feat(seam): typed read per data-bearing screen, 5 to 35 methods, all mock

.gitignore

@@ -105,3 +105,6 @@ docs/nodedb_lab_studio_mockup_v4.html
 specs/*
 docs/*
 .DS_Store
+
+# Subagent-driven-development scratch (ledger, briefs, review packages)
+.superpowers/

nodedb-studio/assets/styles.css

@@ -394,6 +394,19 @@
   /* ============================================================
      Modal overlay
      ============================================================ */
+  /* Connect failures overlay everything, the modal scrim (z-index 150)
+     included: a failed "Save & connect" must be readable without closing the
+     form that caused it. Fixed, because html/body are 100vh with overflow
+     hidden, so a banner in normal flow pushes the shell off-screen. */
+  .connect-error-bar {
+    position: fixed;
+    top: 0; left: 0; right: 0;
+    z-index: 200;
+    background: var(--bg-secondary);
+    border-bottom: 0.5px solid var(--border-mid);
+  }
+  .connect-error-bar .async-error { padding: 12px 20px; }
+
   .modal-overlay {
     position: fixed; inset: 0;
     background: rgba(0,0,0,0.4);
@@ -441,6 +454,11 @@
     font-size: 13px;
   }
   .form-field input:focus, .form-field select:focus { border-color: var(--accent); }
+  .field-error {
+    margin-top: 5px;
+    font-size: 11px;
+    color: var(--text-danger);
+  }
   .form-row { display: grid; grid-template-columns: 1fr 1fr; gap: 12px; }
 
   /* ============================================================

nodedb-studio/src/app.rs

@@ -1,6 +1,7 @@
 //! Root component: provides global state and the top-level state machine.
 //!
-//! Two states, handled by a root conditional (NOT routing — see CLAUDE.md §5):
+//! Two states, handled by a root conditional rather than by routing, because
+//! the Connection Manager is not a route: the Router mounts inside `Studio`.
 //!   - Disconnected -> `ConnectionManager` (full screen, no studio chrome)
 //!   - Connected    -> `Studio`
 //!
@@ -12,12 +13,13 @@ use std::rc::Rc;
 
 use dioxus::prelude::*;
 
+use crate::components::async_view::AsyncView;
 use crate::modals::ModalHost;
 use crate::models::notification::Notification;
 use crate::services::async_state::AsyncState;
 use crate::services::backend::Backend;
 use crate::services::connection_service::MockConnectionService;
-use crate::state::connection::ActiveConnection;
+use crate::state::connection::{ActiveConnection, ConnectError};
 use crate::state::connections_registry::SavedConnection;
 use crate::state::preferences::Preferences;
 use crate::state::ui::ModalKind;
@@ -47,6 +49,10 @@ pub fn App() -> Element {
     // Modal state is provided here (not in Studio) because Preferences is
     // reachable while disconnected and via Cmd+, in either state.
     use_context_provider(|| Signal::new(None::<ModalKind>));
+    // Connect failures are provided here, not inside the views that start them:
+    // the command palette and the switch popover both close on click, so an
+    // error they owned would be dropped before it could render.
+    let connect_error = use_context_provider(|| Signal::new(ConnectError(None)));
 
     // Seed the registry + notification feed asynchronously, at the seam. The
     // mock resolves instantly; the real client awaits the network. The guard
@@ -74,9 +80,25 @@ pub fn App() -> Element {
     use_context_provider(|| reload_feed);
 
     let active = use_context::<Signal<Option<ActiveConnection>>>();
+    // Rendered through the same component every failed read uses, so the markup
+    // and styling live in one place. It is fixed-position and above the modal
+    // scrim: `html, body` are `100vh; overflow: hidden`, so a banner in normal
+    // flow would push the statusbar off-screen, and a failed "Save & connect"
+    // has to be readable without closing the form that caused it.
+    // `retriable` is deliberately false: the way
+    // to retry a connect is the Connect button the user just pressed, which is
+    // still on screen, and a second affordance here would need the name and
+    // credentials of the attempt that failed. The message clears when the next
+    // attempt starts (see the call sites) or succeeds.
+    let connect_error_msg = connect_error.read().0.as_ref().map(|e| e.to_string());
 
