Glance: the phone's glance page runs its cards' taps and in-card chat by ymote · Pull Request #292 · OctoSense-org/OctoSense

ymote · 2026-10-02T17:41:32Z

Follow-up to #278 ("The phone's glance page", in its follow-ups). The phone's glance page drew L0 cards with their chips and fields, but ran none of their taps, so a card's buttons and its in-card chat (sys.chat) did nothing on a phone.

What was wrong

Since #278 the desktop's card window and glance panel keep their L0 cards in a LiveCards (glance_card.rs). A tile's taps, taken only from its own isolate, run through its card's L0Session for the app that published the card. The phone's glance page (mobile_pages.rs) handed its tiles every event but kept no LiveCards, so nothing ever took or ran their NAV calls. Its feed also held a copy of each published card without the L0 source, so it had nothing to start a session from.

The fix

One tap path for all three surfaces. The page keeps its cards in a GlanceCards (mobile_pages.rs): the tiles plus a LiveCards. A card is lowered, dispatched and re-lowered exactly as in the panel, its in-card chat included (glance_chat::perform, octosense-l0-chat). The feed now holds the published GlanceCard itself, L0 source included, instead of the GlanceCardItem copy.
The shell decides what a tap is (GlanceFinger). On the glance page a finger can also be a page swipe, a pull, a long press or a press on the shell's own controls. A card's tap target (OctoscriptTap) still fires on any release within 12 pt of its press. So a card's clicks (its NAV calls without text) count only for the lift of a plain tap on that card. That means no swipe or pull taken by the recognizer, under 12 pt of travel, not on the card's open button, the indicator or the dock, and not a finger a long press took. This is the rule the shell's own hits follow. Clicks from any other finger are dropped and logged (glance page: <card>: N tap(s) dropped (not a tap)).
- A tap target makes its NAV call at the end of the event's cycle (makepad runs widget→script calls after the handlers). A click is therefore queued after the pointer event that caused it. It is judged on a later event, against the last pointer event's verdict.
- A field's edits and its Return carry the person's text, so they always run.
- A tile is tappable only where the page shows it: clipped at its 440 pt cap, and above the page indicator and the dock (tappable). A click on a chip that is clipped away, or that sits under the dock, is dropped.
Page swipes and the page's own scrolling are unchanged. The cards still get every event before the shell's gesture handling, and nothing is consumed.
lib.rs reads the finger before the shell handles the event and hands it to the page's cards. The page logs where its tiles landed, once per change and at rest (glance page: N card(s) <card>@x,y,w,h), for a remote run.
Docs: glance_card.rs (the phone dispatches now). desktop/README.md and README.zh-CN.md: the demo cards also work on a phone style's glance page.

Security properties kept (`crates/l0-chat/README.md`, the README's "Cards and questions")

The publisher's own policy. Tiles are seated under the app's resolved policy as before (GlanceTiles::seat).
Only the publisher's own agent. The session's app is the card's app, the caller recorded at publish. The sys.chat write still goes through octosense_l0_chat::perform's publisher check.
Only what the person typed counts as theirs. Unchanged (event_payload_origin must be UserInput).
No tile can drive another. A tile's taps still come only from its own isolate (LiveCards). On the phone, a click also needs a plain tap on that very card.

Tests

On the Linux build host, at this PR's head (ec48e162, on main at 86241126), with its own target dir and CARGO_BUILD_JOBS=12:

Check	Result
from `phone/`: `cargo test --locked --features mobile-apps -p octosense-shell glance`	43 passed
from `phone/`: `... -p octosense-shell mobile`	108 passed
from `phone/`: `... -p octosense-shell phone`	5 passed
from `phone/`: `OCTOS_SHELL_TEST_KERNEL=<octos ae230ce0> cargo test --locked --features mobile-apps -p octosense-shell`	787 passed
from `phone/`: `OCTOS_SCENARIO_TEST_KERNEL=<octos ae230ce0> ... --lib host_tools::scenario_tests -- --test-threads=1`	5 passed
`cargo test --locked -p octosense-l0-chat`; `cargo clippy --locked -p octosense-l0-chat --all-targets --no-deps -- -D warnings`	9 passed; clean
`cargo check --locked -p octosense` (and `--features mobile-apps`); from `phone/`: `cargo check --locked -p octosense-home --features mobile-apps`; `python3 tools/setup.py --check --cargo`	pass

tools/ci-local.sh was not run.

