@cplieger/web-terminal-ui 8.6.0-dev.1 → 8.6.0-dev.11

package/src/features/tabs/model.ts

@@ -19,7 +19,9 @@ export type StatusRecord = SessionInfo & {
 };
 
 // The status vocabulary is module-private so a status's MEANING has one home:
-// every consumer asks a predicate below instead of comparing strings.
+// every consumer asks a predicate below instead of comparing strings. The
+// protocol states named below are the built-in sources; a classified OSC 9
+// notification may set any status.
 //
 // An exited session is viewable history that can never produce output again, so
 // session selection prefers live sessions everywhere.
@@ -30,11 +32,14 @@ const STATUS_EXITED = "exited";
  *  restart never paints as a failure. Terminal, like "exited". */
 const STATUS_CRASHED = "crashed";
 
-/** OSC 9;4 progress state 2, the error state (iTerm2 semantics). A STATE that
- *  persists until the program reports another, or the process dies. */
+/** An error the program reported: OSC 7501 state `error`, or OSC 9;4 progress
+ *  state 2 (iTerm2 semantics). A STATE that persists until the program reports
+ *  another, or the process dies. */
 const STATUS_FAILED = "failed";
 
-/** OSC 9;4 progress state 4, the warning state (iTerm2 semantics). */
+/** OSC 9;4 progress state 4, the warning state (iTerm2 semantics). OSC 9;4
+ *  cannot set it once the session has sent an OSC 7501 report, until a
+ *  terminal reset (RIS): OSC 7501 outranks OSC 9;4 until a RIS forgets it. */
 const STATUS_WARNING = "warning";
 
 /** Whether the session's process is GONE, whichever way it went: reloading onto
@@ -51,8 +56,9 @@ export function statusRevealsDot(status: string): boolean {
 }
 
 /** The human wording for a status, for BOTH the dot's tooltip and the tab's
- *  accessible name, so they cannot disagree. An unknown status (a newer server)
- *  falls back to the raw value rather than being hidden. */
+ *  accessible name, so they cannot disagree. A status outside the built-in
+ *  vocabulary (a host classifier's, or a newer server's) falls back to the raw
+ *  value rather than being hidden. */
 export function statusPhrase(status: string): string {
   switch (status) {
     case "working":
@@ -94,22 +100,16 @@ export function normalizeProgress(value: unknown): number {
   return Math.min(100, Math.round(value));
 }
 
-/** Whether the OSC 9;4 progress channel is speaking through this status; only
- *  these may show a bar. The server keeps sending the last percentage while the
- *  state persists, and `input`, `done`, `idle`, `exited` and `crashed` come from
- *  other channels, so a percentage under them is a claim about the wrong one. */
-export function statusOwnsProgress(status: string): boolean {
-  return status === "working" || status === STATUS_FAILED || status === STATUS_WARNING;
-}
-
-/** The percentage a status may SHOW. Two things clear it: the program's own
- *  OSC 9;4;0 (arriving as PROGRESS_ABSENT) and a status the channel does not own
- *  (kiro-cli parks state 4 at its context-usage percentage when idle, which once
- *  painted a done dot beside a 72% bar). Deliberately no third clear: 100% is a
- *  STATE that persists, and a timeout would assert a change the program never
- *  reported. */
+/** The percentage a status may SHOW. Under any live status it is the server's
+ *  value, because the status and the percentage can come from different
+ *  channels: OSC 7501 or a notification can set the status while OSC 9;4
+ *  supplies the percentage. Two things clear it: the server's PROGRESS_ABSENT
+ *  (the program cleared or never reported a percentage, e.g. OSC 9;4;0) and an
+ *  ended process, whose percentage nothing will ever clear. No timeout clears
+ *  it: 100% is a STATE that persists, and a timeout would assert a change the
+ *  program never reported. */
 export function renderedProgress(status: string, progress: number): number {
-  return statusOwnsProgress(status) ? progress : PROGRESS_ABSENT;
+  return isEndedStatus(status) ? PROGRESS_ABSENT : progress;
 }
 
 // The secondary-activity vocabulary: a host-reported background activity that
@@ -183,7 +183,7 @@ export const SWIPE_HINT_KEY = "wt-swipe-hint-seen";
  *  a notification. `working` and `warning` are ongoing and informational, so a
  *  dot for them would nag with nothing to act on; `failed` is a parked result the
  *  program does not revisit, so it belongs. Declared once so the raise test, the
- *  acknowledgement store and every attention sink cannot disagree. */
+ *  acknowledgement and every attention sink cannot disagree. */
 export type CueStatus = "input" | "done" | "crashed" | "failed";
 
