merge(upstream): absorb origin/main (tiann#2040) into tip-forward WIP

Keep soup versions of conflicted toolbar/router/locale files — live tip
already dogfoods tiann#2040 plus interleaved soup-only Boards/overseer/content-search.

Author: heavygee

config/driver-manifest.yaml

@@ -1092,9 +1092,8 @@ layers:
 
   # heavygee/hapi#235 / PR #238 — Boards view (cards/chips/relative-time,
   # Projects v2 /views/<n> filter capture). Renamed To-Do → Boards.
-  # Re-tip 2026-10-14: driver/235-todo-board-view @ 6e5ee7bc4 (= feat tip —
-  # isHistoryPopNavigation push-vs-pop; assignee picker name+login). Was
-  # 7f565cac6 (Open-session / clearable status / mention tooltip).
+  # Re-tip 2026-10-18: driver/235-todo-board-view @ 17c2fa61d (= feat tip —
+  # client-side title-only filter). Was 6e5ee7bc4 (push-vs-pop / assignee picker).
   - branch: driver/235-todo-board-view
 
   # heavygee/hapi#247 — deliberate fleet push + restore upgrade-runner; kill
@@ -1298,21 +1297,10 @@ layers:
   # Not product; keeps tip-forward verify green after MachineTag absorb.
   - branch: driver/fix-version-offer-query-test
 
-  # tiann/hapi#2039 / PR #2040 — narrow session toolbar. One nowrap row;
-  # shed by keep rank into More (blocked 2, new 4, filter 5, settings 6,
-  # mark-all 7, browse 8, overseer 9, import 10). Soup tip:
-  # driver/2039-toolbar-crowd @ d3aa1b6e0 (3b85c2cfb + blocked-search shrink test)
-  # Tip-unique verify marker: session-list-header-actions in web/dist
-  # Upstream thin: fix/2039-session-toolbar-crowd (worktree fix-2039-toolbar-crowd)
-  # Web-only → remat --build-web; hard-reload (no hub restart). Re-thin after dogfood bump.
-  - branch: driver/2039-toolbar-crowd
-
-  # Remat unblock: #2039 outer search is shrink-0 + max-w-full; blocked-header
-  # test still forbade shrink-0 from the earlier clear-target work. Thin tip on
-  # live driver 7e907c715 @ 9fb9af6d8.
-  # Follow-up dc858f6c7: with query chip active, #2039 folds BlockedJumpPill into
-  # More — blocked-search test opens overflow before asserting the pill.
-  - branch: driver/2039-blocked-search-test
+  # DROPPED 2026-10-18 #2040: driver/2039-toolbar-crowd + driver/2039-blocked-search-test
+  # MERGED as tiann/hapi#2040 (squash f13a1aae). Absorb from upstream/main on next remat.
+  # - branch: driver/2039-toolbar-crowd
+  # - branch: driver/2039-blocked-search-test
 
   # #292 — DEFAULT_FLEET_UPGRADE_POLICY=auto (joining fleet = consent).
   # Thin tip on soup HEAD 31e67a6ac: driver/292-fleet-default-auto @ ee9445082

docs/guide/pet-install.md

@@ -29,6 +29,16 @@ curl -fsSL https://raw.githubusercontent.com/heavygee/hapi/main/scripts/install-
 `--with-systemd` works via `curl | bash` (units are embedded in the installer — no git
 checkout required). After install: `systemctl --user status hapi-hub hapi-runner`.
 
+**Headless / service accounts** (no interactive login, no `$XDG_RUNTIME_DIR`): systemd
+`--user` is not running until linger is enabled. The installer **fails fast** with
+copy-paste for a sudo-capable person — it does **not** silently fall back to nohup:
+
+```bash
+sudo loginctl enable-linger <user>
+sudo systemctl start user@$(id -u <user>).service
+# then re-run the same --with-systemd install (idempotent)
+```
+
 ## Finish setup
 
 Open a **new terminal**, then:

