M4-20: Thread view, input and message actions

Status: ready | Depends on: M4-19 | Milestone: M4

Goal

After this ticket a person can read and write in the desktop app: the history column shows a thread (a forum post or a thread from a message) and the main thread of a text channel (01 5.1 D2) from the local database with the message component of M4-07 (grouping, origin badges, safe Markdown, "Show more" for long replies, tombstones, system lines), loads older pages and fills gaps through the engine, reports the visible thread to the gateway (focus) and marks it read; the thread header names the operator (or "No agent answers here"), the title with its "automatic" mark, and offers Done and reopen, pin and the session column; the composer of M4-07 sends through the outbox (Enter or Shift+Enter by composer.enter_sends), keeps the draft in sync across devices, suggests mentions from visible people and agents and shows who is typing; the composer inserts templates (personal and of the channel); the message actions edit (with the 412 conflict shown as two revisions), view versions, delete with one confirmation, reply with quote, start a thread from a message, reactions, pin and unpin, mark as unread and copy; the thread header moves a thread to another channel with the same operator; and every offline state of 01 6.6 is visible (banner, "sending", "Sending delayed", failed with "Send again", "Edit" and "Discard", "No access anymore"). The session column gets its frame with the pinned messages; M4-21 and M4-22 add the agent session and files. Rendering passes SEC-T13: nothing in a message is executed or loaded. Why: this is the conversation itself; every rule of 01 6 and 04 13 meets the person here.

Read first

• docs/PLAN.md: section 3; section 10 (Red team: T-AI-06; rows M4-20 to M4-24).
• docs/spec/01-product.md: 3.1 (move a thread), 3.3 "Messages" (view versions, templates), 5.1 D1 and D2 (history, thread header, session column, composer, typing line), 6 "Interaction rules" (6.1, 6.4, 6.6, 6.7), 7 (Enter, Shift+Enter, arrow up, Esc, Option+Click: the actions that M4-24 binds to shortcuts), 8, 11 (composer.enter_sends), 14 (ui.message_group_window, ui.message_collapse_lines, ui.composer_max_lines).
• docs/design/components.md: 1 "Message", 9 "Input with slash suggestions" (the composer states without commands; commands are M4-21).
• docs/spec/03-data-model.md: messages (content format with the mention rules, reply_to_message_id, kind, origin, tombstones), message_revisions, reactions, pins, drafts, read_states, threads (title_source, state, operator).
• docs/spec/04-sync-protocol.md: 4, 5.1, 8.3 items 3 and 4, 11.3 item 2 (focus), 12 item 1 (typing), 13 "Offline behavior of the client" (13.2 to 13.4), 14 (read state, drafts with overwrote_newer and clear_draft), 16.1 and 16.2.
• docs/spec/07-permissions.md 4.6 (who can be mentioned; the client offers only visible principals).
• docs/spec/19-security.md: SEC-OUT-1 to SEC-OUT-3, SEC-T13; docs/security/threat-model.md T-AI-05, T-AI-06.
• docs/spec/15-client-architecture.md: 4, 5, 7.3 item 4 (gaps), 7.5, 11 (/t/{thread_id}?m={message_id}).
• docs/api/openapi.yaml: listMyTemplates, createPersonalTemplate, listTemplates (channel templates), moveThread, listThreadMessages, getThread, createMessage, updateMessage (If-Match, 412, 410), deleteMessage, listMessageRevisions, addReaction, removeReaction, listReactions, pinMessage, unpinMessage, listPins, putReadState, markThreadUnread, putThreadDraft, deleteThreadDraft, closeThread, reopenThread, setThreadTitle, createThread (parent_message_id), getInstance (InstanceLimits).
• docs/DECISIONS.md: D-W-100, D-W-114, D-W-115; section 10.
• Briefs: docs/briefs/M4-19-sidebar-post-list.md, docs/briefs/M4-18-desktop-shell.md (columns, router, providers), docs/briefs/M4-07-core-components.md (DsMessage, DsMarkdown, DsComposer, DsSuggestionList, DsBanner), docs/briefs/M4-15-sync-outbox.md (executors, watchThread, edit and delete rules), docs/briefs/M4-14-sync-catch-up.md (gaps, targetsRemoved, draftOverwritten, DraftEditing port), docs/briefs/M4-13-sync-connection.md (FocusManager, TypingThrottle), docs/briefs/M4-17-fake-server.md (handlers, scenarios).

This ticket touches no API operation, no table of chapter 03, no action, no event and no configuration key.