 /** Severity order, most severe first, AND the complete set isCueStatus tests
@@ -221,15 +221,13 @@ export function cueIconName(status: CueStatus): "input" | "done" | "alert" {
 
 /** The cue statuses meaning the turn is OVER WITHOUT INCIDENT, the only ones a
  *  live background task may blank. `done` is the whole set: every other cue must
- *  reach the viewer AT ONCE, and `failed` here is OSC 9;4 state 2 rather than a
- *  turn verdict. */
+ *  reach the viewer AT ONCE, and `failed` is an error the program reported,
+ *  not a clean end of the turn. */
 const SETTLED_CUES: ReadonlySet<string> = new Set<CueStatus>(["done"]);
 
 /** The status the CUE surfaces see: the session's own, unless a settled turn's
- *  background task is still running, in which case "". "" and NOT "idle": "" means
- *  NO INFORMATION, so the seen map is left alone, where "idle" is a real non-cue
- *  state that would forget the acknowledgement and re-raise the cue when the task
- *  ends. The status DOT keeps rendering the real state. */
+ *  background task is still running, in which case "" (no cue). The status DOT
+ *  keeps rendering the real state. */
 export function foldedCueStatus(status: string, activity: string): string {
   if (!SETTLED_CUES.has(status) || normalizeActivity(activity) === "") {
     return status;
@@ -237,25 +235,29 @@ export function foldedCueStatus(status: string, activity: string): string {
   return "";
 }
 
-/** Whether a session's CURRENT status is a cue this viewer has not acknowledged;
- *  the one predicate behind the raise and the attention count. A latch arriving
- *  on a shown tab is acknowledged at arrival, so no caller needs a special case. */
-export function isUnseenCue(
-  status: string,
-  id: string,
-  seen: ReadonlyMap<string, CueStatus>,
-): status is CueStatus {
-  return isCueStatus(status) && seen.get(id) !== status;
-}
-
 /** What the cue fold reads per tab; structural, so a caller passes its own tab
- *  objects. */
+ *  objects. `status` is the FOLDED status (foldedCueStatus). */
 interface CueCandidate {
-  readonly id: string;
   readonly status: string;
+  /** the server's number for that status's occurrence */
+  readonly statusSeq: number;
+  /** the server-confirmed seen floor */
+  readonly seenSeq: number;
+  /** this page's optimistic read floor, 0 when none */
+  readonly ackSeq: number;
+}
+
+/** Whether a session's CURRENT status is a cue no reader has acknowledged; the
+ *  one predicate behind the raise and the attention count. The floor is the
+ *  higher of what the server confirmed and what this page has already sent, so
+ *  a read paints at once and a lagging record cannot relight it. */
+export function isUnread<T extends CueCandidate>(
+  tab: T,
+): tab is T & { readonly status: CueStatus } {
+  return isCueStatus(tab.status) && tab.statusSeq > Math.max(tab.seenSeq, tab.ackSeq);
 }
 
-/** The unseen cues over the tab list: a COUNT for the title and the badge, one
+/** The unread cues over the tab list: a COUNT for the title and the badge, one
  *  WORST for the icon. A count is set-valued and needs no rule for choosing among
  *  sessions; severity is a total order, so the icon's choice is not arbitrary.
  *  Neither names a session, the standing constraint on a page-wide surface. */
@@ -264,16 +266,12 @@ interface CueSummary {
   readonly worst: CueStatus | "";
 }
 
-/** Fold the tab list and this viewer's acknowledgements into the one summary
- *  every attention surface renders. */
-export function summarizeCues(
-  tabs: readonly CueCandidate[],
-  seen: ReadonlyMap<string, CueStatus>,
-): CueSummary {
+/** Fold the tab list into the one summary every attention surface renders. */
+export function summarizeCues(tabs: readonly CueCandidate[]): CueSummary {
   let count = 0;
   let worst: CueStatus | "" = "";
   for (const tab of tabs) {
-    if (!isUnseenCue(tab.status, tab.id, seen)) {
+    if (!isUnread(tab)) {
       continue;
     }
     count += 1;
@@ -282,52 +280,10 @@ export function summarizeCues(
   return { count, worst };
 }
 
