search
filter over the page 100-event window). A second action now fetches
the complete event history of the active project scope in one
EventLog call (the RPC has no cursor and no server-side cap) and
writes it as JSONL. Serialisation extracted to a top-level function
with unit tests; a stale comment advertising the never-shipped
"chain audit export" command now names "chain admin events --json".
Studio 0.73.0.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
- Store hero: 'TODAY' badge only for an operator-accepted story; the
rotating compiled-in fallback deck now says 'FEATURED' (no false
freshness claim). Policy as a top-level function with unit tests.
- Audit filter chips: standard label typography instead of mono —
mono stays reserved for paths and identifiers.
- DE chain wording: 'Hash-Kette geprüft' as the one confirmation term
(audit header now matches the doctor pill); 'intakt' stays the
state headline. EN was already consistent.
- Workspace switcher: contrast bump for the sealed-area 'stopped'
label.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
Three doctor-page findings from the usertest panel:
- Module tile no longer counts the hub's built-in 'system'
pseudo-module — a fresh hub shows 0 modules, matching the
welcome checklist's definition of an install. Counting is a
top-level function with unit tests.
- When the audit DB lives in an OS-cleanable temp directory
(/var/folders, /tmp, Windows Temp), the daemon-files panel
says so instead of presenting the state as healthy. The
classifier is a top-level function with unit tests.
- The daemon card states who-talks-to-whom-how in one line:
endpoint, transport security (TLS / unencrypted-local /
unencrypted), and whether a bearer token is attached (length
only) — the auditor's baseline the green dot cannot answer.
Also syncs pubspec.yaml (0.70.0 -> 0.72.0) with kStudioVersion,
which had drifted to 0.71.0 while pubspec stayed behind.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
- the 'start a saved flow' checklist tick no longer unticks once
the flow.completed event scrolls out of the 100-event window —
a local sticky marker keeps it honest to its wording
- the Today carousel shows 'n/m' next to the 6-px dots so the
position is readable without aiming at them
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
'document' rendered as a raw lowercase English token next to
localized neighbours; unknown categories at least capitalize.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
- 'Mit Endpunkt verbinden' — no Endpoint/Endpunkt mix
- audit-chain lead term is 'Hash-Kette' everywhere (doctor pill);
chain detail says 'Verkettung lückenlos geprüft' instead of the
raw field name prev_event_sha256
- welcome checklist line says who refreshes what
- setup privacy note explains the local model instead of ending in
a bare model tag
- default project renders localized ('Allgemein') in the switcher;
sealed-area status pills explain run state on hover
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
Text widgets render markdown backticks verbatim (usertest: reads
as typos / raw dev output) — stripped across both catalogs; code
terms stay inline in plain type. 'Zeig dem Hub' / 'Nimm das CLI'
now use the formal address; the guard test learns both stems.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
- audit type filter: 'Alle'/'All' capitalized like every other label
- settings -> setup wizard: close Settings first (one modal layer),
stronger wizard scrim
- try-out setup profile discloses the upgrade path to a regulated
profile
- store maturity pills explain themselves on hover (experimental/
published/planned)
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
The empty state unconditionally claimed background runs were
switched off, even on hubs where the operator had enabled them.
The hub now reports the flag on the list RPC (detached_enabled);
the hint picks the truthful variant.
Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
