Standardize Button and IconButton with Buzz design tokens

[mahanti]

Button and IconButton previously had separate emphasis and sizing recipes, and the agent error notice still used a legacy HTML button. Both shared controls now use the same variants and 32/40/52px sizing, following the Block UI structure with Buzz's existing typography, colors, spacing, and materials. Icon buttons default to round; compatibility aliases and Buzz's tint/chrome treatments remain available.

Loading preserves geometry, accessible names, focus, and available colors. Disabled outlined/unfilled controls retain their treatment; expanded triggers retain pressed emphasis, and hover is limited to pointer devices. The design viewer now has simple previews and bordered example groups, and the agent notice uses the shared Button.

Review fixes

Chrome IconButtons retain their glass hover recipe. App journeys assert the intended zero-width borders, padding tokens, canonical sizes and aliases, and enlarged-label containment. Sidebar assertions compare icon centers at the original tolerance while retaining label left-edge, surface, menu, and draft checks. The viewer retains button, menu, and dialog coverage; the menu collision probe uses a point inside its pill trigger. Committed review screenshots were removed.

The optional BUZZ_TEST_WORKERS limit preserves defaults, selection, assertions, timeouts, and retries when unset; invalid values fail configuration loading.

Search fixture CI repair

At 6efbdfa (main integrated through 837e07a), the avatar alignment test seeds its photo in the existing initial-profile fixture instead of starting the app, editing storage, and reloading during startup. Its image-load and center-alignment assertions and tolerance remain unchanged. profilePicture is test-scoped and defaults to the same empty value; the photo route is installed before navigation. No production code or fixture error allowance changes.

Diagnosis: the original WebKit setup reproduced an aborted-request failure in 1/12 local diagnostic executions. A temporary controlled reproduction captured an issued stream ID, confirmed its close, then delivered its control; it reproduced the exact hosted Expected: primary / Received: undefined fixture error. This establishes that retired-stream delivery can produce the observed failure; the old hosted trace did not record owner-close ordering. All diagnostics were removed. This is a layout-test setup repair, not a general repair of the synthetic fixture's retired-control behavior.

All six cases in the complete search file passed in Chromium/WebKit locally (4.1s), then all 24 repeated alignment executions passed (20.8s), without retries. No browser cases or assertions were removed or moved. Startup/reload stress is not the purpose of this geometry case. Mandatory hooks passed 2,216 tests across 210 files (62.29s wall, 76.55s summed test execution), application/design types, and design guards. These are local macOS results. All hosted checks passed at 6efbdfa, including DCO, security checks, and CI run 35861007939: JavaScript, Rust/tool integration, browser measurements, all four Chromium/WebKit journey shards, and CI required. The previously failing WebKit shard passed 129/129 tests in 6.2 minutes, including all three search cases. Optional Windows native validation was skipped. The head is conflict-free; reviewer/code-owner approval remains outstanding.

Presence timing CI repair

At d85c124 (main integrated through 877ae2a), the presence timing assertion moves to the owners of the five-second start gates. The old browser assertion subtracted modeled relay arrival timestamps, after admission, signing, transport, and fixture signature verification. Variable work after admission can compress observed arrival spacing, so the 4,985.963ms hosted observation does not establish an early admission.

Controlled-clock tests now assert no second client read or broker admission at 4,999ms and availability at exactly 5,000ms. Client coverage includes remount with and without a retained timeline author; existing continuous-author-churn coverage remains. Shortening either production gate to 4,980ms made the corresponding tests fail; restoring the unchanged production implementations passed all 25 tests in both full owner files (0.417s local wall time).

No browser cases were removed by this repair. Only the arrival-interval assertion moved; the full presence journey retains real app/broker wiring, 300-author mounting and scrolling, the 256-author cap, deduplication, Unknown during held replacement reads, and no live presence subscriptions. All 12 presence cases passed in Chromium/WebKit locally (27.5s, no retries). No production behavior, timing requirement, timeout, or retry policy changed.

Validation

• Presence repair snapshot d85c124: focused owner tests and the entire presence browser file passed as above. Mandatory push hooks passed 2,210 unit tests across 207 files (63.92s local wall time, 77.09s summed test execution), application/design type checks, and design guards. Hosted DCO and all presence checks passed in CI run 35853872864; that run failed only the WebKit search fixture case addressed above.
• Earlier checked snapshot c32a6da: all 48 viewer cases passed locally (40.6s); hosted sidebar cases and the unchanged thread-history case passed both engines. The only hosted failure was the presence arrival-spacing assertion repaired above.
• Earlier button snapshot 4b4bfbe: all 28 cases in the six affected app-browser files passed in Chromium/WebKit (55.9s), and the chrome hover assertion failed before its CSS fix in both engines. The new button viewer cases require real-browser geometry, computed styles, focus, and reduced-motion behavior.
• Original button work adds two browser cases (four engine executions), none removed. This timing repair adds no browser cases and maps the moved timing assertion to controlled owner tests with fail-then-pass evidence.

