Launchpad: Nová karta on /new-tab, the shell element <lazurio-new-tab> and the panel's strip of every tab (F47 step 3)

docs/decisions.md

@@ -7125,6 +7125,15 @@ workstation, keep their apps' own "+".
    Nová karta, and so does closing the last tab. Zavřít in its strip is the close for everyone
    (point 6), with the warning when an agent works in the tab. A message during the grace
    never takes Vrátit away (wireframe #27).
+
+   **Addendum 2026-10-12, decided by Matěj: the strip shows the tabs the Launchpad holds.**
+   The Launchpad's strip lists the tabs the Launchpad holds (`holders/launchpad.json`), as a
+   T3 Code thread's strip lists the thread's, and Přehled lists every tab. × lets go of the
+   Launchpad's hold, with Vrátit while the hub's grace lasts; the tab stays in the
+   Environment and in Přehled as long as anything still needs it. Closing a tab for everyone
+   is Přehled's Zavřít alone. A tab chosen in the panel's Nová karta is held for the
+   Launchpad, as a page opened there is. This changes 0195 point 9's strip of every tab and
+   point 11's "or in the Launchpad's strip", which the root register will record.
 10. **T3 Code** (plan DEV-6646 task 2026-10-11-501): "+" opens a tab with `<lazurio-new-tab>`
     instead of the upstream menu. A page or a chosen tab turns it into the thread's tab, a tool
     into T3 Code's own surface. Its server keeps the threads' browser tabs and writes their
@@ -7259,3 +7268,82 @@ shown in the Launchpad, mark the heap "≈" and never open another Environment's
 Code's holder files with their record times; and a check on a real Environment, where
 neither the heaps of tabs that share a renderer nor the cost of the overview every 5 s has
 been measured yet.
+
+**Step 3, implemented in this revision (2026-10-11).**
+- `src/launchpad/new-tab.html` and `new-tab-page.ts` are Nová karta, served on `/new-tab`
+  beside the Launchpad's page, locally and behind the gateway with the boot document.
+  Behind the gateway the page answers `Content-Security-Policy: frame-ancestors 'self'`
+  with the entry's own app origins (the Launchpad, T3 Code and MausBot as present) and
+  `X-Content-Type-Options: nosniff`; no other page changes its headers. What it decides
+  without a document is `new-tab-view.ts`: the overview read field by field, the address
+  bar, the memory and its tone, "when last used", who opened a tab, the order, the
+  warning, the toast, the Modules' names from the boot catalog and the suggestions.
+- The Czech copy of the page and the panel addresses the person formally (vykání), as the
+  brand rule of 2026-10-11 asks of the whole Launchpad; where the wireframe speaks
+  informally, the rule wins.
+- The address bar opens a link to a tab of this Environment's view as that tab. It never
+  opens an address of another Environment's view: it says so, as the wireframe does, with
+  a link that opens it in a tab of the person's own browser. An http(s) or host-like
+  address opens as a page and anything else is a search; a page becomes a remote tab only
+  then (`POST /api/new-tab/open` with the host's strip).
+- Přehled is read every 5 s while the page is visible, never while it is hidden:
+  - the Environment's memory with the Dashboard's thresholds (80 and 90 %);
+  - the tabs, heaviest first, with who opened them, whether an agent works in them,
+    "v tomto vlákně" for the host's thread and the heap marked "≈";
+  - the running Modules with Zastavit.
+
+  A value that cannot be read is left out, never shown as 0. When the hub or the Launchpad
+  does not answer, Přehled says which and reads again; where the Environment has no
+  browser, it says so and reads no more.
+- Zavřít asks first when an agent works in the tab (the wireframe's warning; keeping the
+  tab is the answer offered first). The tab leaves the list at once and stays gone until
+  the hub has accepted the close and an overview requested after that lists it as closing,
+  or comes back when the close fails. Vrátit lasts until the hub's deadline: the close
+  answers the time left (`left`, measured on the Environment's clock, which the deadline is
+  on), and the page counts it from its request, so a late answer never offers Vrátit past
+  the deadline. A later message shows above it and never takes it away.
+- `src/shell/new-tab-protocol.ts` is the protocol between the page and
+  `<lazurio-new-tab>` (`src/shell/new-tab-element.ts`, defined with the shell's other
+  elements). Interface v1 gains the element with its attributes `strip`, `tools`,
+  `focus-address` and `lang`, and the event `lazurio-new-tab`.
+  - The element frames `/new-tab` on the origin of the current Environment's `apps`. It
+    answers the page's `ready` with the strip, the tools, the language and the host
+    document's colour roles, again whenever they change, and dispatches what the tab
+    became. It hears only its own frame on that origin.
+  - The page hears only its parent on an origin of the Environment's apps and posts only
+    there. Neither navigates the other.
+- **Standalone** (Matěj 2026-10-11): Codex Desktop's browser opens `launchpad.<env>/new-tab`
+  on its own. A page that is not framed, or hears no host within 1.5 s, is Nová karta of
+  the Launchpad's strip with no tools; its address bar takes the focus, and a choice
+  navigates that window to the tab's view. A page opened there is the Launchpad's to hold
+  (`open` with the strip `launchpad`); choosing a tab that exists holds nothing.
+- The Launchpad's right panel (`browser-panel.ts`, `browser-panel-view.ts`) lists the tabs
+  the Launchpad holds (point 9's addendum of 2026-10-12), from the overview read every 5 s
+  while the panel is open, in the order the strip first had them; every other tab is in
+  Přehled. The overview reports the Launchpad's hold as its holder last wrote it, so the
+  strip never waits for the hub to read the file again.
+  - "+" shows Nová karta, `<lazurio-new-tab strip="launchpad" focus-address>`, and so do
+    the first opening and the strip once its last tab goes. A page opened in it, which the
+    Launchpad holds, shows in the panel; a tab chosen in its Přehled shows once
+    `POST /api/new-tab/hold` has held it.
+  - × lets go of the Launchpad's hold, without a warning, since it never closes a tab
+    something still needs. `POST /api/new-tab/release` takes the holder file's own path:
+    one operation at a time, the file read again first, nothing written over a file that
+    cannot be read, and a tab not held is released already. The tab stays gone until the
+    release is done and a later overview says so, or comes back when it fails. The toast
+    says whether the tab closes or stays because an agent works in it or another place
+    holds it, and Vrátit holds it again for 8 s from the request, within the hub's grace.
+  - A page's new tab that a view reports (`lazurio-browser:new-tab`), and the sign-in tab
+    an Integrace opens, show only once the Launchpad holds them. A hold that failed says
+    why, with Zkusit znovu where trying again can help; for a sign-in, Integrace says that
+    the browser cannot open it now. A Launchpad without a holder (no usable runtime
+    directory) fails the sign-in closed, as `open` answers 503 then
+    (`launchpadHoldOf`). `lazurio-browser:closed` drops its tab.
+  - A closed panel mounts no frame and reads nothing.
+- `scripts/preview-new-tab.ts` shows it against fakes: the Launchpad's page with the
+  panel, `/new-tab` standalone and inside a host page with T3 Code's tools, and switches
+  for a hub that does not answer and an Environment without a browser.
+
+Until T3 Code's release with step 4, the Launchpad's panel and a standalone page are Nová
+karta's only consumers. While Nová karta shows in the Launchpad's panel, the panel and the
+page each read the overview every 5 s; step 5 measures that cost with the heaps.