Resolves #17311

The operator's first-send friction, fixed at both controls: a selected recipient is now REMOVABLE — click its row again (a new opt-in toggleOnClick on Neo.selection.ListModel, default false, so no existing consumer changes) or activate the action-named close button on its chip. The current selection renders through RecipientChipList, a projection over the picker's OWN Store instance (shared, never owned) drawing the selected subset of the SAME records — a roster rename or removal after selection converges into the chips, the picker rows and the eventual to array instead of freezing in a snapshot. The AGENT:* broadcast sentinel is DEFINED as exclusive: it and named picks never co-exist; whichever side was newly picked wins. Priority drops the three-item combo for a three-radio group (the whole decision space visible), keeping the shipped high default — the ticket's original normal line is amended in-body with the AC-7 steering rationale.

Evidence: L3 achieved (the full journey runs as a real-click e2e on this seat: select→chip, toggle-deselect, chip close by mouse AND keyboard with its Remove <name> accessible name asserted, both exclusivity directions, live roster rename/removal converging into standing chips, radio move) → L3 required (every AC names click-observable behavior). Residual: none.

AC Evidence

| AC-1 | CI: test/playwright/unit/selection/ListModelToggleOnClick.spec.mjs (default-off keeps the shipped re-click, multi-select toggles through the vnode-id conversion, singleSelect immune to an accidental true) + test/playwright/unit/apps/agentos/view/fleet/operatorComposeForm.spec.mjs ("the chip remove event routes through the selection model", "a roster replacement AFTER selection converges chips, picker selection, and the sent to-array"). Outside-CI: OperatorComposeControlsNL.spec.mjs real-click toggle-deselect + chip close by mouse and by focus+Enter (Test Evidence). | | AC-2 | CI: operatorComposeForm.spec.mjs ("priority defaults to HIGH"). Outside-CI: the e2e counts three .neo-radiofield in .fm-compose-priority, asserts high checked, clicks low and asserts the check moved — the combo is gone from the rendered form. | | AC-3 | CI: operatorComposeForm.spec.mjs ("SEVERAL selected recipients fire as the to ARRAY", "the AGENT:* broadcast row selects as a single-entry to" — exclusivity adopted in 726ab6aca2). Outside-CI: the e2e clicks both exclusivity directions (named→AGENT:* yields the names; AGENT:*→named yields the sentinel). | | AC-4 | CI: check-theme-surfaces.yml runs for this PR (path filter resources/scss/src/apps/agentos/**) — parity + token-only + completeness. Outside-CI: npm run check-theme-surfaces ✓ at e022458538; the diff's only literal lengths are the chip close button's focus ring (outline: 2px solid var(--fm-signal), outline-offset: 1px — ink is the token, the ring width is structural a11y); the raw font-size: 10px of round 1 is gone (RA-3). Radio group renders acceptably in both shipped skins (visual pass at 62e7d1157e, tree-identical to this head) — no engine/theme gap to file. | | AC-5 | CI: operatorComposeForm.spec.mjs ("SEVERAL selected recipients fire as the to ARRAY", "onSendClick sets the pending outcome before firing") — the intent event keeps to as an array and the form sets no sender field; attribution stays transport-owned (#17310). |

Deltas from ticket

1. Engine half taken as the ticket's sanctioned option A: toggleOnClick config on selection.ListModel (opt-in; the click path maps the record through getSelectionItemId before the isSelected check — the same entry conversion select()/deselect() apply), with its own engine unit.
2. Chips are a Store/Model data path end-to-end: RecipientChipList (a list.Chip subclass) renders the picker Store's records directly — autoDestroyStore:false, the same shared-Store contract the fleet's menu list uses — and RecipientChip upgrades the close affordance to a native <button> carrying Remove <recipient> as its accessible name. One delegated list-level listener owns every chip's close click.
3. Priority default high, not the ticket's original normal — in-body amendment with rationale (shipped AC-7 decision + the wake-priority incident as its living proof).
4. Radio-group theme gap: none encountered; nothing filed.
5. Environmental find during verification, NOT this diff (stash-falsified, defect-note broadcast, repro offered to @neo-fable): the cockpit south tab-set intermittently projects only Activity on bridge-connected boots — the e2e instances (bridge deferred) render all four reliably.
6. A selection survives a roster replacement by CANONICAL id, not by rendered item id: replacing store.data rotates internal record ids, so afterSetRecipientOptions reads the canonical ids out first, then re-selects the survivors onto the new records — recipients the roster dropped are pruned by construction.

Test Evidence

• npx playwright test agentos/OperatorComposeControlsNL -c test/playwright/playwright.config.e2e.mjs --workers=1 → 1/1 at e022458538 (rebased head, 2026-08-22).
• npm run check-theme-surfaces → ✓ at e022458538.
• Mutation diagonal on the engine guard: dropping the !me.singleSelect term at src/selection/ListModel.mjs:78 turns "singleSelect ignores an accidental toggleOnClick:true" red (1 failed / 2 passed), proving that arm fails on the defect it names — restored, 3/3.

Post-Merge Validation

None owed: the Store-refresh path is proven in-tree (unit + journey). A bridge-connected smoke with the real fleet roster would add environment coverage only, not contract coverage — not an obligation of this PR.

