Web UI across projects

  - attempt 1 finding f1: Acceptance says internal/web tests fetch EACH page kind (overview, roadmap, runs, run detail, change set) under /p/<a>/ and /p/<b>/. In internal/web/switcher_test.go at 8cb4b26c, TestProjectPagesAreScopedWithSwitcher fetches only overview (a), runs (a, b) and roadmap (b; data checked for a and b). It never fetches a change set page (/p/<x>/changes/<id>), and it doesn't check that page's own-project data or its switcher link (the switcher should keep the roadmap kind, so /p/b/roadmap). Run detail is only touched by TestSwitcherKeepsListKindOnDetailPages on /p/a/runs/nope (a 404). That test asserts only that a /p/b/runs/nope link is absent, which a 404 body satisfies trivially. No run exists in either fixture, so the run detail page is never served with its switcher or data. Overview is not fetched under /p/b/. A throwaway probe test in a separate worktree showed the behaviour works (change set page 200 with own data only and switcher /p/<other>/roadmap). But the committed tests don't prove it as the acceptance requires. Fix: add a run to each fixture and fetch /p/a|b/runs/<id> and /p/a|b/changes/<cs>, asserting own data only, no other project's data, and the switcher link to the other project's list page. Ran: go test -trimpath ./internal/web/ -run 'Switcher|Scoped|EventStream' -v (pass).
- web-root-listener (step review/review): open
  - attempt 2 fixer in cycle 2, session 5c2370c9-0455-4f6c-a52b-01a1b3b02b6a: pass (said done)
  - attempt 2 verifier in cycle 2, session a8f11b1e-6930-403c-a7bc-01a1b3b3918a: pass (Evidence written by the verifier)
- web-projects-home (step review/review): open
  - attempt 2 fixer in cycle 2, session 4bc3d39f-f727-4a1a-889d-01a1b3b3d4b6: pass (said done)
  - attempt 2 verifier in cycle 2, session fa0195ce-fc7e-41d2-b8d9-01a1b3b782b6: pass (Evidence written by the verifier)
- web-project-switcher (step review/review): open
  - attempt 2 fixer in cycle 2, session 41d0e9ec-ec35-4c11-99c0-01a1b3b7c975: pass (said done)
  - attempt 2 verifier in cycle 2, session f03ae487-9ec7-4506-a7a2-01a1b3bbdc67: pass (Evidence written by the verifier)