New tests:

mobile_pages::tests::the_glance_pages_cards_run_their_taps_for_a_plain_tap_only
mobile_pages::tests::only_a_plain_taps_lift_is_a_tap_for_a_card
mobile_pages::tests::a_tile_is_tappable_only_where_the_column_shows_it
mobile_pages::tests::the_feed_keeps_a_cards_l0_source_for_its_tile

Instrument check (headless, phone layout)

The release desktop shell ran its Android phone style (--test-action phone:android --test-action page:-1) on the Linux host, under a headless weston (--backend=headless --renderer=pixman). It was driven through makepad's remote instrument with OCTOSENSE_GLANCE_DEMO=mail: two fake Mail cards, no mail read and no model called. Frames come from MAKEPAD_WRITE_FRAMEBUFFER_PNG, because /g does not answer on Linux GL. Chips were found by colour inside the tile rects that the page logs.

#	Scenario	Result
B1	`main` (`86241126`): a plain tap on Reply does nothing on the glance page	PASS (no tap)
P1	The demo cards on the glance page, drawn through the live L0 path	PASS
P2	A plain tap on Reply opens the draft on the page (`glance page: os.mail/ana-contract tap reply (applied true, relower true)`); Cancel goes back	PASS
P3	An 11 pt drag that starts on Reply: the recognizer takes it for a page swipe and cancels it. Reply's tap target fires, and the shell drops the click (`1 tap(s) dropped (not a tap)`)	PASS
P4	A page swipe that starts on Reply turns to page 0 and runs no tap; a swipe right comes back	PASS
P5	An upward drag that starts on a card is the home's pull to the App Library: it opens it and queues no tap; a swipe right goes back	PASS
P6	The wheel scrolls the page and runs no tap. Track comes up from under the dock, where it was not tappable, and a plain tap on it runs; Back returns	PASS
P7	Ask opens the in-card chat on the page. A typed question (`tap typing`, not re-lowered) is sent with Return (`tap submit`, `chat convo recorded`), and the canned reply shows. The thread is `apps/os.mail/accounts/device/chat/ana-contract.json` (this home has no Mail account)	PASS
P8	A card's open button is the shell's: it opens Mail and runs no card tap	PASS
T1	The touch path: a synthetic finger on Reply (`--test-action taps:`, TouchUpdate Start then Stop) opens the draft	PASS

Not covered

Unverified on a device. Nothing was installed on a phone. The touch path ran through the shell's synthetic finger (--test-action taps:), not a real touchscreen. How a card's field gets the soft keyboard on Android, and whether the keyboard covers a field low on the page, was not checked (unverified).
Script cards. A script card's own widgets (a makepad Button) handle the pointer themselves, as before. The shell's tap rule covers L0 cards' clicks, which are the cards with buttons and chat today.
The page scrolls with the wheel only (PhonePointerPhase::Scroll), on main and here. An upward drag on it is the home's pull to the App Library (P5).
A chat card meets the tile's cap here too. After an exchange, the request card reaches the 440 pt cap and its field is cut at the tile's edge (P7's last frame). The desktop panel's half of this is the follow-up for a tall chat card, which waits for Glance and notifications UX: undo, keyboard, motion, cards that follow the mode #290.

🤖 Generated with Claude Code

The supervisor saw the kernel end (its stdout closing, or its exit status) and read the stderr tail at once, but stderr is copied into the tail by a task of its own. The line the kernel wrote just before it exited could still be in the pipe, so the reason lost it: CI's `a_kernel_that_dies_closes_its_connections_with_its_last_words` failed with "the kernel closed its output: fake kernel up", without the "asked to exit" the fake kernel wrote last. The tail is now read after the kernel is stopped and the stderr task has reached the end of the pipe (bounded at 2 s, for a process the kernel started that still holds the pipe). Failed reasons get the same complete tail. The test asks for the last words themselves, not just "exit". Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

… probes The glance tile tests register probe system apps (os.glancetile, os.glanceinput, os.glancequiet, os.glancesweep) in App Hub's system-app registry. That registry is process-wide, has no removal, and is the one `system_card_apps` lists, so a catalog test running after a glance test in the same process saw the probes as launcher rows: `bundled_apps_open_without_catalog_files_or_child_processes` failed its catalog comparison 7 of 10 times beside `glance_card::` on main, and `the_system_apps_ship_as_card_apps` compares the same list. Tests now register their system apps through `apps::test_system_apps::register`, which notes the id before it registers it, and the tests of the build's own catalog leave noted ids out. Production code is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