     rsx! {
         document::Stylesheet { href: STYLES }
+        if let Some(msg) = connect_error_msg {
+            div { class: "connect-error-bar",
+                AsyncView { loading: false, empty: false, error: Some(msg) }
+            }
+        }
         if active.read().is_some() {
             Studio {}
         } else {

nodedb-studio/src/components/async_view.rs

@@ -1,4 +1,5 @@
-//! Shared loading/empty/error renderer for any seam-backed read.
+//! Shared loading/empty/error renderer for any seam-backed read, and the
+//! error/retry renderer for a seam-backed write.
 //!
 //! The caller maps its `use_resource` result to `AsyncState<T>` (plain Rust),
 //! renders the `Loaded(T)` case itself, and delegates the three non-loaded

nodedb-studio/src/components/command_palette.rs

@@ -3,19 +3,25 @@
 //! Rendered inside the router (via `StudioLayout`) so navigation items can use
 //! the navigator. Open state is the shared `Signal<bool>` provided by `Studio`.
 
+use dioxus::core::spawn_forever;
 use dioxus::prelude::*;
 
 use crate::routes::Route;
 use crate::services::backend::Backend;
-use crate::state::connection::ActiveConnection;
+use crate::state::connection::{ActiveConnection, ConnectError, apply_connect};
+use crate::state::connections_registry::{Credentials, SavedConnection};
 use crate::state::ui::ModalKind;
 
 #[component]
 pub fn CommandPalette() -> Element {
     let mut open = use_context::<Signal<bool>>();
     let mut active = use_context::<Signal<Option<ActiveConnection>>>();
+    // The palette closes on click, so a failure it owned would never render;
+    // the surface lives at the app root instead.
+    let mut connect_error = use_context::<Signal<ConnectError>>();
     let mut modal = use_context::<Signal<Option<ModalKind>>>();
     let service = use_context::<std::rc::Rc<dyn Backend>>();
+    let registry = use_context::<Signal<Vec<SavedConnection>>>();
     let nav = use_navigator();
 
     if !*open.read() {
@@ -26,6 +32,30 @@ pub fn CommandPalette() -> Element {
     // each switch handler clones it.
     let switch_svc = service.clone();
 
+    // A saved entry's stored profile IS its explicit username; the palette
+    // switches between entries that already have one, so there is no field to
+    // type into here. An entry with no profile yields a blank, which the seam
+    // rejects with MissingUsername and the app root renders — never a silent
+    // fallback to `admin`. The connections fixture carries the invariant
+    // that keeps connectable entries from reaching that state.
+    let creds_for = |name: &str| -> Credentials {
+        Credentials {
+            username: registry
+                // .read(), not .peek(): this runs at render time, not in an
+                // event handler. peek() would freeze the credentials at the
+                // render where the palette opened, so a registry that resolves
+                // later (a real backend awaiting the network) would leave every
+                // switch sending a blank username with no re-render to fix it.
+                .read()
+                .iter()
+                .find(|c| c.name == name)
+                .and_then(|c| c.profile.as_ref())
+                .map(|p| p.user.clone())
+                .unwrap_or_default(),
+            password: None,
+        }
+    };
+
     rsx! {
         div {
             class: "palette-overlay open",
@@ -66,10 +96,17 @@ pub fn CommandPalette() -> Element {
                     div { class: "palette-section", "Connections" }
                     div { class: "palette-item", onclick: {
                             let svc = switch_svc.clone();
+                            let creds = creds_for("staging-cluster");
                             move |_| {
                                 let svc = svc.clone();
-                                spawn(async move {
-                                    if let Ok(s) = svc.connect("staging-cluster").await { active.set(Some(s)); }
+                                let creds = creds.clone();
+                                connect_error.set(ConnectError(None));
+                                // spawn_forever: the palette closes on the next
+                                // line, and a scope-bound task would be dropped.
+                                spawn_forever(async move {
+                                    let result = svc.connect("staging-cluster", &creds).await;
+                                    let err = apply_connect(&mut active.write(), result);
+                                    connect_error.set(ConnectError(err));
                                 });
                                 open.set(false);
                             }
@@ -78,10 +115,17 @@ pub fn CommandPalette() -> Element {
                     }
                     div { class: "palette-item", onclick: {
                             let svc = switch_svc.clone();
+                            let creds = creds_for("prod-replica-eu");
                             move |_| {
                                 let svc = svc.clone();
-                                spawn(async move {
-                                    if let Ok(s) = svc.connect("prod-replica-eu").await { active.set(Some(s)); }
+                                let creds = creds.clone();
+                                connect_error.set(ConnectError(None));
+                                // spawn_forever: the palette closes on the next
+                                // line, and a scope-bound task would be dropped.
+                                spawn_forever(async move {
+                                    let result = svc.connect("prod-replica-eu", &creds).await;
+                                    let err = apply_connect(&mut active.write(), result);
+                                    connect_error.set(ConnectError(err));
                                 });
                                 open.set(false);
                             }