-/** localStorage key for the cues this viewer has SEEN: session id -> the
- *  acknowledged status. Remembered because `input` and `done` are latched on the
- *  server and re-delivered in every snapshot, so a dismissed dot came back on
- *  every reload; client-side because "seen" is the VIEWER's, not the session's;
- *  per session because several background tabs can hold a latch at once. */
-export const CUE_SEEN_KEY = "wt-cue-seen";
-
-/** Bound on the acknowledgement map, so a corrupted or hostile stored value
- *  cannot make the restore path do unbounded work. */
-export const MAX_PERSISTED_CUE_SEEN = 200;
-
-/** Read stored acknowledgements into a clean map, dropping anything untrusted: a
- *  lost acknowledgement only re-lights a dot the user can dismiss again. */
-export function parseCueSeen(raw: string | null): Map<string, CueStatus> {
-  const out = new Map<string, CueStatus>();
-  if (raw === null) {
-    return out;
-  }
-  let data: unknown;
-  try {
-    data = JSON.parse(raw);
-  } catch {
-    return out;
-  }
-  // Arrays and null are typeof "object" too, and neither is a cue map.
-  if (typeof data !== "object" || data === null || Array.isArray(data)) {
-    return out;
-  }
-  for (const [id, status] of Object.entries(data)) {
-    if (id === "" || typeof status !== "string" || !isCueStatus(status)) {
-      continue;
-    }
-    out.set(id, status);
-    if (out.size >= MAX_PERSISTED_CUE_SEEN) {
-      break;
-    }
-  }
-  return out;
-}
-
-/** serializeCueSeen encodes acknowledgements for storage. The caller keeps the
- *  live map within the cap (see markCueSeen), so this does not truncate: a silent
- *  truncation here would drop whichever entries the parser happened to read last,
- *  which is the opposite of what an eviction should discard. */
-export function serializeCueSeen(seen: ReadonlyMap<string, CueStatus>): string {
-  return JSON.stringify(Object.fromEntries(seen));
+/** A status-occurrence number off the wire: a non-negative safe integer, or null
+ *  for anything else, which leaves the tab's value unchanged. */
+export function normalizeSeq(raw: unknown): number | null {
+  return typeof raw === "number" && Number.isSafeInteger(raw) && raw >= 0 ? raw : null;
 }
 
 /** TabOrderKey is what the strip's order is decided by: the server's shared
@@ -424,10 +380,9 @@ export interface Tab {
   /** The chip's determinate progress bar (the 2px line on its bottom edge).
    *  Present on every chip, hidden until a percentage exists. */
   progressEl: HTMLElement;
-  /** The last OSC 9;4 percentage the server reported for this session, or
+  /** The last percentage the server reported for this session, or
    *  PROGRESS_ABSENT. Held raw: whether it is currently SHOWN is a render-time
-   *  question (renderedProgress), and the prefix it produces is never stored on
-   *  any title field. */
+   *  question (renderedProgress). */
   progress: number;
   /** The chip's secondary activity mark (the rounded-square ring beside the
    *  status dot). Present on every chip, and costing no layout until a state
@@ -447,9 +402,10 @@ export interface Tab {
    *  offset away, and it stopped meaning the same line once the session produced
    *  output while backgrounded. In memory only. */
   view: ViewMemory | null;
-  /** Sticky: true once this session emitted a genuine activity signal (OSC 9;4).
-   *  Its activity dot is shown only while true; a session that never reports
-   *  activity (a plain shell) keeps a clean, dot-less tab. Fed from the server's
+  /** Sticky: true once this session emitted a genuine activity signal (OSC 7501
+   *  status, OSC 9;4 progress or a classified OSC 9 notification). Its activity
+   *  dot is shown only while true; a session that never reports activity (a
+   *  plain shell) keeps a clean, dot-less tab. Fed from the server's
    *  reportsActivity via applyStatus. */
   reports: boolean;
   /** The user's pinned name (the server's `pinnedTitle` wire field). Outranks
@@ -457,6 +413,25 @@ export interface Tab {
    *  tab menu's "use the automatic name" action. Undefined or empty means the tab
    *  has no user-set name. */
   pinnedTitle?: string | undefined;
+  /** The server's number for the status this tab holds (0: none yet). */
+  statusSeq: number;
+  /** The server-confirmed seen floor. Only rises: a record carrying a lower one
+   *  is older, never a retraction. */
+  seenSeq: number;
+  /** This page's optimistic read floor: the occurrence its latest ack sent, 0
+   *  when none. A 204 clears it once seenSeq covers it, and a non-404 failure
+   *  only while it still holds the failed number; a 404 keeps it until the
+   *  vanished tab is removed. */
+  ackSeq: number;
+  /** The occurrence whose ack last failed with a non-404, 0 when none; the
+   *  automatic ack skips it so a failing server sees one PUT per occurrence. */
+  failedSeq: number;
+  /** The occurrence a banner this page posted for the session belongs to, 0
+   *  when none. */
+  bannerSeq: number;
+  /** The stream epoch at which a status-stream record last updated this tab, 0
+   *  when none: a list requested before it is older. */
+  streamAt: number;
   /** Monotonic per-tab rename counter. A rename or clear increments it and
    *  captures the value; the response is applied only if it is still current when
    *  it lands, so a slow failure cannot roll back a newer rename, a later clear,
@@ -518,6 +493,12 @@ interface SessionAPI {
   /** Replace the shared pane layout. Throws on non-2xx as `setOrder` does: a 409
    *  means a side names a session that is not live. */
   setLayout(layout: PaneLayout): Promise<void>;
+  /** Acknowledge `seq` for every reader. The server keeps the higher floor and
+   *  caps it at its own statusSeq, so a resolve confirms the floor reached `seq`
+   *  only for a `seq` this page received. Throws a SessionAPIError on non-2xx; a
+   *  404 means the session is gone. Sent with `keepalive`, so a read just before
+   *  the page goes away still lands. */
+  markSeen(id: string, seq: number): Promise<void>;
 }
 