`approvals::tests::the_relay_gets_decisions_made_before_it_was_installed` began with `init_memory()`, which replaces the shell's process-wide approvals with empty ones. Every consent a test running beside it had given was gone. `app_chat::tests::the_panel_opens_a_sharing_context_and_sends_person_turns_there` allows its app, then reads `agents::line()`, which reports a peer slug only while the app is allowed. Beside `approvals::` it failed 50 of 50 runs with `peer_slug: null`. The same test also installed its recording relay into the shared approvals, where it would take other tests' decisions. The relay seam (`approval_requested`, `set_relay`, `bus_requested`) is now methods on `Approvals`. The free functions call them on the shell's approvals, as before. The test builds `Approvals::memory()` and never touches the shared one. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…the whole connect's `a_jail_only_app_reads_its_jail_and_is_refused_everything_else` failed on GitHub's macOS 14 runners with "the hub is reachable: " and nothing after it: the sandboxed `nc -z` exited 1 without a word, because nc prints why a connect failed only with `-v`. Its exit status says only that the connect did not complete. A sandbox refusal and a refusal past the sandbox (no listener on the port then, the network stack) look the same, though only the first is what this test is about. Closing the hub's listener before the probe reproduces the CI message exactly. The probe now runs `nc -v -n` and the test reads what nc says. The hub fails only on the sandbox's own refusal (EPERM from Seatbelt and seccomp, EACCES from Landlock), or when nc never reported a connect at all. A refusal past the sandbox is printed and passes. Any other port must now be refused by the sandbox itself, not just fail, which the old check could not tell apart. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

octos#2675 makes session/hydrate rows name their tool calls: a tool row carries tool_call_id and tool_name, an assistant row its tool_calls. The shell's system chat and "Ask <app>" panel already read tool_call_id and name/tool_name, and the broker's merged history passes rows through, so reloaded tool rows now show their tool's name instead of "tool". The two-lane scenario checks it against the real kernel: News's agent's news_share call in the panel's reloaded history, and the system chat's peer_send_input. The pin also brings #2261, #2664, #2665, #2669, #2671 and #2672. octos-core, octos-cli, octos-research and the kernel artifact move together; Cargo.lock changes only the 17 octos source lines. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…w behind it A module tile claimed presses but never a hover. A mouse move over a part of a card window that takes no hover (Mail's empty page) went on to the tile behind unclaimed, and the app there took it: a News button under Mail lit up and showed its hand cursor. A tile behind also handed its app every move, claimed or not, as it handed presses before #277. The live tile now treats a hover (a mouse move with no button held) the way #277 treats a press. A hover inside it that none of its app's widgets took is the tile's, and one a window in front already took is let by, so its app never sees it. The one exception is the move that leaves a widget of the app still holding the hover: it reaches the root, so that widget sees its hover end, and being claimed it lets no other hover start. The closed face of a stopped app claims a hover inside it too. Moves with a button held (drags) pass as before, so captures keep working. Tests, in module_input_tests.rs: a hover on the window in front never reaches the app behind; makepad's Button behind it never lights up or shows its hand; a hover on a stopped face never reaches the app behind it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…ot at its top left The closed face draws its line and Restart button centred, but it kept the rect `walk_turtle` returned for the button as Restart's hit rect. The face's turtle centres its content when it ends, which moves the drawn button after it was walked, so the kept rect stayed at the face's top left. A press on the visible button only raised the window, and a press at the top left, where nothing is drawn, restarted the app. The face now hit-tests Restart by the button's drawn area, as any widget is hit-tested: clipped, at the time of the press. It keeps no rect of its own. Tests, in module_input_tests.rs: Restart responds where it is drawn (a click and a tap on the visible button restart the app, a press at the top left only raises the window), and #277's stopped-face test now presses the drawn Restart. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…e card window Since #290 a press on a card in the glance panel that the card's own controls do not claim opens the card in the card window on its release (pointer_claimed_area across the tiles' dispatch). A field claims its press, but a chip does not: an L0 card's tap targets are OctoscriptTap, which never calls event.hits (so a list can still scroll under it) and fires on the release. So every press on Reply, Ask, Track or Send opened the card window and closed the panel, and the chip's tap ran in the panel's session as the panel forgot it: the card's buttons and its in-card chat could not be used in the panel. - glance_panel.rs: a press released on its card opens the card window a frame later, unless the card clicked by then. A tap target calls its card once the release's handlers have run, and the click is seen before the card's taps run, on any event after the release's. - glance_card.rs: has_clicks, whether an isolate has a click waiting (a NAV call with no text; a field's carries what was typed). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