nodedb-studio/src/components/popovers/connection_popover.rs

@@ -3,11 +3,12 @@
 
 use std::rc::Rc;
 
+use dioxus::core::spawn_forever;
 use dioxus::prelude::*;
 
 use crate::services::backend::Backend;
-use crate::state::connection::ActiveConnection;
-use crate::state::connections_registry::{ConnStatus, SavedConnection};
+use crate::state::connection::{ActiveConnection, ConnectError, apply_connect};
+use crate::state::connections_registry::{ConnStatus, Credentials, SavedConnection};
 use crate::state::ui::{ModalKind, Popover};
 
 #[component]
@@ -17,6 +18,9 @@ pub fn ConnectionPopover() -> Element {
     let mut modal = use_context::<Signal<Option<ModalKind>>>();
     let registry = use_context::<Signal<Vec<SavedConnection>>>();
     let service = use_context::<Rc<dyn Backend>>();
+    // The popover closes on click (see `popover.set(None)` below), so a failure
+    // it owned would never render; the surface lives at the app root instead.
+    let mut connect_error = use_context::<Signal<ConnectError>>();
 
     let conn = active.read();
     let Some(c) = conn.as_ref() else {
@@ -50,6 +54,18 @@ pub fn ConnectionPopover() -> Element {
                     };
                     let svc = service.clone();
                     let item_class = if disabled { "cp-item disabled" } else { "cp-item" };
+                    // The stored profile IS this entry's explicit username; the
+                    // popover only switches between already-saved connections. A
+                    // profile-less entry yields a blank, which the seam rejects
+                    // with MissingUsername and the app root renders.
+                    let creds = Credentials {
+                        username: sc
+                            .profile
+                            .as_ref()
+                            .map(|p| p.user.clone())
+                            .unwrap_or_default(),
+                        password: None,
+                    };
                     rsx! {
                         div {
                             class: "{item_class}",
@@ -59,8 +75,18 @@ pub fn ConnectionPopover() -> Element {
                                     // set `active` (Copy) only after the await resolves.
                                     let svc = svc.clone();
                                     let name = name.clone();
-                                    spawn(async move {
-                                        if let Ok(s) = svc.connect(&name).await { active.set(Some(s)); }
+                                    let creds = creds.clone();
+                                    connect_error.set(ConnectError(None));
+                                    // spawn_forever, not spawn: this popover is
+                                    // conditionally mounted and closes on the next
+                                    // line, and Dioxus drops a scope's tasks when
+                                    // the scope goes away. A plain spawn dies at
+                                    // the await against any backend that actually
+                                    // yields, leaving no session and no error.
+                                    spawn_forever(async move {
+                                        let result = svc.connect(&name, &creds).await;
+                                        let err = apply_connect(&mut active.write(), result);
+                                        connect_error.set(ConnectError(err));
                                     });
                                     popover.set(None);
                                 }

nodedb-studio/src/components/popovers/notification_popover.rs

@@ -9,18 +9,24 @@
 //! list itself. Mark-all-read / per-item clicks MUTATE the store, so the badge
 //! and the list never diverge. The Error-state Retry reloads the feed via the
 //! shared `Resource` handle, gated on `StudioError::is_retriable()`.
+//!
+//! A failed mark-all-read is a WRITE failure and is kept out of the read store:
+//! the list the user was looking at is still correct, so it stays on screen and
+//! the failure renders beside it, with a retry that re-issues the write.
 