 /** The server's pane-layout record: which session each pane shows, the handle's
@@ -584,8 +565,8 @@ const SESSION_API_TIMEOUT_MS = 15000;
 
 /** A non-2xx response from the session API, carrying what the server said. A
  *  host may TEMPORARILY refuse session creation (a 503 with `Retry-After` and a
- *  body message while it installs tools on first boot), and a caller that only
- *  saw an `Error` read that as a broken page. */
+ *  body message while it starts up), and a caller that only saw an `Error`
+ *  read that as a broken page. */
 export class SessionAPIError extends Error {
   /** HTTP status, so a caller can branch on 503 (retry) vs 429 vs 5xx. */
   readonly status: number;
@@ -754,6 +735,17 @@ export function createSessionAPI(apiBase: string, realm: SessionAPIRealm): Sessi
         throw await sessionError("set layout", r);
       }
     },
+    async markSeen(id: string, seq: number): Promise<void> {
+      const r = await request(`${apiBase}/${encodeURIComponent(id)}/seen`, {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ seq }),
+        keepalive: true,
+      });
+      if (!r.ok) {
+        throw await sessionError("mark seen", r);
+      }
+    },
   };
 }
 

package/src/features/tabs/strip.ts

@@ -14,7 +14,6 @@ import { activityPhrase, normalizeActivity, statusPhrase, statusRevealsDot } fro
 // motion is spelled in — index.ts owns the mechanism, strip.ts owns the values,
 // the same split switcher.ts keeps for the mobile swipe.
 
-// Twin of marotte static-src/tabs-drag.ts's constants; change both or neither.
 /** How long (ms) the pointer must have been un-moved before a position report at an
  *  unchanged position (a `dragover`, or the pointer path's re-report on this tick) is
  *  believed as "stopped". Small, because such a report is positive evidence of rest;
@@ -149,14 +148,10 @@ const KB_SVG = `<svg viewBox="0 0 24 24" aria-hidden="true"><rect x="4" y="4" wi
 // background-tab notification dot rides on it (see switchButtonHTML). Same
 // viewBox + stroke=currentcolor treatment as the others.
 const SWITCH_SVG = `<svg viewBox="0 0 24 24" aria-hidden="true"><rect x="3" y="8" width="13" height="13" rx="2"/><path d="M8 8V6a2 2 0 0 1 2-2h9a2 2 0 0 1 2 2v9a2 2 0 0 1-2 2h-3"/></svg>`;
-// The state is the button's aria-expanded, not its icon. The viewBox equals the
-// 20px box 30-tabs.css draws it in, one unit per CSS px: that stylesheet's
-// per-DPR geometry is written in those units.
-const SPLIT_SVG =
-  `<svg class="wt-split-icon" viewBox="0 0 20 20" aria-hidden="true">` +
-  `<rect class="wt-split-icon-left" x="1" y="4" width="6" height="12" rx="1.5"/>` +
-  `<rect class="wt-split-icon-divider" x="9" y="2" width="2" height="16" rx="1"/>` +
-  `<rect class="wt-split-icon-right" x="13" y="4" width="6" height="12" rx="1.5"/></svg>`;
+// The keyboard glyph's rounded square split down the middle, so the two buttons
+// beside each other read as one size and weight. The state is the button's
+// aria-expanded, not its icon.
+const SPLIT_SVG = `<svg viewBox="0 0 24 24" aria-hidden="true"><rect x="4" y="4" width="16" height="16" rx="3.5"/><path d="M12 4v16"/></svg>`;
 