Scope and remaining checks

The PR contains button work, the approved opt-in local Vitest worker limit, and the bounded presence/search test repairs. No presence production code changed. Packaged native acceptance and a visual walkthrough of every app view remain deferred. Hosted CI is green at 6efbdfa; required reviewer/code-owner approval remains the merge gate.

[mahanti]

🤖 @wesbillman — ready for your review. This standardizes Button and IconButton using existing Buzz tokens and updates the agent-notice dismiss action. Light/dark screenshots and the notice preview are included in the PR description. Local checks passed, including 42 Chromium/WebKit viewer cases, 69 design tests, and 437 related unit tests; hosted CI is running and DCO passed.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Changes requested

Reviewed head 6e9ae9bf817eaa812312f6f24e3d9fe224cc382d against base 298a50a9861c19d33e45b2b52bdadb81b128f15d.

P2: Preserve the chrome hover recipe. The new generic ghost hover selector also matches chrome IconButtons and outranks their glass hover. Hovering an enabled shell Search Buzz control now uses --affordance-subtle-hover instead of --bg-glass-primary-hover, while retaining the glass blur/rim. The inline finding traces the introduced cascade change. Keep chrome hover owned by its material and add a focused light/dark browser assertion.

P2: Migrate the existing app-journey assertions with the shared contract. Exact-head CI run 35783961740 fails seven cases in each engine across all four functional browser jobs. These are stale expectations, not seven product regressions, but the early failures prevent later interaction/layout assertions from running. Update the existing tests without reverting the intended new design or dropping coverage:

Source	Required contract correction
tests/browser/app-style-order.spec.mjs:30-33, terminal-renderer.spec.mjs:299, thread-unread.spec.mjs:134-138	Assert the new zero-width border and preserve hover/no-layout-shift/focus coverage. A computed color on a nonexistent border is no longer meaningful.
tests/browser/design-system.spec.mjs:78-103	Probe the actual Button padding owner, --space-6, rather than --space-control-inset; retain the diagnostic 29px assertion and independent typography/color checks.
tests/browser/plugin-import.spec.mjs:182-206	Expect canonical md for the omitted size, and update the downstream geometry map to cover sm/md/lg plus retained aliases. Fixing only the first assertion exposes another failure because that map currently lacks canonical names.
tests/browser/profiles-appearance.spec.mjs:84-90	After text enlargement, assert the 32px minimum and content containment rather than fixed 32px height. Keep exact default-scale geometry and both theme iterations.

Exit criteria: retain chrome glass hover, cover that cascade, and update these existing journeys to the intentional shared-button contract. The required browser gate must then pass; no broader redesign is requested.

Scope and evidence: reviewed shared API/alias normalization, disabled/loading/name/ref/render/tooltip composition, CSS/token states, representative shell/settings/profile/terminal/message consumers, the notice-dismiss migration, and viewer coverage. No interaction/API blocker found. Expanded pressed emphasis is explicitly intended; an initially suspected disabled-hover defect does not survive cascade analysis and is not a finding. JavaScript, Rust/tool integration, and browser measurements passed in the hosted run; functional browser jobs failed as above. Source-only review on pinned bare Blox objects plus existing CI logs/artifacts; no checkout, code execution, local tests, rerun, or live/native acceptance claim.

[wesbillman]

[P2] Keep chrome out of the generic ghost hover cascade

Removing the icon-variant exclusion makes this selector match IconButton variant="chrome", because IconButton.tsx:33-42 also gives it data-variant="ghost". This selector has specificity (0,4,0), while the glass-primary-interactive hover applied at lines 170-172 has (0,3,0), so the generic fill wins even though the material is declared later. On a fine pointer, hover the enabled shell Search Buzz control (src/app/shell/PageSearch.tsx:88-99): it uses --affordance-subtle-hover rather than its retained --bg-glass-primary-hover, leaving the glass blur/rim behind. Base excluded icon variants and did not have this conflict. Preserve the chrome-specific hover recipe without restoring the exclusion for canonical icon variants, and cover its actual background in both themes. This is a source-derived cascade finding, not a claimed live reproduction.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Changes requested: two P2 items, no additional blockers

Independent review of head 6e9ae9bf817eaa812312f6f24e3d9fe224cc382d against base 298a50a9861c19d33e45b2b52bdadb81b128f15d confirms the existing review's findings and exit criteria. All three delegated review lanes are complete; this is the consolidated result, not three separate reviews.