 use std::rc::Rc;
 
+use dioxus::core::spawn_forever;
 use dioxus::prelude::*;
 
 use crate::components::async_view::AsyncView;
 use crate::models::notification::{Notification, NotificationTarget};
 use crate::routes::Route;
 use crate::services::async_state::AsyncState;
 use crate::services::backend::Backend;
+use crate::services::error::StudioError;
 use crate::state::connection::{ActiveConnection, Capabilities};
-use crate::state::notifications::{mark_all_read, mark_read, visible};
+use crate::state::notifications::{apply_mark_all_read, mark_read, visible};
 use crate::state::ui::Popover;
 
 /// Where a notification navigates when clicked.
@@ -50,6 +56,32 @@ pub fn NotificationPopover() -> Element {
     let active = use_context::<Signal<Option<ActiveConnection>>>();
     let backend = use_context::<Rc<dyn Backend>>();
     let nav = use_navigator();
+    // Write failure for mark-all-read, separate from the read store.
+    let mut write_error: Signal<Option<StudioError>> = use_signal(|| None);
+    // Persist first; the local list changes only once the seam acknowledges
+    // the write (see apply_mark_all_read). The spawn keeps every signal guard
+    // out of the await. Built once so the header button and its Retry are the
+    // same operation, not two copies that can drift.
+    //
+    // spawn_forever, not spawn: this popover is conditionally mounted, and
+    // Dioxus drops a scope's tasks on unmount. Clicking away while the write
+    // is in flight would kill it at the await, leaving the server's state
+    // unknown and the shared store never reconciled. The store is app-level
+    // context, so the reconcile still lands; only `write_error` is scoped
+    // here, so a failure the user navigated away from is not shown. That is
+    // acceptable because the failure path leaves the list untouched, which is
+    // what reopening the popover shows.
+    let mark_all = {
+        let backend = backend.clone();
+        move || {
+            let backend = backend.clone();
+            spawn_forever(async move {
+                let result = backend.mark_all_read().await;
+                let err = apply_mark_all_read(&mut store.write(), result);
+                write_error.set(err);
+            });
+        }
+    };
 
     // Capability gate (unchanged): no connection -> render nothing.
     let caps: Capabilities = match active.read().as_ref() {
@@ -89,29 +121,29 @@ pub fn NotificationPopover() -> Element {
             div { class: "notif-header",
                 h4 { "Notifications " span { class: "count", "{count_label}" } }
                 button {
-                    onclick: move |_| {
-                        // In-memory update first for snappy UI (write guard dropped
-                        // before the block ends, never held across an await).
-                        if let Some(items) = store.write().loaded_mut() {
-                            mark_all_read(items);
-                        }
-                        // Persist through the seam so the badge stays cleared on
-                        // any subsequent reload (fixes POP-03). The spawn avoids
-                        // holding any signal guard across the await.
-                        // On success, reconcile the shared feed so the real client's
-                        // persisted state is reflected (reload.restart() re-fetches).
-                        let backend = backend.clone();
-                        let mut reload = reload;
-                        spawn(async move {
-                            match backend.mark_all_read().await {
-                                Ok(()) => reload.restart(),
-                                Err(e) => tracing::warn!("mark_all_read failed: {e}"),
-                            }
-                        });
+                    onclick: {
+                        let mark_all = mark_all.clone();
+                        move |_| mark_all()
                     },
                     "Mark all read"
                 }
             }
+            // A failed write renders through the same component as a failed
+            // read, so it is styled, tested, and gated on retriability exactly
+            // once. Its Retry re-issues the write, not the read.
+            if let Some(e) = write_error.read().as_ref() {
+                AsyncView {
+                    loading: false,
+                    empty: false,
+                    error: Some(format!("Could not mark all read: {e}")),
+                    retriable: e.is_retriable(),
+                    empty_message: String::new(),
+                    on_retry: {
+                        let mark_all = mark_all.clone();
+                        move |_| mark_all()
+                    },
+                }
+            }
             div { class: "notif-list",
                 // Loading / Empty / Error -> shared AsyncView, driven by AsyncState.
                 AsyncView {