… view After its first exchange a card's in-card chat (sys.chat) grew past the glance panel's 440 pt tile (glance_card TILE_MAX_HEIGHT), and the tile clipped the card's bottom: its field, its send arrow and Back were cut off, so the person could not type the next question in the panel. - glance_card.rs: GlanceTiles::draw_scrolled draws a card scrolled up inside its tile, through the tile frame's own layout scroll (no scroll view: its bars would claim every press, and an unclaimed press on a card is what opens the card window). overflow() says how much taller than its tile a card is. The card window's tiles scroll by themselves and ignore it. - glance_panel.rs: TileScroll. A card taller than its tile scrolls inside it, with a thumb at its edge. A card that reads a sys.chat sits at its newest rows and follows them as the conversation grows, so the field and the latest exchange stay in view. Any other card starts at its top, and one that peeks in at the list's end shows its top. The wheel over a tall card scrolls it first and moves the list only at its ends; scrolled back to the bottom, a chat follows its newest rows again. The panel logs where its tall cards sit, once per change. - README (en, zh-CN): the desktop panel row says so. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The phone's glance page drew L0 cards with their chips and fields but ran none of their taps: only the desktop's card window and glance panel kept their cards live (glance_card.rs LiveCards, #278). A card's buttons and its in-card chat (sys.chat) did nothing on a phone. - mobile_pages.rs: GlanceCards, the page's tiles with a LiveCards. A tile's taps, from its own isolate only, run through its card's session, made for the app that published the card, as on the desktop. The feed holds the published GlanceCard itself (its L0 source included) instead of a GlanceCardItem copy without it. - The shell decides what a tap is (GlanceFinger). A card's clicks (NAV calls without text) count only for the lift of a plain tap on that card: no swipe or pull the recognizer took, under 12 pt of travel, not on the shell's own controls, not a finger a long press took. That is the rule the shell's own hits follow. A tap target calls NAV at the end of the event's cycle, so a click is judged on a later event by the last pointer event. Field edits carry the person's text and always run. A tile is tappable only where the page shows it (its cap, above the page indicator and the dock). Page swipes and the page's scroll are unchanged and click no card. - lib.rs: the page's cards get every event as before, plus the finger, read before the shell handles the event. - glance_card.rs: drop_clicks; docs (the phone dispatches now). - desktop README (en, zh-CN): the demo cards work on a phone style's glance page too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ymote · 2026-10-02T22:04:34Z

Merged in a merge train; local CI (Mac with rom toolchain + --linux-host) passed on the train head 72e5d55, which contains this PR.

tools/ci-local.sh --only all --linux-host, started 2026-10-02T14:00:45: passed. Desktop, phone and apps passed on the Mac; apps services, kernel-security and linux-host / sandbox passed on the Linux build host. Its rom.yml steps were skipped on the Linux host, and the train doesn't trigger rom.yml.
tools/ci-local.sh --only all on the Mac with the rom toolchain (JDK 17, Android SDK, node 24), started 2026-10-02T14:51:21: 42/42 steps passed, none skipped.

The train was #291, #293, #297, #294, #298, #295, #296, #299, #300 and #292, on main f6678b5. After the last merge, main 301be0c has the tested head's tree.

This was referenced Oct 2, 2026

Glance: a press on a card's chip in the panel no longer opens the card window #299

Merged

Glance: a tall chat card scrolls in its panel tile, its field in view #300

Merged

ymote and others added 10 commits October 2, 2026 13:57

ymote force-pushed the fix/phone-glance-taps branch from ec48e16 to 72e5d55 Compare October 2, 2026 20:59

ymote merged commit 301be0c into main Oct 2, 2026
4 of 5 checks passed

Navigation Menu

Repository navigation

Glance: the phone's glance page runs its cards' taps and in-card chat - #292

Glance: the phone's glance page runs its cards' taps and in-card chat#292
ymote merged 10 commits into
mainfrom
fix/phone-glance-taps

ymote commented Oct 2, 2026

Uh oh!

Uh oh!

ymote commented Oct 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

ymote commented Oct 2, 2026

What was wrong

The fix

Security properties kept (crates/l0-chat/README.md, the README's "Cards and questions")

Tests

Instrument check (headless, phone layout)

Not covered

Uh oh!

Uh oh!

ymote commented Oct 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Security properties kept (`crates/l0-chat/README.md`, the README's "Cards and questions")