feat(console): TODAY — the estate's triage screen, and the shell moves up to hold it

[omercelikdev]

U4 slice 2 (console RFC D2). An operator opens a console to answer "is anything wrong", not to browse. The landing screen is now the whole estate's triage; every module is one click away rather than the front door.

The shell had to move up for that: it belongs to the console as a whole (services, nav, Today) and a service contributes only its panels. Which also means capability discovery now runs for every registry service, not just the open one — triage cannot speak for a service whose capabilities it never asked about.

What the screen refuses to do — that is the design

• No invented aggregates. Every number is read from the same take-bounded lists an operator would open, because the frozen contract has no aggregate endpoint. So the screen prints its scope ("the most recent 50 rows of each surface") instead of implying it saw everything, and "nothing found" is said as nothing in that scope — a different claim from "nothing is wrong".
• A surface it CANNOT read is a row. No ops role, or a call it cannot scope: blindness during an incident is the most important thing an operator can be told. Grouped per service, because five identical "forbidden" rows would bury the estate's real problems under our own.
• A surface that dies mid-read is a row too. Triage never drops a service quietly.
• Every row is a deep link — it opens the panel that owns it, on the service that owns it.

Proof

The smoke's three apps, all real:

• open — a real upload creates a batch at the four-eyes gate; triage reports it and the row deep-links into the bulk panel on that service;
• auth-floored and tenant-scoped — triage reports that the console cannot see them, in the server's own words.

18/18 green, including the accessibility check of the landing screen itself. Console unit 136 (28 new), kit 64.

The retired Console shell's tests were re-homed rather than dropped: forbidden/refused naming, the no-surface case, and landing on each panel are all asserted at the new level.

🤖 Generated with Claude Code

[omercelikdev]

Review agent v1 — 2 finding(s). The human decides; hard-stop labels need explicit resolution.

• R1 (medium) ui/console/src/triage.ts:60 — A service the console cannot read at all is tagged tone "warning", so orderTriage sorts it below every "danger" row from a fully-readable service — in tension with the PR's own claim that blindness during an incident is "the most important thing an operator can be told".
  • evidence: docs/rfc/goldpath-console.md: "blindness during an incident is the most important thing an operator can be told"; triage.ts:60 sets tone: "warning" for the unreadable row, and orderTriage (danger before warning, then by service) ranks it under any ordinary failed-run/failed-notification row from another service. · action: Confirm intentional: if blindness should outrank ordinary failures, tone it "danger" (or give orderTriage a tier ahead of danger); if "warning" is deliberate, soften the RFC wording so the code and the promise agree.
• R6 (medium) ui/console/src/triage.ts:54 — The re-check capabilities[unreadable[0]].kind === "forbidden" || ... === "refused" is dead code: unreadable[0] is already guaranteed forbidden/refused by the filter on lines 48–51, and the as { message?: string } cast on line 55 bypasses TS narrowing anyway — the check buys neither runtime nor type safety.
  • evidence: redundant condition — filter predicate re-tested immediately after the filter that already established it · action: Simplify to const said = (capabilities[unreadable[0]] as { message?: string }).message;

Calibration: mark each finding accepted/dismissed in a reply — dismiss rate >40%/class revises that class (strategy §5).

[omercelikdev]

Both accepted.

R1 — the finding is that my own sentence and my own code disagreed, which is the worst kind of drift. A row saying the list is incomplete now sorts above the list: blind is its own rank, ahead of danger, and the chip reads "cannot see" instead of borrowing a failure's words. The RFC wording stays as written, because the code now keeps it.

R6 — dropped; the filter had already established the condition and the cast bypassed narrowing anyway.