## Checks

- compliance (step review/review): passed after 1 cycle
  - cycle 1: passed, check session 923f8fbf-837c-4195-ac69-01a1b3a855ba pass (said done)
  - round 1 (cycle 1): 2 findings, 0 confirmed
    - f1 minor at internal/web/root.go:27 on web-projects-home: The all-projects list is served at /projects, while / (and the header wordmark) still serve the home project's overview. The statement calls this list 'the web UI's home page', but the root URL is not that page. The acceptance's tests do render and check /projects as written, and every page's nav links to it.
    - f2 nit at internal/api/web_root_test.go:15 on web-root-listener: The acceptance says 'a root daemon of two projects opens one listener'. TestWebRootHandlerServesEveryProject only exercises WebRootHandler through httptest. That there is a single listener is clear from runDaemon building one web.Manager (daemon.go:193), but no test asserts it.
- quality (step review/review): passed after 2 cycles
  - cycle 1: failed, check session 58562b0a-1ab1-4fdd-855b-01a1b3a8a532 pass (said done), critic session e788efff-caeb-46f5-a1e6-01a1b3aebe9d pass (said done)
  - cycle 2: passed, check session 9ca41bae-e526-49e5-bd71-01a1b3c96e10 pass (said done)
  - round 1 (cycle 1): 5 findings, 2 confirmed
    - f1 major at internal/api/daemon.go:193 on web-root-listener: WebRootHandler is handed the daemon's live ctx, and WebRootHandler, WebProjectsSource and WebMergedInboxSource copy it (projectCtx does `c := *ctx`) on every request goroutine. Meanwhile the poll writes that same struct: when the home project is the cwd, daemonHome returns ctx itself as homeCtx, and daemonDetach -> ensureRepoSession sets ctx.RexSession and ctx.repoSession. That is a data race. The old code snapshotted ctx once ('the handler gets its own copy of ctx') to avoid exactly this. Fix: take one copy of ctx in runDaemon (or at the top of WebRootHandler) and derive every per-project ctx from that copy. — confirmed: runDaemon passes the live ctx to WebRootHandler (daemon.go:194). Per request, the resolver and WebProjectsSource/WebMergedInboxSource call projectCtx(ctx, dir), which does `c := *ctx` (daemon_projects.go:34) on the request goroutine. When the home project is the root's cwd, daemonHome returns ctx itself as homeCtx (daemon_projects.go:82). The poll then writes that struct through daemonDetach -> ensureRepoSession (ctx.RexSession, ctx.repoSession, daemon.go:1597) and daemonFoldCache setup (ctx.daemonFold, daemon_fold.go:111). An unsynchronised struct copy racing those writes is a data race, the one the old `snap := *homeCtx` existed to prevent.
    - f2 major at internal/web/root.go:781 on web-project-switcher: Every request under /p/<project>/ calls projects() to build the switcher. That includes static CSS/JS, every fragment refresh and the event stream. WebProjectsSource reads every registered project's run ls, inbox (a model fold) and daemon status, so N projects cost N full reads per asset or fragment fetch, on each live event. The switcher only needs the names of the initialised projects, which rootcfg plus projectInitialised gives cheaply. It could also be built only when a page is rendered. — confirmed: RootWithInbox calls projects() for every request under /p/<name>/ (root.go:71-80), before dispatch and whatever the tail, so static assets and fragment refreshes pay too. WebProjectsSource (web_root.go:65-96) runs WebRunsSource, WebInboxSource (a model fold) and WebDaemonSource for every registered project, just to collect the Initialised names for the switcher. Fragments refresh on each live event, so every event costs N full project reads per open page. rootcfg plus projectInitialised gives the names cheaply.
    - f3 minor at internal/api/web_root.go:121 on web-projects-home: WebProjectsSource makes its own WebHealth for every project, the home one included, apart from the one inside the home project's WebProjectHandler. The home project's health report is then refreshed twice in the background.
    - f4 minor at internal/web/switcher_test.go:170 on web-project-switcher: TestEventStreamScopedToProject only asserts that project b (built with no events handler) does not answer 200 at /p/b/events. It never checks that /p/a/events reaches a's stream, or that app.js's data-rz-base makes a scoped page subscribe under its prefix, so 'the live event stream is scoped to the same project' is barely tested.
