fix(channels): keep client-only state (PSK selection, My Channels, unread) across a channel-list refresh #152

Summary

loadChannels() in public/channels.js replaces the channel list with the server snapshot and carries nothing across. State that only exists in the tab is lost on every refresh, and an open PSK conversation is closed. Same root cause as upstream Kpa-clawbot/CoreScope#2095 (proposed fix Kpa-clawbot/CoreScope#2096); this fork has one extra trigger (shared-channel approval).

Where (master 571fb2c8)

loadChannels() (around line 1856): fetch → map lastActivityMs → ChannelProposals.mergeApprovedChannels(...) → sort → renderChannelList() → reconcileSelectionAfterChannelRefresh(). mergeUserChannels() is not called here.

reconcileSelectionAfterChannelRefresh() (around line 249) clears the selection when selectedHash is not in channels. A user:* PSK hash is never in the server snapshot, so it always is cleared.

Triggers:

1. Region filter change (RegionFilter.onChange, around line 1013).
2. "Show encrypted channels" toggle (mc-channels-show-encrypted-changed, around line 1328).
3. Fork only: shared-channel approval (ChannelProposals.mount({ onApproved }), around line 1047) calls mergeUserChannels() only after loadChannels() has already reconciled.

Symptoms

With a user-added PSK channel open:

• the conversation closes ("Choose a channel from the sidebar"), messages is emptied and the URL is rewritten to #/channels;
• the My Channels section disappears until something re-runs mergeUserChannels();
• unread badges reset. Unread is only bumped for live-decrypted packets (decryptedLocally), i.e. mainly user:* rows, so those are the badges that matter;
• the sidebar preview of a user:* row resets to "Encrypted — click to decrypt".

Proposed fix

In loadChannels(), capture the previous list, then:

fresh snapshot → mergeApprovedChannels → mergeUserChannels() → merge client state from the previous list → sort → render → reconcile

• A pure helper (like mergeWsAppendedIntoRest()) carries unread, userAdded, userLabel by hash, for server rows and user:* rows, and never resurrects a row the fresh list does not contain (the region filter must keep working).
• Newer live activity (lastActivityMs, lastSender, lastMessage, messageCount, moved together) is decided by a local WS sequence, not by comparing timestamps: the WS path stamps rows with an incrementing counter, loadChannels() samples it when the request starts, and prev's activity is kept only if its stamp is newer. Comparing the browser's Date.now() with the server's lastActivity depends on clock skew (review finding on the upstream PR).
• The onApproved path then no longer needs its own mergeUserChannels() call (keep or remove deliberately, with a test).

Acceptance criteria

• With a PSK channel open: region change, show-encrypted toggle and shared-channel approval keep the selection, the messages and the URL.
• My Channels rows and labels survive every refresh.
• Unread and preview on user:* rows survive a refresh.
• A server channel the new snapshot omits (region filter) does not come back.
• A WS update that arrives while the request is in flight wins regardless of browser/server clock skew; a stale client row never overrides a newer snapshot.
• Inputs are not mutated; explicit unread: 0 is preserved.
• Unit tests call the real loadChannels() (existing test hooks) and fail on master; mutation checks for the ordering, the sequence comparison and the user-row merge; a Playwright check of the region-change scenario with a PSK channel open, desktop and mobile width.

Non-goals

No server/API change; no fix for a brand-new WS channel dropped during the very first load (upstream leaves it too).