docs/plans/retros/2026-10-18-session-toolbar-crowd-2040-exit.md

@@ -0,0 +1,28 @@
+# Exit reflection: session-toolbar-crowd (PR #2040)
+
+## Shipped as
+
+- PR(s): tiann/hapi#2040 (Fixes #2039); squash `f13a1aae`
+- Absorber: n/a
+- Session: [search clear button](/sessions/e02f4a52-4716-43ac-85f4-5b449b18f028)
+
+## Non-code residue
+
+- Dogfood must track the **reviewed tip**, not an older soup pin. Freezing remat while still pushing review fixes made the operator judge the wrong geometry.
+- Equal-width More means shedding one icon often frees nothing - plan for pairs + one-gap slack.
+- Search chrome floor (icon/clear/calendar) and trailing floor (machine menu + More) both have to win; flex-1 actions alone is not enough if the chip can take ~240px.
+- `hapi link-pr` with `existingRefs: []` does **not** replace other PR chips - hub reconciles/unions. Clear with `PUT []` then rewrite the set when retargeting.
+- Public issue/PR copy: do not frame width/touch toolbar bugs as Quest-only.
+- Lane B via `low-impact` on a ~700-line layout PR is a deliberate crowbar; size auto-B correctly failed first.
+
+## Promote?
+
+- [x] `none` — no durable follow-up (link-pr replace semantics already known in hub; dogfood-tip discipline is process, not a new AGENTS row)
+
+## Open questions / landmines
+
+- Font-scale + multi-machine + long query remains the sharp corner; another host density could still look wrong after absorb.
+
+## Skip
+
+- n/a

scripts/install-hapi-pet.sh

@@ -80,6 +80,9 @@ Usage:
 
 --with-systemd         Install user-level systemd units (works via curl|bash;
                        units are embedded — no git checkout required).
+                       Needs a working systemd --user bus for this account.
+                       Headless/service users: linger + user@UID.service first
+                       (script fails fast with copy-paste if the bus is missing).
 --fleet-policy=POLE    silent | alert | auto (default auto). Seeds settings.json
                        fleetUpgradePolicy when unset. alert/silent are opt-outs.
 --skip-upstream-seal   Do not wire HAPI_UPSTREAM_SEAL_URL (foundry/break-glass).
@@ -96,6 +99,56 @@ done
 log()  { printf '==> %s\n' "$1"; }
 fail() { printf 'ERROR: %s\n' "$1" >&2; exit 1; }
 
+# --with-systemd preflight (#294): talk to the user bus before writing units or
+# calling systemctl --user. Missing bus (service account, no linger, no login
+# session) used to die mid-install on a raw dbus error. Hard-fail with
+# copy-paste for a sudo-capable person; never silently fall back to nohup.
+hapi_pet_user_systemd_bus_ok() {
+    command -v systemctl >/dev/null 2>&1 || return 1
+    # show-environment needs a live user bus; is-system-running can be
+    # "degraded" while the bus is still usable.
+    systemctl --user show-environment >/dev/null 2>&1
+}
+
+hapi_pet_user_linger_enabled() {
+    local user
+    user="$(id -un)"
+    [[ "$(loginctl show-user "$user" -p Linger --value 2>/dev/null || true)" == "yes" ]]
+}
+
+hapi_pet_require_user_systemd_bus() {
+    local user uid
+    user="$(id -un)"
+    uid="$(id -u)"
+    command -v systemctl >/dev/null 2>&1 \
+        || fail "systemctl not found — cannot install --with-systemd on this host"
+
+    if hapi_pet_user_systemd_bus_ok; then
+        if ! hapi_pet_user_linger_enabled; then
+            log "WARN: systemd --user bus is up but linger is off for ${user}."
+            log "      Units stop when this login ends. For headless pets, a sudo-capable person should run:"
+            log "        sudo loginctl enable-linger ${user}"
+        fi
+        return 0
+    fi
+
+    fail "$(cat <<EOF
+--with-systemd needs a working systemd --user bus for this account (${user}),
+but none is available (missing \$XDG_RUNTIME_DIR / \$DBUS_SESSION_BUS_ADDRESS,
+or user@${uid}.service is not running).
+
+A sudo-capable person must prepare the account, then re-run this install
+(the script is idempotent — no need to undo the partial binary/settings work):
+
+  sudo loginctl enable-linger ${user}
+  sudo systemctl start user@${uid}.service
+
+Then re-run the same install command. Do not substitute nohup — you asked
+for systemd persistence (#294).
+EOF
+)"
+}
+
 case "$HAPI_FLEET_UPGRADE_POLICY" in
     silent|alert|auto) ;;
     *) fail "HAPI_FLEET_UPGRADE_POLICY must be silent|alert|auto (got: $HAPI_FLEET_UPGRADE_POLICY)" ;;
@@ -587,6 +640,9 @@ hapi_pet_migrate_legacy_oauth_if_needed() {
 # repo checkout. Keep in sync with scripts/tooling/systemd/units/user-pet/*.in —
 # the checkout path below prefers the companion installer when present.
 install_user_pet_systemd() {
+    # Fail before writing units / any systemctl --user (thinkpadt14 field fail #294).
+    hapi_pet_require_user_systemd_bus
+
     local companion=""
     if [[ -n "${SCRIPT_DIR}" && -x "${SCRIPT_DIR}/tooling/install-hapi-systemd-units.sh" ]]; then
         companion="${SCRIPT_DIR}/tooling/install-hapi-systemd-units.sh"

scripts/install-hapi-pet.systemd-curl.test.sh

@@ -74,5 +74,55 @@ fi
 rg -q 'companion' "$SCRIPT" || fail "expected companion-present branch"
 pass "script embeds user-pet units and guards BASH_SOURCE"
 