Fixed requirements that apply

Owner's fixed build rules (apply verbatim):

1. No MVP. New from scratch and directly in the final state; stages are only the order.
2. Strictly modular: clear module and service boundaries, dependencies only through defined interfaces, no cross access.
3. Documentation in code: every public module, class, function and interface with a docstring/doc comment (purpose, parameters, return value, errors, example where useful); comments explain the why, not the what. API documentation is generated from code (OpenAPI from the routes, dartdoc, Python API docs in MkDocs).
4. Documentation in the repo: README per module/service, ADR for every architecture decision, CHANGELOG per release, keep the documentation site current. A change without matching documentation is not done.
5. Quality gates (SonarQube, linters, type checking, security scanners, test coverage) block the merge.

Rules for every brief:

1. Test first: write the failing test, run it and keep the red output for the report, then make it green, then clean up.
2. No en dash and no em dash in any file you write; the text-rules pre-commit hook rejects them, and the ARB test of M4-06 rejects them in interface texts. Use a hyphen or rephrase.
3. White label: examples and test data use example.com and the people Alex, Sam and Robin; no company, host or personal names, no paths under a home directory. Interface texts come from packages/l10n, never as literals in widgets.
4. Limits only through named keys: ui.message_group_window, ui.message_collapse_lines, ui.composer_max_lines from AppConfig; content and attachment limits from InstanceLimits of getInstance (D-W-115), checked before sending; no literal in code.
5. Specification first: if a flow of 01 6 needs an operation or field that docs/api/openapi.yaml lacks, stop (Boundaries).

Product requirements implemented here:

1. The history reads only from the local database; a gap in thread_seq shows a loading row until the engine fills it, never messages out of order (04 4, 15 7.3).
2. Messages of the same author within ui.message_group_window are grouped; messages over ui.message_collapse_lines lines collapse with "Show more"; code blocks scroll; long replies are never split (01 6.4).
3. Messages from agents, apps, imports and the system carry their origin badge; only server messages of kind system render as system lines (SEC-OUT-3).
4. Rendering executes nothing and loads nothing: raw HTML stays text, javascript: and other unsafe links stay text, image URLs are not loaded, there is no link preview (SEC-OUT-1, SEC-OUT-2, SEC-T13).
5. Every write goes through the outbox (15 1 principle 3); a sent message appears at once with "sending" after the last confirmed thread_seq; permanent errors show the reason with "Send again" (new ID), "Edit" and "Discard"; "Sending delayed" after client.outbox_stuck_after (01 6.6, 04 13.2).
6. Editing a sent message sends If-Match; 412 version_conflict shows both revisions and the person decides; 410 message_deleted keeps the text for copying (04 13.3).
7. Deleting asks for confirmation once (01 6.7); a deleted message shows its tombstone.
8. "View versions" shows the earlier revisions of an edited message (listMessageRevisions, where the server allows message.revisions.read) (01 3.3).
9. Templates: the composer offers the person's own templates and the channel's templates and inserts the chosen text; a person can save the current text as a personal template (01 3.3).
10. Move: the dialog shows only channels with the same operator; the thread ID stays; the moved thread follows thread.moved (01 6.7, M1-62).
11. A new message in a done thread reopens it (the server writes the system line); "Done" and reopen from the header (01 6.1).
12. The header names the operator or says "No agent answers here"; an automatic title carries the "automatic" mark and editing makes it manual (01 6.7).
13. Mention suggestions show only people and agents that the local database knows (what the person may see, 01 6.7); a token is shown as a mention only when its principal is in mention_ids (03 content format).
14. Read state: the visible thread is marked read through the outbox and only increases; "Mark as unread" uses markThreadUnread with If-Match (04 14).
15. Drafts are saved through the outbox and synchronized; a change from another device does not overwrite text the person is typing; overwrote_newer shows a notice; sending with clear_draft (04 14).
16. Typing: typing.start at most once per sync.typing_min_interval, typing.stop on clear or send; the typing line shows people typing in the thread (04 12).
17. On access removal the open view closes with "No access anymore" and waiting messages stay as text for copying (01 6.6, 04 8.3).