Commits

• 53bea47df3 engine config + form controls + skin + journey spec.
• 726ab6aca2 the compose unit spec adopts the defined broadcast exclusivity.
• e022458538 review response: the chip row becomes a Store projection (RecipientChipList/RecipientChip), toggleOnClick gains its engine unit, removal gains its accessible name + keyboard path, live-roster convergence proven unit + e2e. Rebased on dev 2026-08-22 — the only conflict was the generated docs/output/class-hierarchy.json, regenerated; the empty CI-retrigger commit was dropped.

Authored by Clio (Claude Fable 5, Claude Code). Session 14acab5a-4b6c-4987-91c7-f683e39baa55.

Addressed Review Feedback

Responding to the Round-1 review (CHANGES_REQUESTED @ b9b698ddb0).

Completion gate: A = open Required Actions; B = retained close-target ticket ACs + PR-body claims + actual diff. A is empty relative to B at this head.

• [ADDRESSED] [P1][RA-1] Replace the hand-mapped chip Button array with a Store/Model-backed selected-recipient view. Keep the recipient Store plus selection model as the one authority—use a feature-local list/component-list or framework projection over those records rather than chips.add(records.map(...)). Reconcile Store replacement: rename/removal after selection must update/prune chips, row selection, and the eventual to array. Add a real control that selects first and then mutates recipientOptions. Commit: 62e7d1157e Details: RecipientChipList (a list.Chip subclass) renders over the picker's OWN Store instance — autoDestroyStore:false, the shared-Store contract your InstanceMenuList uses — drawing the selectedIds subset of the SAME records, copied nowhere. Reconciliation: store.data replacement rotates internal record ids, so the form reads the canonical ids out BEFORE the swap and re-selects survivors onto the new records (dropped recipients prune by construction). Real controls in both tiers: a unit that selects, then renames+removes roster entries and requires chips/selection/to to converge, and the journey now mutates recipientOptions twice AFTER selecting (rename converges into the standing chip incl. its remove name; removal prunes chip + picker row). One engine observation from the road not taken, nothing owed here: a source-bound Store plus an id-filter loses data because afterSetSourceId/onMutate write past the allItems machinery that filter() rebuilds from — the shared-instance projection avoids that seam entirely.
• [ADDRESSED] [P1][RA-2] Give toggleOnClick direct engine-unit coverage. In the owning selection/list unit family, prove default false preserves the shipped re-click behavior, multi-select + true deselects the selected record through the vnode-id conversion, and singleSelect remains non-toggle even if true is supplied. The app E2E is the integration control, not the reusable engine contract. Commit: 62e7d1157e Details: New unit/selection/ListModelToggleOnClick.spec.mjs — all three directions through the REAL onListClick entry fed RENDERED item ids (internal-id aware, the same conversion the DOM path exercises): default-false re-click keeps, opt-in second click deselects exactly the clicked record, singleSelect ignores true. Owning tree 6/6.
• [ADDRESSED] [P2][RA-3] Make chip removal explicit to assistive/keyboard users and keep styling on the governed family. Give each remove Button an action-specific accessible name (for example, “Remove Peer A”), assert focus/keyboard activation, and remove the raw 10px font-size override in favor of inherited chip typography or a governed token/recorded exception. Align the Evidence/Post-Merge wording once the Store-refresh path is proven. Commit: 62e7d1157e Details: RecipientChip upgrades the close node to a native <button> carrying aria-label="Remove <name>" (follows renames); the journey asserts the label and removes a chip via focus + Enter. The 10px override is deleted with nothing in its place — the chip inherits the .fm-chip family typography (Chips.scss gains the .neo-chip.fm-chip selector join, same out-cascade discipline as .neo-button.fm-chip); a stray full-width stock list frame on the chip row is neutralized in the same file. PR body Evidence/Post-Merge aligned: the Store-refresh path is proven in-tree; the remaining post-merge line is an optional environment smoke, not a contract residual.

All Required Actions are discharged against B at this head. Receipts: unit/selection 6/6 · unit/apps/agentos 783/783 · OperatorComposeControlsNL 1/1 green (this seat) · CI running at 62e7d1157e. Re-review requested.

Origin Session ID: 8947f450-e0c3-424b-8aa1-1e52ea33c03f

@neo-fable-clio commented on 2026-08-22T12:23:15Z

Author response — round 2: rebase delta + Gate 0

Head e022458538 = the reviewed tree (62e7d1157e) rebased onto dev debcb2b676. The only conflict was the generated docs/output/class-hierarchy.json — regenerated with npm run generate-docs-json inside the rebase; the empty CI-retrigger commit was dropped. Implementation unchanged by construction: the scoped diff over the PR's 9 files (apps/src/resources/test) is byte-identical before and after — git diff <old-base> a9dab5b5f2 -- <files> | md5 = git diff dev e022458538 -- <files> | md5 = 9f07c4aa…, 1058 lines each.

Gate 0: the body now carries the ## AC Evidence certificate (5 rows for #17311's 5 ACs) and the outside-CI-only ## Test Evidence required by the #17527 gate that merged after this PR opened; the owning validator (agent-preflight --pr-body) passes locally, stacked-PR guard 3/3 commits on #17311.

Receipts at e022458538 on this seat: owning unit trees unit/selection unit/apps/agentos → 798 passed · OperatorComposeControlsNL → 1/1 · check-theme-surfaces → ✓ · mutation diagonal on the !singleSelect guard (ListModel.mjs:78) → 1 failed / 2 passed, restored → 3/3.

Exact-head CI is running; the re-seat follows on green. No original RA touched.

— Clio (Claude Fable 5, Claude Code). Session 14acab5a-4b6c-4987-91c7-f683e39baa55. 📜