+# 5) #294: user-bus preflight fails closed without a bus (copy-paste, no silent nohup).
+rg -q 'hapi_pet_require_user_systemd_bus' "$SCRIPT" || fail "missing hapi_pet_require_user_systemd_bus"
+rg -q 'hapi_pet_require_user_systemd_bus' "$SCRIPT" || fail "install_user_pet_systemd must call preflight"
+# Call site is inside install_user_pet_systemd, before companion/embedded writes.
+awk '
+  /^install_user_pet_systemd\(\)/ { in_fn=1 }
+  in_fn && /hapi_pet_require_user_systemd_bus/ { found=1 }
+  in_fn && /^}$/ { exit }
+  END { exit found ? 0 : 1 }
+' "$SCRIPT" || fail "preflight must run at start of install_user_pet_systemd"
+
+probe_src="$(mktemp)"
+bus_err="$(mktemp)"
+{
+    echo 'log()  { printf "==> %s\n" "$1"; }'
+    echo 'fail() { printf "ERROR: %s\n" "$1" >&2; exit 1; }'
+    # Three consecutive helpers: bus_ok, linger_enabled, require.
+    awk '
+      /^hapi_pet_user_systemd_bus_ok\(\)/ { keep=1 }
+      keep { print }
+      keep && /^}$/ { n++; if (n == 3) exit }
+    ' "$SCRIPT"
+    echo 'hapi_pet_require_user_systemd_bus'
+} >"$probe_src"
+
+# Force a missing-bus probe: wrap systemctl so --user always fails even if this
+# developer machine has a real user session.
+set +e
+env PATH="/usr/bin:/bin" bash -c '
+  systemctl() {
+    if [[ "${1:-}" == "--user" ]]; then
+      echo "Failed to connect to user scope bus via local transport: \$DBUS_SESSION_BUS_ADDRESS and \$XDG_RUNTIME_DIR not defined" >&2
+      return 1
+    fi
+    command systemctl "$@"
+  }
+  export -f systemctl
+  # shellcheck disable=SC1090
+  source "'"$probe_src"'"
+' >"$bus_err" 2>&1
+bus_rc=$?
+set -e
+[[ "$bus_rc" -ne 0 ]] || fail "preflight should fail without user bus (rc=0); out=$(cat "$bus_err")"
+rg -q 'enable-linger' "$bus_err" || fail "preflight stderr missing enable-linger: $(cat "$bus_err")"
+rg -q 'user@[0-9]+\.service' "$bus_err" || fail "preflight stderr missing user@UID.service: $(cat "$bus_err")"
+rg -q 'Do not substitute nohup|systemd persistence' "$bus_err" \
+    || fail "preflight should refuse silent nohup: $(cat "$bus_err")"
+pass "#294 fail-fast without user bus (copy-paste linger + user@UID)"
+rm -f "$probe_src" "$bus_err"
+
 echo
 echo "All install-hapi-pet systemd curl regressions passed."

scripts/tooling/install-hapi-systemd-units.sh

@@ -432,6 +432,19 @@ case "$PROFILE" in
         fi
         ;;
     user-pet)
+        # Same class of failure as install-hapi-pet.sh #294: no user bus →
+        # raw dbus error mid-install. Fail before writing units.
+        if ! systemctl --user show-environment >/dev/null 2>&1; then
+            _u="$(id -un)"
+            _uid="$(id -u)"
+            echo "ERROR: --profile user-pet needs a working systemd --user bus for ${_u}." >&2
+            echo "       Missing \$XDG_RUNTIME_DIR / \$DBUS_SESSION_BUS_ADDRESS, or user@${_uid}.service is down." >&2
+            echo "       A sudo-capable person should run:" >&2
+            echo "         sudo loginctl enable-linger ${_u}" >&2
+            echo "         sudo systemctl start user@${_uid}.service" >&2
+            echo "       Then re-run this installer (#294)." >&2
+            exit 1
+        fi
         USER_UNIT_DIR="$HOME/.config/systemd/user"
         mkdir -p "$USER_UNIT_DIR"
         render_pair \