 /** The ONE builder for a tab chip's content (status dot, label, progress bar,
  *  close), shared by the strip chip, the mobile active row and each mobile list
@@ -240,7 +235,7 @@ export function paintStatusDot(el: HTMLElement, status: string, reports: boolean
  *  a tooltip worded by activityPhrase. No state REMOVES the attribute, which is
  *  what collapses the mark's footprint to zero. The reveal is the mark's OWN
  *  state, not the status dot's reportsActivity gate: a background run is a fact
- *  independent of whether the program ever spoke OSC 9. */
+ *  independent of whether the program ever reported status. */
 export function paintActivityMark(el: HTMLElement, state: string, count: number): void {
   const phrase = activityPhrase(state, count);
   if (phrase === "") {

package/src/kernel/attention.ts

@@ -40,17 +40,18 @@ export function iconVariantHref(href: string, variant: string): string | null {
   return `${href.slice(0, at)}-${variant}${href.slice(at)}`;
 }
 
-/** Render reports onto `sinks`, change-gated on the last rendered value: the
- *  title doubles as the browser-tab label and the bookmark name, and
- *  re-assigning an icon href makes some browsers re-fetch it. `pagehide` restores
- *  the surfaces (a browser remembers ONE icon per URL for the bookmark and the
- *  history row, so a tab closed on a lit cue would leave a status variant standing
- *  in for the app), `pageshow` repaints the last report for a page that came back
- *  from the back-forward cache, and `freeze` changes nothing because a frozen tab
- *  is still in the strip rendering its icon. */
+/** Render reports onto `sinks`. The title and icon are change-gated: the title is
+ *  also the tab label and bookmark name, and re-assigning an icon href makes some
+ *  browsers re-fetch it. The badge is OS state a platform may drop a write to
+ *  without rejecting, so it is also re-asserted on `resync`, a return to visible,
+ *  window focus and `pageshow`. `pagehide` restores the title and icon (a browser
+ *  remembers ONE icon per URL) but leaves the badge, which means "unread" for the
+ *  whole app rather than for this page. */
 export function createAttention(sinks: AttentionSinks, win: Window): AttentionSurface {
-  let reported: AttentionState = NO_ATTENTION;
+  let reported: AttentionState | null = null;
   let rendered: AttentionState | null = null;
+  let badged: number | null = null;
+  let pendingResync: number | null = null;
 
   function render(next: AttentionState): void {
     const countChanged = next.count !== rendered?.count;
@@ -58,24 +59,58 @@ export function createAttention(sinks: AttentionSinks, win: Window): AttentionSu
     rendered = next;
     if (countChanged) {
       sinks.setTitleMark(titleMarkFor(next.count));
-      sinks.setBadge?.(next.count);
     }
     if (iconChanged) {
       sinks.setIcon?.(next.icon);
     }
   }
+  function cancelResync(): void {
+    if (pendingResync !== null) {
+      win.clearTimeout(pendingResync);
+      pendingResync = null;
+    }
+  }
+  function writeBadge(count: number): void {
+    cancelResync();
+    badged = count;
+    sinks.setBadge?.(count);
+  }
+  const listeners = new AbortController();
+  const { signal } = listeners;
+  // Deferred a task so this surface's listener and the caller's report on one
+  // event write once. Before the first report, a write would wipe the badge
+  // another page or a previous run set; after dispose, it would raise a cleared one.
+  function resync(): void {
+    if (reported === null || signal.aborted || pendingResync !== null) {
+      return;
+    }
+    pendingResync = win.setTimeout(() => {
+      pendingResync = null;
+      if (reported !== null && !signal.aborted) {
+        writeBadge(reported.count);
+      }
+    }, 0);
+  }
 