1. Preserve chrome's glass hover. src/shared/design-system/styles/components.css:79-85 now includes chrome IconButtons in the generic ghost hover rule, which outranks the glass recipe at lines 170-172. This affects enabled shell Search Buzz and other chrome controls. I independently reproduced the cascade in Chromium and WebKit, light and dark, using the compiled app CSS extracted from CI run 35783961740 and the production button attributes. Light hover becomes opaque rgb(232, 232, 232) instead of rgba(255, 255, 255, 0.62); dark hover becomes rgb(64, 64, 64) instead of rgba(28, 28, 28, 0.66). Keep the chrome hover material authoritative and add a browser regression assertion. This was an isolated browser CSS probe, not a live-app walkthrough.

2. Migrate the existing app-browser assertions alongside the intentional design changes. Hosted CI fails seven cases per engine across all four browser shards. The earlier review correctly identifies the stale border, padding-token, size-name/map, and enlarged-text-height expectations. Preserve their downstream focus, layout, and unread-state coverage; do not delete the cases or revert the intended design to satisfy old assertions. These are test-maintenance failures, not seven independent product defects.

Stable exit criteria: fix and cover chrome hover, update the six affected app test files to the new contract, and pass the affected browser journeys/required gate. No API redesign or per-caller return to the old artwork/shape is requested. Round defaults, standardized artwork, text-size growth, and expanded pressed emphasis are deliberate changes, not separate blockers. The pre-existing unguarded material touch-hover behavior is outside this required repair.

Validation limits: source review plus existing hosted results and the focused two-engine CSS probe; no broad suite rerun or native acceptance. CI's synthetic merge a24da5bddb4a1ac6eb9eadbf78e4be4b7a4ed06b has the same tree as the reviewed head. JavaScript, Rust/tool integration, and browser measurements passed. The standalone design-viewer browser suite is not invoked by the current CI workflow, so its reported 42 passes remain author-reported local evidence. That CI coverage gap is advisory here, not a new infrastructure requirement. No additional defect found in the AgentWakeNotice dismissal migration.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Changes requested: one remaining P2 test-contract migration

Re-reviewed 4b4bfbebf7c8f899e8348ac7bbd2f591f4e014af against 20d7447c107e56f2885970c73b9394757e904c51, converging on the previous review’s exit criteria and the main-merge/worker-limit increment.

P2: Update the merged sidebar journey for standardized artwork

tests/browser/navigation-sidebar.spec.mjs:196-204 still compares the left edges of the regular 17px channel icon and hovered disclosure chevron. The new components.css:44-47 rule sizes direct SVG artwork in small buttons to 16px; IconButton now forwards compact into that small-button recipe. The hash is nested and remains 17px. The disclosure box remains 32px and its unchanged positioning centers both sizes on the same column (ChannelSidebarRow.module.css:68-71). Consequently equal centers now legitimately produce different left edges.

Exact-head CI confirms the result in both Chromium and WebKit: line 202 receives 41.5, expects 41, and aborts before the parent/child label, row-surface, menu, and new-session-draft assertions. This is another stale assertion after the design migration, not a request to revert the deliberate 16px artwork or change the control’s position.

Smallest repair: compare icon column centers (x + width / 2) across the regular icon and disclosure states, retaining the label left-edge and downstream interaction assertions. Do not widen the tolerance or delete the case. Demonstrate the complete sidebar file passing in both engines, then satisfy the required browser gate.

Previous findings and remaining evidence

• Chrome’s glass-hover exclusion and its real-app light/dark regression assertion address the prior cascade blocker. The six previously identified app files now preserve their downstream checks while using the new border, padding-token, size/alias, and enlarged-label contracts.
• No blocker found in the opt-in positive-integer Vitest limit or merge coverage: default selection is unchanged, and both button and menu viewer cases survive. The menu probe moves inside the pill without removing its visibility/collision assertions.
• CI is still red. The additional Chromium thread-history timeout at tests/browser/messages.spec.mjs:311 remains unattributed; it is neither labeled flaky nor asserted to be caused by this PR. JavaScript, Rust/tool integration, measurements and WebKit shard 1 passed; Windows native validation was skipped. Standalone viewer passes remain author-reported, not a hosted viewer gate.