    - f5 nit at internal/web/root.go:777: The /p/<name> redirect builds its Location from the raw name, while the scope prefix and the hrefs use url.PathEscape(name). A name that needs escaping would get inconsistent URLs.
  - round 2 (cycle 2): 3 findings, 0 confirmed
    - f1 minor at internal/web/templates/layout.html:20 on web-projects-home: With a home project named, / now serves the all-projects home. On the unscoped pages (/projects and /inbox), the nav's Overview link (href="/") and the wordmark therefore open the projects home, not an overview. Overview reads as a duplicate of Projects there, while Runs and Roadmap redirect into the home project. Scoped pages are unaffected: rewrite turns / into /p/<project>/.
    - f2 minor at internal/api/web_root.go:121 on web-projects-home: Still open from cycle 1: WebProjectsSource keeps its own WebHealth for the home project as well as the one inside the home WebProjectHandler, so the home project's health is refreshed twice in the background.
    - f3 nit at internal/web/root.go:112: Still open from cycle 1: the /p/<name> to /p/<name>/ redirect builds its Location from the raw name, while the scope prefix, the switcher and the new unscoped redirect use url.PathEscape(name).
- qa (step review/review): passed after 2 cycles
  - cycle 1: failed, check session 6b4d6ff8-0459-46e5-9b18-01a1b3a900e6 pass (said done), critic session 3f2b25f0-3773-4c7a-bcca-01a1b3af003e pass (said done)
  - cycle 2: passed, check session 770ebe55-115a-42a7-aa61-01a1b3c9b73f pass (said done)
  - round 1 (cycle 1): 3 findings, 1 confirmed
    - f1 major at internal/web/root.go:54 on web-projects-home: Hands-on with the root daemon, opening the web UI at http://127.0.0.1:<port>/ gave the home project's (alpha's) overview, and its /runs and /roadmap, served unscoped. Those pages have no project switcher and no project name, so the owner cannot tell which project they are looking at. The all-projects home exists only at /projects. The leaf says 'The web UI's home page lists every registered project' and decision m29-web-all-projects says 'every existing page is scoped to one project through a switcher', but the page the web UI opens on lists no projects and has no switcher. / should serve (or redirect to) the projects home, and the old unscoped paths should redirect to /p/<home>/... — confirmed: internal/web/root.go:54 sends every path outside /projects, /inbox and /p/ to the home project's handler with no scope, so / (and /runs, /roadmap) render without a switcher (layout.html:20 only shows it when a scope is set), and the header's Overview, Runs and Roadmap links point at those unscoped paths. The web UI therefore opens on one project's overview with no project name or switcher. That breaks the leaf web-projects-home ('the web UI's home page lists every registered project') and decision m29-web-all-projects ('every existing page is scoped to one project through a switcher'). The all-projects list is only at /projects.
    - f2 minor at internal/web/templates/projects.html:3 on web-projects-home: On /projects, the not initialised project's row links /p/bare/, and that URL returns 404 because the resolver refuses projects with no .rhiza/. The row should not be a link while the project is not initialised.
    - f3 nit at internal/web/templates/projects.html:3: Before the first health poll, each project's pill renders class 'rz-pill--' with an empty modifier and the text 'unknown'. It settles to the real state after a poll.
  - round 2 (cycle 2): 1 finding, 0 confirmed
    - f1 minor at internal/web/templates/projects.html:3 on web-projects-home: Still as in cycle 1: on the projects home (now /), the not initialised project's row links /p/bare/, and that URL answers 404 until the project is initialised. The row should not be a link while it is not initialised.
- scope (step review/review): passed after 1 cycle
  - cycle 1: passed, check session 39d65494-37eb-426c-b60c-01a1b3a94dd0 pass (said done)
  - round 1 (cycle 1): no findings
- model (step review/review): passed after 2 cycles
  - cycle 1: failed, check session da5a1f92-b12b-4bbf-9b30-01a1b3a9a85c pass (said done), critic session 7ac44fa9-5649-4d7d-84c4-01a1b3af4c06 pass (said done)