   function onPageGone(): void {
     render(NO_ATTENTION);
   }
   function onPageBack(): void {
-    render(reported);
+    if (reported !== null) {
+      render(reported);
+    }
+    resync();
+  }
+  function onVisibility(): void {
+    if (win.document.visibilityState !== "hidden") {
+      resync();
+    }
   }
-  const listeners = new AbortController();
-  const { signal } = listeners;
   try {
     win.addEventListener("pagehide", onPageGone, { signal });
     win.addEventListener("pageshow", onPageBack, { signal });
+    win.addEventListener("focus", resync, { signal });
+    win.document.addEventListener("visibilitychange", onVisibility, { signal });
   } catch (err) {
     listeners.abort();
     throw err;
@@ -85,10 +120,15 @@ export function createAttention(sinks: AttentionSinks, win: Window): AttentionSu
     report(state) {
       reported = state;
       render(state);
+      if (state.count !== badged) {
+        writeBadge(state.count);
+      }
     },
+    resync,
     dispose() {
       listeners.abort();
       render(NO_ATTENTION);
+      writeBadge(0);
     },
   };
 }

package/src/kernel/notify.ts

@@ -38,24 +38,41 @@ export function shouldNotify(sessionIsActive: boolean, pageVisible: boolean): bo
   return !(sessionIsActive && pageVisible);
 }
 
-/** Bound on the per-session dedupe map: each key is a live session server-side,
- *  so a real page is nowhere near this and a hostile stream cannot grow it. */
+/** Bound on each per-session map: each key is a live session server-side, so a
+ *  real page is nowhere near this and a hostile stream cannot grow it. */
 const MAX_TRACKED_SESSIONS = 200;
 
 export function createNotifier(env: NotifierEnv): Notifier {
   // Highest sequence delivered per session. The engine never replays a
   // notification; this makes a doubled frame unable to notify twice for one event.
   const lastSeq = new Map<string, number>();
+  // The banner on screen per session. A page notification is invisible to
+  // ServiceWorkerRegistration.getNotifications(), so only this reference can
+  // close it once its session is read.
+  const shown = new Map<string, NotificationLike>();
   let armed = false;
   let requested = false;
 
-  function evict(): void {
-    while (lastSeq.size > MAX_TRACKED_SESSIONS) {
-      const oldest = lastSeq.keys().next().value;
+  // `drop` must remove the key, or this never ends.
+  function evict(map: Map<string, unknown>, drop: (id: string) => void): void {
+    while (map.size > MAX_TRACKED_SESSIONS) {
+      const oldest = map.keys().next().value;
       if (oldest === undefined) {
         return;
       }
-      lastSeq.delete(oldest);
+      drop(oldest);
+    }
+  }
+  function retract(id: string): void {
+    const posted = shown.get(id);
+    if (posted === undefined) {
+      return;
+    }
+    shown.delete(id);
+    try {
+      posted.close();
+    } catch {
+      /* a banner the platform already took down */
     }
   }
 
@@ -71,7 +88,7 @@ export function createNotifier(env: NotifierEnv): Notifier {
           return false;
         }
         lastSeq.set(ev.id, seq);
-        evict();
+        evict(lastSeq, (id) => lastSeq.delete(id));
       }
       if (!shouldNotify(view.sessionIsActive, env.pageVisible())) {
         return false;
@@ -90,7 +107,16 @@ export function createNotifier(env: NotifierEnv): Notifier {
         posted.onclick = (): void => {
           view.activate();
           posted.close();
+          if (shown.get(ev.id) === posted) {
+            shown.delete(ev.id);
+          }
         };
+        // Re-inserted so map order is banner age, and the banner evicted is
+        // closed: a dropped reference would leave it (and Android's launcher
+        // dot) up with nothing able to retract it.
+        shown.delete(ev.id);
+        shown.set(ev.id, posted);
+        evict(shown, retract);
         return true;
       } catch {
         // Safari throws on `new Notification` outside an installed PWA.
@@ -117,8 +143,10 @@ export function createNotifier(env: NotifierEnv): Notifier {
         /* a browser that refuses to be asked is a tab-only browser */
       }
     },
+    retract,
     forget(id): void {
       lastSeq.delete(id);
+      retract(id);
     },
   };
 }

package/src/kernel/pane.ts

@@ -77,6 +77,18 @@ function typedChar(ev: KeyboardEvent): string | null {
   return first !== undefined && String.fromCodePoint(first) === ev.key ? ev.key : null;
 }
 
