feat(workspace): unsent input survives switching agents, chat tabs and rooms (abilityai/trinity-enterprise#657)

[vybe]

Summary

• Text typed into a Workspace composer used to die on the next click — the shell remounts PortalConversation / PortalRoom on every switch and input was a ref of the stage. Drafts now outlive the switch, come back exactly as left, and are marked wherever the conversation is listed (agent row, chat tab, thread/room row, search hit).
• The composer IS the draft. One write-through composable binds both composers, which makes send()'s existing input.value = '' the clear and every existing hand-back (cancelled turn, failed escalation, failed room send) a draft again — no clear call was added to any of them.
• Frontend only: no endpoint, no schema, no API, no MCP surface. Keys are the shell's own chatKey scheme (thread: / room:, plus new:<agent>), so a later server-side draft would swap only the source.

The three decisions worth reviewing

1. Identity = the roster's client_email, not the column layout's resolveLayoutIdentity (auth0_user). That rule exists because widths must resolve synchronously before first paint and it gives every portal client one shared client bucket — harmless for a number, not for someone's words. Drafts render after rosterLoaded, so they can use the server-reported principal. The divergence is recorded in architecture/workspace.md so the next per-viewer cache doesn't invent a third rule.
2. Persistence is key-granular (persistDraft re-reads the bucket, applies one key) plus a storage listener. The Workspace opens in its own tab (ent#456); a whole-map write from tab B carries a stale snapshot of tab A's keys and could re-persist a draft A had just sent — the one thing AC-6 forbids.
3. The mark is the word "Draft", not an icon — a deviation from the approved plan, made after looking at the live render. The pencil is already the rename affordance (PortalEditableTitle) on these exact rows, the dot is the tab strip's activity signal, the star is the per-viewer pin. The issue offers "icon or short tag"; two facts sharing one shape is the failure principle 24 names.

Changes

Area	Files
New	components/portal/portalDrafts.js (pure rules), stores/portalDrafts.js, composables/useComposerDraft.js, components/base/DraftMark.vue, utils/safeStorage.js
Composers	PortalConversation.vue, PortalRoom.vue — bind the composable; restore focus on a fine pointer only (a phone would get the soft keyboard over the transcript)
Lists	PortalSidebar.vue, PortalChatRow.vue, PortalChatTabs.vue, OverflowTabs.vue (+ optional per-tab hasDraft), portalUtils.js
Shell	Portal.vue — hasDraft rides decorate() beside starred/unread; Reset carries the draft to the new Main; a failed room post hands the text back
Session	clientPortal.js — explicit sign-out clears the bucket before signOut() nulls the identity; expiry keeps it

Four in-instance identity changes are one rule (reconcileDraftOnKeyChange), including the thread: → null hop openAgentPage takes on the current agent before its remount — a three-branch rule would have blanked the composer there.

Test plan

• npm run test:unit — 3200 passed / 140 files (includes the raw-color + loading-gate ratchets); npm run check:tokens OK
• e2e/workspace-drafts.spec.js — 5/5 against a real browser: agent round trip + focus, two drafts at once, reload survival, room round trip, tab-to-tab isolation. Hermetic page.route mocks and @smoke, because CI runs test:e2e:smoke only — an @interactive spec here would be a live consumer nothing executes (bug(process): tests that assert source TEXT instead of executing the path — three green-CI ejections in one train, third run running #2829)
• No regression in neighbouring workspace e2e (chat-tabs, code-blocks, stick-to-bottom): 9 passed, 4 skipped
• Looked at in the browser in both themes at 1280×800: the mark reads quietly in each, and row/tab geometry is byte-identical with and without it (serialized every button's getBoundingClientRect both ways)

Mutation: nine, each verified red, restored byte-identical from scratch copies —
(1) write-through watch removed (2) whitespace accepted as a draft (3) mark dropped from the mirror row (4) hasDraft dropped from the re-measure key (5) buckets merged on identity change (6) → null reconcile branch dropped (7) clearBucket() moved after signOut() (8) each composer's useComposerDraft call deleted, in turn — e2e only (9) hasDraft dropped from decorate() — e2e only.

(4) is the one worth knowing about: it stayed green at first. jsdom reports every rect as 0, so no spec executed the key — the mark would have silently stopped repacking the strip. Closed with a consumer that spies on getBoundingClientRect, toggles hasDraft and asserts the strip re-measured, plus a negative control that an unrelated prop change does not. Written up in learnings.md.

Stated residuals

• The same conversation edited in two tabs is last-write-per-key (the cross-key case is closed).
• Attachments stay session-only — the issue allows this if retaining them isn't cheap, and it isn't: the chips carry upload state and server-side inbox ids.
• Draft text rests in the clear in the browser profile, under an email-named key — the same boundary that already holds the portal token and the platform JWT. Explicit sign-out removes it.
• The search-result row's mark has no automated coverage: it is a one-line store read in a template, the sidebar has no mount harness, and the e2e doesn't mock the search endpoint.
• The caret restores to the end of the text, not to where it was.

Docs

requirements/core-agent.md §5.35 · new feature-flows/workspace-drafts.md (+ index + changelog) · architecture/workspace.md · design-system.md (the per-tab field family and its three-rows-plus-key invariant) · learnings.md

Fixes abilityai/trinity-enterprise#657 — cross-repo, so this does not auto-close; the private issue is closed at the release cut.

🤖 Generated with Claude Code

[vybe]

merge-train: one mechanical fix pushed to this branch (572cb5ec0).

Validation came back READY — coverage is mutation-proven behavioural, not the source-text class, and every changed value has a named live consumer. One item was worth fixing before merge rather than after:

docs/memory/requirements/core-agent.md AC-3 still described the planned mark — "one small, quiet pencil beside an sr-only Draft (PortalDraftMark.vue)", marked via OverflowTabs' per-tab draft field. Shipped is components/base/DraftMark.vue rendering the visible word, on a per-tab hasDraft field. The deviation is already explained correctly in the PR body and in feature-flows/workspace-drafts.md; this file was simply left at the plan's wording.

The field name was the part worth not leaving: draft is a different, pre-existing PortalChatTabs prop meaning "fresh-start intent", so the requirements named a live prop that means something else. I folded the feature-flow doc's own reasoning (pencil = rename, dot = activity, star = pin — principle 24) into the AC so it reads as a decision rather than an omission.

Recorded as follow-ups, not blocking:

• The three wiring seams (useComposerDraft in both composers, decorate()'s hasDraft) are green under unit mutation and covered only by frontend-e2e, which its own workflow header calls advisory, not a required merge gate. It ran and passed here. A future edit to those files could inert the feature while satisfying every required check.
• No debounce on the persist path — every keystroke does a full getItem/parse/stringify/setItem over the bucket. Latent, bounded by MAX_DRAFTS/MAX_PERSISTED_CHARS.
• DraftMark's title prop is bound but never passed by any caller; usePortalDraftsStore().has() is consumed only by tests.

Fixes abilityai/trinity-enterprise#657 is cross-tracker — it will close the issue but will not relabel it, so I'll set status-in-dev there by hand after merge.

[trinity-ability]

merge-train: validated 2026-09-20. Coverage mutation-proven behavioural; every changed value has a named live consumer. One mechanical fix pushed (AC-3 doc alignment, 572cb5e). Full check set green including all six pytest seeds and e2e.