  - cycle 2: passed, check session 048df6e4-90d8-4683-8fe1-01a1b3ca03c2 pass (said done)
  - round 1 (cycle 1): 3 findings, 1 confirmed
    - f1 major at internal/web/templates/layout.html:20 on web-project-switcher: The landed capability web-design-components still says the shared layout's header has a 'nav to Overview, Runs and Roadmap', but this change set's layout now renders a project switcher (All projects plus each initialised project) and a nav of Projects, Inbox, Overview, Runs and Roadmap, with the golden layout files regenerated to match. The change set touches that node's behaviour without proposing an update to its statement, so once landed the model describes a header the code no longer has. Propose a set on web-design-components in this change set naming the switcher and the Projects and Inbox nav entries. — confirmed: web-design-components' statement still reads 'nav to Overview, Runs and Roadmap', while layout.html:20 on this branch renders the switcher template and a nav of Projects, Inbox, Overview, Runs and Roadmap. No write in this change set's log touches that node (01M6PFJWRXY4PRZ989CC6WM3ZK), so once landed the model describes a header the code no longer has.
    - f2 minor at internal/web/root.go:44 on web-projects-home: web-projects-home (and decision m29-web-all-projects) speak of the web UI's 'home page' listing every project, but the code serves that list at /projects while / (and the header wordmark) stays the home project's Overview. Either the leaf's statement should name /projects, or / should be the all-projects home; as written, model and code disagree on what the home page is.
    - f3 nit at .rhiza/log (leaf placement): The four new web leaves (web-root-listener, web-projects-home, web-merged-inbox, web-project-switcher) sit directly under the root capability rhiza rather than under web-monitor, where every other web UI capability lives.
  - round 2 (cycle 2): 5 findings, 0 confirmed
    - f1 minor at internal/web/templates/projects.html:3 on web-projects-home: The statement says each project on the home links to that project's overview, and the test (projects_test.go:126) checks href="/p/bare/" for the not initialised project too. But the resolver in WebRootHandler (internal/api/web_root.go:49) returns nil for a project with no .rhiza/, so /p/bare/ answers 404. The model promises an overview link that the code cannot serve. Either the statement should say a not initialised project is listed without a link, or the row should not link.
    - f2 minor at .rhiza capability web-overview-daemon, web-overview-fast, web-live-sections, web-events-stream: Landed web-monitor leaves still place pages at the root: 'The Overview page at / shows the daemon', 'The Overview page at / and its daemon fragment answer at once', 'the embedded script subscribes to /events'. On the root daemon's listener, / now serves the all-projects home (internal/web/root.go:81), the Overview is at /p/<project>/, and app.js subscribes to <data-rz-base>/events. web-project-switcher states the scoping, so nothing contradicts it outright, but these statements now describe the per-project handler's paths, not the served UI's. A later amendment should say 'a project's Overview' and '/p/<project>/events'.
    - f3 minor at internal/web/root.go:89 on web-project-switcher: RootWithSwitcher redirects every unscoped page GET (for example /runs or /roadmap) with a 302 to /p/<home project>/..., and keeps /static/, /api/, /events and /site.webmanifest served by the home project at the root. Old bookmarks and the read-only API depend on this, but no capability or decision records it. The model's web-project-switcher statement covers only the /p/<project>/ pages.
    - f4 nit at internal/web/scope.go:45 on web-project-switcher: The statement says the switcher 'keeps the page kind' and lists run detail and change set as page kinds. pageKind maps a run's page to the other project's /runs list and a change set's page to its /roadmap, because those pages do not exist in another project. That is sensible, but the statement does not say it.
    - f5 nit at internal/api/daemon.go:193: The comment says one listener serves 'the home project at /'. Since b70cca66, / serves the all-projects home and the home project lives at /p/<home>/.