+/** Ctrl+C (Shift allowed) or Ctrl+Insert: the chords that copy a selection. A
+ *  non-Latin layout's C is its physical KeyC; a Latin layout's is `key`. */
+function isCopyChord(ev: KeyboardEvent): boolean {
+  if (!ev.ctrlKey || ev.altKey || ev.metaKey) {
+    return false;
+  }
+  if (ev.key === "Insert" || ev.key === "c" || ev.key === "C") {
+    return true;
+  }
+  return ev.code === "KeyC" && !/^[a-z]$/i.test(ev.key);
+}
+
 /** iOS sends U+00A0 where a space was typed; shared by every send path so one
  *  physical key cannot produce two byte sequences. */
 function normalizeTypedText(text: string): string {
@@ -986,8 +998,9 @@ function buildPaneInto(
       if (!ownsSelection() && !keysUnclaimed()) {
         return;
       }
-      // Features while the selection is STILL INTACT and before the modifier
-      // gate: clipboard's Ctrl+Shift+C is a modified key that reads the selection.
+      // Features while the selection is STILL INTACT and before the key is
+      // encoded: clipboard's Ctrl+Shift+C reads the selection, and its claim on
+      // Ctrl+V keeps 0x16 off the wire.
       if (runKeydownChain(ev)) {
         return;
       }
@@ -995,7 +1008,7 @@ function buildPaneInto(
       // beforeinput or input, `_tryToHandlePressesEvent:` in
       // https://github.com/WebKit/WebKit/blob/main/Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm),
       // so a dead key or an IME takes focus and passes through, ahead of the
-      // modifier gate that would keep Option+e.
+      // decision below, which drops a key that types nothing.
       if (
         ev.key === "Dead" ||
         ev.key === "Process" ||
@@ -1010,21 +1023,25 @@ function buildPaneInto(
         return;
       }
       // Decided before taking focus, because a bare modifier press (Shift on its
-      // way to Shift+click) must leave the selection alone. Computed only for an
-      // "ignore", so the encoder always wins a key it maps.
+      // way to Shift+click) must leave the selection alone. Modifiers alone never
+      // reject a key the encoder maps, as on the focused path.
       const result = mapKeyboardEvent(ev, engine.modes);
       const char = result.kind === "ignore" ? typedChar(ev) : null;
-      if (result.kind === "ignore" && char === null) {
-        return;
-      }
-      // Modified keys stay with the browser except an AltGr CHARACTER, the way
-      // some layouts type it; AltGraph alone is not a reliable signal (Firefox
-      // reports it for plain Option on macOS), and Alt+ArrowLeft is browser back.
-      const altGraphChar = char !== null && ev.getModifierState("AltGraph");
-      if ((ev.ctrlKey || ev.metaKey || ev.altKey) && !altGraphChar) {
-        return;
+      if (result.kind === "ignore") {
+        if (char === null) {
+          return;
+        }
+        // An unencoded character with Ctrl, Alt or Cmd is the browser's (Cmd+V,
+        // Ctrl+1). A desktop AltGr character needs no exception: it arrives with
+        // neither modifier (the engine's encodeKittyDisambiguate cites why), and
+        // Firefox sets AltGraph on every macOS Option chord.
+        if (ev.ctrlKey || ev.metaKey || ev.altKey) {
+          return;
+        }
       }
-      if (ev.key === "Tab") {
+      // Tab leaves the page (no keyboard trap); a copy chord over this
+      // terminal's selection is the browser's copy, not a key for the shell.
+      if (ev.key === "Tab" || (ownsSelection() && isCopyChord(ev))) {
         return;
       }
       doc.getSelection()?.removeAllRanges();

package/src/kernel/shell.ts

@@ -438,7 +438,7 @@ function createShellInto(
   function attention(options: AttentionOptions): AttentionReporter {
     // A setup still running past destroy() gets a reporter that writes nothing.
     if (destroyed) {
-      return { report: () => undefined };
+      return { report: () => undefined, resync: () => undefined };
     }
     const surface = createAttention(
       browserAttentionSinks(