Source-only review on pinned bare Blox objects plus existing hosted evidence. No checkout, repository-code execution, tests, CI rerun, or live/native acceptance performed. No broader API/design change requested.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Re-review: prior code/test-contract blockers resolved; CI still blocks merge readiness

Reviewed head c32a6da994f0718040e648f0baea6ee84fa72bbe against base f66f89e5b8993ee5833cfa377486a0b0ff9911ff. This converges on the previous review’s exit criteria, including the sidebar follow-up and main-merge resolutions. No remaining PR-attributable code/test-contract blocker found.

• Sidebar repair is complete. tests/browser/navigation-sidebar.spec.mjs:190–234 compares icon centers with the original tolerance, retaining label left-edge, hover-swap, row-surface, menu and new-session-draft assertions. All 10 cases in the file pass in each engine in the current hosted run.
• Original repairs remain intact. Chrome is excluded from the generic hover fill, with a real-app glass-color assertion across both themes and three widths. The six migrated app files retain their downstream interaction/layout/unread coverage; all 14 cases per engine pass. The opt-in Vitest worker limit preserves default concurrency when unset and does not change selection, timeouts or retries. The main merge retains the button, menu and incoming dialog viewer coverage. The independent review lane is integrated. I considered its suggestion to change chrome pressed/expanded styling but do not promote it to a blocker: the prior published review explicitly accepted expanded pressed emphasis, and DESIGN.md:99–103 retains that contract. The agreed chrome repair was hover, not a new state redesign.
• Required CI remains red, separately from these resolved findings. Run 35801641854 fails only Chromium’s large-mounted-thread presence case at tests/browser/presence.spec.mjs:353: observed interval 4,985.963ms, expected ≥4,990ms. That test and src/features/presence have identical blobs at base and head. I have not established causation or called it a proven flake; it remains an unresolved required gate, not evidence for another button defect. The earlier thread-history journey now passes in both engines with messages.spec.mjs unchanged from base.

Evidence and limits: inspected exact-head source/diffs and existing completed hosted logs; no local suite execution, CI rerun, production edits, approval or merge. CI’s synthetic merge a801a6c685345c1c453091329dba03ac0ab8bdf0 has the same tree as this head. JavaScript passed 2,182 tests across 205 files, plus types/design guards; Rust/tool integration, browser measurements and the other three browser shards passed. The reported 48 standalone viewer passes remain author-reported local evidence, not a hosted viewer gate. Native acceptance is not claimed.

The requested code repairs are resolved. Merge readiness still requires the presence failure to be classified/resolved and required CI/reviewer gates satisfied; this comment is not approval.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Re-review clear for code; required CI still blocks merge readiness

Reviewed d85c124c75b21186e4a6792c6b171843e41cbd21 against exact base 877ae2a6749221dd6850d5695b5c8de023a239e3, including the delta from prior reviewed c32a6da. No new actionable PR-attributable defect found after integrating the UI, presence and integration lanes. This is a comment, not approval.

• Prior button repairs remain intact: chrome glass-hover exclusion, migrated downstream assertions and sidebar icon-center checks. The merged composer retains the tint/toolbar Send control and wrapping layout. No new alias, loading/activation or consumer-compatibility defect established.
• Presence coverage now tests the owning clocks: remount with/without a retained author stays gated at 4999ms and recovers at 5000ms; admission rejects at 4999ms and admits at 5000ms. Existing continuous-churn coverage remains. Production gates are unchanged. Removing the upstream-arrival-spacing assertion preserves all six browser cases and their cap/overflow, remount/recovery and no-direct-upstream checks. Existing CI passes all 12 engine executions without retries and all 25 owner/admission unit tests. Contributor-reported mutation failures are supporting evidence, not tests I executed.
• CI remains red: run 35853872864, WebKit shard 1 fails the synthetic fixture owner lookup at tests/browser/fixture.mjs:874, collected by teardown at :1220. Trace evidence shows the first stream-interests request uses its issued stream ID around page reload; the later stream's control succeeds. The actual search/avatar center assertion at global-search.spec.mjs:34 completes without error. This is not a demonstrated geometry defect. Owner-close ordering is not captured, so retirement is a hypothesis, not a proven flake or proof of unrelatedness. The fixture and transport blobs are identical at base/prior/head. Do not weaken geometry tolerances or broadly allow unexpected errors on this evidence.