## Code checks

- step review/code: pass

## Sign-offs

- signoff (visit 1): approved by rule autonomous

## Sessions

- build/build, session 920647b0-3cd1-4f10-858b-01a1b35c0666: tokens input 38, output 8413, cache creation 59528, cache read 1364370; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session b04195b2-0c7e-4d55-bc41-01a1b3611173: tokens input 30, output 6363, cache creation 45334, cache read 945917; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session fb1248b4-767e-407b-8917-01a1b361597d: tokens input 28, output 7416, cache creation 61972, cache read 996271; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session e175fe67-c2ac-4be1-9032-01a1b3655d7c: tokens input 38, output 6686, cache creation 38703, cache read 1106265; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session de8a69e7-7d2e-4d09-a637-01a1b3659e9c: tokens input 22, output 5346, cache creation 49097, cache read 679581; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session baea7c60-abf8-4e19-aec6-01a1b37221c3: tokens input 46, output 6594, cache creation 44644, cache read 1313878; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 38282772-2b50-44ac-9920-01a1b3729630: tokens input 64, output 14012, cache creation 73548, cache read 2746843; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 50df14e5-0779-45a1-bf50-01a1b37953fc: tokens input 28, output 5681, cache creation 45194, cache read 847726; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 1d0a600e-61fc-4823-a9c1-01a1b3797e74: tokens input 66, output 14988, cache creation 75910, cache read 2696559; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session a8d6ccb5-0f91-4e75-88eb-01a1b37eeb7a: tokens input 52, output 10446, cache creation 56732, cache read 1616014; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 4d352dc5-252c-4fb3-b1f7-01a1b37f4eb2: tokens input 34, output 7477, cache creation 46748, cache read 1086193; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session f888349e-6339-4a67-90ec-01a1b38213b9: tokens input 42, output 7350, cache creation 39830, cache read 1176555; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session f3176677-1163-4818-a130-01a1b38f3a59: tokens input 38, output 5352, cache creation 38769, cache read 1069259; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session f1a799a6-287e-4899-a7df-01a1b39bd2be: tokens input 24, output 4370, cache creation 35644, cache read 672810; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 923f8fbf-837c-4195-ac69-01a1b3a855ba: tokens input 14, output 2750, cache creation 56490, cache read 438861; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 58562b0a-1ab1-4fdd-855b-01a1b3a8a532: tokens input 38, output 9599, cache creation 73407, cache read 1589712; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 6b4d6ff8-0459-46e5-9b18-01a1b3a900e6: tokens input 70, output 18588, cache creation 71223, cache read 2725343; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 39d65494-37eb-426c-b60c-01a1b3a94dd0: tokens input 14, output 1462, cache creation 48499, cache read 410170; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session da5a1f92-b12b-4bbf-9b30-01a1b3a9a85c: tokens input 26, output 4718, cache creation 61042, cache read 936971; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session e788efff-caeb-46f5-a1e6-01a1b3aebe9d: tokens input 22, output 3524, cache creation 37001, cache read 592023; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 3f2b25f0-3773-4c7a-bcca-01a1b3af003e: tokens input 16, output 1899, cache creation 26776, cache read 394154; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 7ac44fa9-5649-4d7d-84c4-01a1b3af4c06: tokens input 14, output 1806, cache creation 27899, cache read 348585; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 5c2370c9-0455-4f6c-a52b-01a1b3b02b6a: tokens input 24, output 3226, cache creation 31879, cache read 646616; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session a8f11b1e-6930-403c-a7bc-01a1b3b3918a: tokens input 22, output 3689, cache creation 32897, cache read 594296; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 4bc3d39f-f727-4a1a-889d-01a1b3b3d4b6: tokens input 30, output 8394, cache creation 43238, cache read 908601; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session fa0195ce-fc7e-41d2-b8d9-01a1b3b782b6: tokens input 28, output 4099, cache creation 36663, cache read 803427; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 41d0e9ec-ec35-4c11-99c0-01a1b3b7c975: tokens input 40, output 7171, cache creation 41828, cache read 1227707; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session f03ae487-9ec7-4506-a7a2-01a1b3bbdc67: tokens input 36, output 5659, cache creation 38341, cache read 1067800; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 9ca41bae-e526-49e5-bd71-01a1b3c96e10: tokens input 34, output 6291, cache creation 60755, cache read 1280941; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 770ebe55-115a-42a7-aa61-01a1b3c9b73f: tokens input 72, output 17349, cache creation 69058, cache read 2772114; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 048df6e4-90d8-4683-8fe1-01a1b3ca03c2: tokens input 22, output 5988, cache creation 66274, cache read 771567; helper tokens input 0, output 0, cache creation 0, cache read 0

Totals: tokens input 1072, output 216706, cache creation 1534923, cache read 35827129; helper tokens input 0, output 0, cache creation 0, cache read 0