Add Surface notepads with capture, archive, and lifecycle preservation

[nedtwigg]

Add a notepad to each Surface so users can keep plain notes and styled terminal selections, navigate back to captured output, and find notes in a machine-local archive after the Surface closes. Pane headers and minimized Doors open notes; Settings provides the Archive view with staged deletion and recovery of unreadable data.

Helpers share their parent’s notepad and capture without source pins. Reset, hide, and promotion preserve the shared notes on the parent. Closure checks helper work before and after archiving, freezes edits during the transaction, and tears down only after every gate succeeds. The floating context preserves main’s animation, focus behavior, and helper lifecycle fixes. Late helper startup is cancelled when its parent retires, command reuse excludes actual closures, and failed or cancelled dor ensure panes archive user-entered notes before removal.

The archive uses compare-and-swap transactions across processes. VS Code mirrors live notes in host memory for editor-tab disposal and same-host resumes, and stores the archive in an atomically replaced shared file with legacy migration and locked recovery. Stable pending batch IDs preserve edits and deletions when a save reply times out. Standalone quit archives before teardown with an explicit failure decision.

Validation: full pnpm test, pnpm build, and all 29 Rust unit tests passed after merging origin/main. A live Storybook browser check verified creating a note in helper context and reopening the same note from the parent. Specs and rationale accompany the implementation.

[cloudflare-workers-and-pages]

Deploying mouseterm with    Cloudflare Pages

Latest commit:	06366f1
Status:	✅  Deploy successful!
Preview URL:	https://ccb076e6.mouseterm.pages.dev
Branch Preview URL:	https://notepad-2.mouseterm.pages.dev

View logs

[dormouse-bot]

Read the whole thing — the notepad model, the three archive hosts, the close coordinator, the VS Code volatile mirror, the Rust store, and the specs. It holds together well: the compare-and-swap contract is stated once and honoured identically by all three ports, applyArchiveMutation is genuinely idempotent in both directions, and the delete-then-append replacement is the right shape for "landed, then reported failure". The dialog-keyboard lease refactor is a real bug fix riding along. I also re-read the delta since I started (the main merge that dropped resolveTerminalSessionId, and 1f08b218).

One thing I think is a gap, plus three small ones inline.

The standalone quit gate can't reach the coordinator's "delete the landed batch" branch. archiveNotesBeforeQuit derives its Surface list from getNotepadSnapshot(), which only holds Surfaces with at least one live note — replaceNotes deletes the map entry when the last note goes. So a Surface that still has a pendingBatchId but no notes never reaches archiveSurfaceNotes, and peekPendingBatchId never runs for it.

That combination is reachable, and it is exactly the case the spec's rule covers: the 3 s withDeadline fires, gaveUp.abort() stops the forget step but the mutation lands anyway, the user picks Cancel, then deletes every note in that notepad. docs/specs/notepad.md → "Closure" says the batch should go with them — "its notes having been deleted after the user was told none were stored" — but on the next quit the stored batch survives. close-coordinator.test.ts's "deletes the landed batch when the retried closure has nothing left" pins the coordinator; quit.test.ts mocks getNotepadSnapshot, so nothing pins the caller.

Wall.closeSurface isn't affected — it passes an explicit id. It's only the one caller that infers the list.

[dormouse-bot]

All four earlier threads are genuinely closed. I re-derived the quit path with the real store: notepadSurfaceIds() is the right home for the union, quit-notepad.test.ts reaches the branch through the real coordinator rather than a mock, the async wrapper turns a synchronous getCwd throw into a per-entry settleAllWithin fallback, and both comments now match the code. The dor alias in standalone/vitest.config.ts is what the real notepad-store import needs, and it matches the dor/* path standalone's tsconfig already carries.

One leftover, non-blocking.

[dormouse-bot]

Read the increment since b02f9674: the two authored commits plus the origin/main merge resolutions. The kill-gesture consolidation into requestKill is a real simplification — the keyboard layer no longer re-derives door/untouched policy — the Wall-owned pendingSurfaceCloses vs. the notepad store's shared notes freeze is the right seam, and routing dor ensure's integration-timeout cleanup through closeSurface closes a genuine note-loss hole. The merge resolutions check out too: pointInConvexPolygon goes with its last caller, and TerminalPanel / wall-context / ui-geometry land on the post-#573 shapes.

One finding.

docs/specs/layout.md still says the dor ensure throwaway is torn down with killPaneImmediately. Under "Spatial navigation", item 6 ("Focus-neutral surface creation") ends:

A throwaway that never reports OSC 633 integration is torn down with killPaneImmediately, whose live selection check leaves the caller's selection intact (a --minimize throwaway is already a door, disposed directly).

398ff0fa made that path await closeSurface(result.value.id, 'silent'), and the same commit's docs/specs/notepad.md → "Closure" states the opposite as a rule: Must route dor ensure cancellation and integration-timeout cleanup through closeSurface. layout.md's own new rule under "Kill confirmation" — "Every kill routes through the notepad close coordinator … and can refuse the close" — contradicts it as well. The sentence is also unconditional where the behavior no longer is: a refused archive keeps the throwaway open and answers the caller with temporary surface kept open: ….

The line is outside the diff hunks, so no inline suggestion. A replacement that fits the budget (layout.md is at 7939 of 7950 words):

A throwaway that never reports OSC 633 integration closes through `closeSurface`, whose teardown's live selection check leaves the caller's selection intact (a `--minimize` throwaway is already a door, disposed directly); a refused archive keeps it open.

Say the word and I'll push it.

Not a finding, just a heads-up: #574 rewrites ContextAction's busy/disabled handling in the same TerminalContextView.tsx that 1d0987e5 restructures around, so whichever lands second will need the other's edit reapplied.

What I checked, and what I ruled out

• closeHelperParent dropping its promoting exemption in 398ff0fa means it now throws out of disposeHelper, and none of its three call sites handles that. Unreachable in practice: closeSurface gates on helperRefusal first and helperHasWork returns true while promoting, and both replace paths are behind isReplaceableShell, which is isUntouched(id) && !getHelper(id). Worth knowing that the assert can only fire somewhere it cannot recover — removeSurface(id) has already dropped the notepad by the time killPaneImmediately runs.
• usePopoverFocusTrap vs. the private useModalFocusTrap in design.tsx: not duplication worth collapsing. They already share stepFocus, which focus-step.ts documents as the intended shared primitive, and the popover adds outside-click dismissal and scopes its handler to focus inside the popover.
• SelectionPopup.copy.test.tsx folding into SelectionPopup.test.tsx preserves all five cases; the it.each Helper-closure test splits into four named tests with more coverage, not less.
• pointInConvexPolygon disappears in the origin/main merge because PaneHeaderContextMenu did; nothing references it anywhere.
• reconnect.ts's ptyById map is equivalent to the old ptyList.some(...) scan, and still adopts an orphaned helper on the else branch.
• scripts/spec-lint.mjs passes on the PR's real tree. (It fails in this checkout with spec not indexed -> docs/specs/notepad.md, because the CI harness restores AGENTS.md from the base branch before the session starts — git show HEAD:AGENTS.md has the index entry.)