Validation boundary: source-only on pinned Blox objects plus independently inspected existing hosted logs/artifacts. No checkout, install, new tests, CI rerun, implementation change or native acceptance. Hosted CI tested synthetic merge 6a1b11598f065be607460e5e2ff74e617930815f with the pinned base/head parents. JavaScript lint/types/build and all 2,210 Vitest tests (207 files), Rust/tool integration, browser measurements, three functional shards and DCO pass; WebKit shard 1 is 128/129. Windows native validation was skipped. Standalone viewer runs remain earlier contributor-reported evidence, not independently verified exact-head acceptance.

Exit criteria: classify/resolve the remaining fixture/stream-lifetime failure and satisfy required CI/reviewer gates. No additional button redesign or speculative transport hardening is requested.

Existing CI timing evidence (artifact basis, not new benchmarks)

Suite/shard	Passed/total	Wall seconds	Summed test seconds
Vitest	2210/2210	106.482	181.255
Browser measurements	7/7	131.192	122.212
Chromium 1	129/129	367.660	704.056
Chromium 2	123/123	266.640	476.776
WebKit 1	128/129	359.794	686.633
WebKit 2	123/123	397.724	744.319

The failed shard marks its report incomplete. Slowest Vitest test: durable read-state owner 12.847s; slowest file: unread-startup 26.989s. Slowest measurement: cursor paging 62.420s. Functional shard maxima: packed-author integration 34.806s Chromium / 31.425s WebKit (shard 1); immobile-timeline setup 14.665s Chromium and old-root navigation 21.977s WebKit (shard 2). Slowest files: agent-control 91.920s/84.659s (Chromium/WebKit shard 1), message-navigation 47.255s/89.241s (shard 2).

Presence-file summed browser execution: current Chromium 30.553s / WebKit 42.700s versus prior 34.680s / 44.043s; prior Chromium had one failure. Prior Vitest: 2182 tests, 110.370s wall / 189.790s sum. These are run snapshots with intervening main changes, not isolated speedup evidence. The two owner files currently total 25 passing tests, approximately 0.416s summed execution. No isolated before/after performance claim.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Follow-up clear; prior CI failure addressed

Reviewed 6efbdfa5140541212766b7a2c25628dbb5e2a3a2 against 837e07a4e532f295402f2e9567911a756d06b93f, including the delta from d85c124. No new actionable blocker found after integrating the independent fixture review. This is COMMENTED, not approval.

• The new commit is confined to two browser-test files. fixture.mjs:30,1041–1057 adds a test-scoped picture option with the previous empty default. global-search.spec.mjs:4–35 installs the image route before initial navigation instead of mutating storage and reloading during startup. Loaded-image and center-alignment assertions, tolerance, other search cases, and fixture error checks remain intact. This removes an unnecessary reload from a geometry test; it does not claim a general retired-stream fixture repair or prove the old hosted failure’s ordering.
• Range comparison preserves all seven prior authored commits. Button/IconButton compatibility, chrome hover, loading/accessibility repairs and the presence 4999/5000ms owner-clock coverage remain intact. The advanced base has no changed-path overlap with the PR delta. No broader transport redesign or speculative fixture hardening is required for this follow-up.
• Existing CI run 35861007939 passes all executed jobs and required CI. Logs pin synthetic merge 47266058986e435fec357796cddc0f07e4e2a21b to this exact head/base. The reports verify all six search executions across Chromium/WebKit, without retries; the formerly failing WebKit shard passes 129/129. JavaScript passes 2,216 tests across 210 files. DCO and security checks also pass; Windows native validation is skipped.

Source-only review on pinned bare Blox objects plus existing hosted logs/artifacts: no checkout, code execution, new tests or CI reruns. Contributor-reported local repeated-run/mutation evidence was not independently executed. Native acceptance and a complete visual walkthrough remain deferred; required reviewer/code-owner approval remains the merge gate.

Existing CI cost evidence, not a controlled benchmark

Suite	Current pass/total	Wall seconds, prior → current	Summed test seconds, prior → current
Vitest	2216/2216	106.482 → 85.497	181.255 → 147.604
Chromium shard 1	129/129	367.660 → 373.380	704.056 → 714.324
WebKit shard 1	129/129	359.794 → 370.856	686.633 → 708.739

Current avatar case: Chromium 0.898s, WebKit 0.755s; complete search-file summed execution: 4.779s and 5.397s. No browser cases added or removed by this repair. Slowest current Vitest test/file: unread-startup 10.015s/22.367s. Slowest shard-1 tests: packed-author integration 36.065s Chromium / 32.063s WebKit; slowest files: agent-control 94.072s / 93.019s. Prior is run35853872864 at d85c124, with one failed WebKit case and intervening base changes. These snapshots establish neither isolated speedup nor elimination of every race.