Scope

Create in apps/client/lib/:

• thread/ (move_thread_dialog.dart, versions_dialog.dart, history_column.dart, message_list.dart virtualized with paging up and the gap row, message_tile.dart mapping to DsMessageData, thread_header.dart, title_editor.dart, system_line.dart, revisions_dialog.dart for the 412 case, delete_confirm.dart, reaction_picker.dart, message_menu.dart with the actions, outbox_rows.dart for pending and failed entries, typing_line.dart, providers.dart).
• composer/ (composer_controller.dart with draft sync, mention suggestions and the send path; mention_suggestions.dart; templates_menu.dart; draft_sync.dart implementing the DraftEditing port of M4-14).
• session_column/ (session_column.dart frame with the section "Pinned", pins_section.dart).
• sync/message_ops_app.dart only for the executors M4-15 does not have yet (markThreadUnread, pinMessage, unpinMessage, closeThread, reopenThread, setThreadTitle, moveThread, createPersonalTemplate, and cancelRun, which Running now of M4-23 and the live box of M4-21 both use), registered in the bootstrap.
• Fake server handlers for the operations above that M4-17 does not have (listMessageRevisions, markThreadUnread, pinMessage, unpinMessage, listPins, closeThread, reopenThread, setThreadTitle, createThread with parent_message_id, moveThread, listMyTemplates, createPersonalTemplate, listTemplates), through the handler registry of M4-17.
• Tests under test/thread/, test/composer/, goldens under test/goldens/thread/, integration tests under integration_test/ (Tests).
• ARB keys for every new text in packages/l10n.

Change:

• apps/client/README.md (thread view, composer, message actions).
• docs/DECISIONS.md section 10: rows D-M4-20-<n>; root CHANGELOG.md under [Unreleased].

Out of scope

• Live box, trigger state, follow-ups, components on messages, slash commands and the agent part of the session column (M4-21).
• Attachments, images, voice messages and the "Files" section (M4-22).
• Search in the thread, quick switcher, mentions view (M4-23); keyboard shortcuts as bindings (M4-24; this ticket offers the actions they call).
• Link preview (R-PR-09: later and only with opt-in).

Boundaries

• Work in a dedicated git worktree on the branch feat/M4-20-thread-view; one writer per worktree.
• Conventional Commits with the package or component as scope (for example feat(client): ..., feat(sync-engine): ..., build(gates): ..., docs(spec): ...) and a DCO sign-off on every commit (git commit -s); squash into meaningful commits before the merge (docs/quality/push-discipline.md).
• Never push to main, never tag and never create remote repositories; the only remote steps are the branch push and the pull request of AGENTS.md. Never publish a Dart package (publish_to: none in every pubspec.yaml).
• Do not modify files outside the scope above, except the CHANGELOG, README and docs/DECISIONS.md entries named in this brief.
• Follow the host rules supplied by the launcher (ports, machine rules).
• Tests bind only 127.0.0.1 with port 0 and make no network call; fakes replace the server unless a section below names a container. Temporary directories only via mktemp -d (Dart Directory.systemTemp.createTemp, pytest tmp_path), removed at the end. Stop only processes you started, by PID.
• Never read or print secrets. No network calls except package downloads for pinned tools and pub packages and what the gates of make check do themselves.
• The Flutter SDK at the version pinned in the root pubspec.yaml must be on PATH (and Go and Docker where a section names them); without them the gates fail by design (R-QA-02), and the ticket stops with Verdict: BLOCKED <tool> missing instead of skipping.
• Never lower a threshold, disable a gate, delete a test, raise repo.max_file_kb or extend quality/licenses/allowed.txt; never exclude hand-written code from a lint, format, coverage or doc gate.
• The product name appears only at the places of 02 "Code layout" ("Places that carry the product name"); the app shows branding.product_name from the instance, never a literal.
• No permission logic in the client (15 1 principle 1): controls follow server responses, snapshots and events, never an own derivation from grants.
• If the core contract (chapters 00, 03, 04, 05) or docs/api/ lacks something this ticket needs, stop with Verdict: BLOCKED <reason> instead of building a deviation (P-11).
• This brief was written before milestone M1 closed (D-W-100, extended to M4 by D-W-114). Where the merged code of an earlier ticket names a package, type, function, file, provider or make target differently from this brief, follow the code and list each difference in the report; where it behaves differently from the specification, stop with Verdict: BLOCKED <reason>.

Design notes

1. History. MessageList over MessagesDao.watchThread with the newest page first and paging up through the engine's Fetcher when the person scrolls near the top; the scroll position stays anchored on new pages; a jump to ?m=<message_id> loads the range around it and highlights it. Outbox entries of the thread (M4-15 watchThread) render after the last confirmed thread_seq with their state. Grouping through isContinuation of M4-08 with ui.message_group_window. The main thread of a text channel shows thread starters as a line "Thread: