[freeqaz]

Problem

Dogfood round 59 on a member/administrator walk found four console gaps after recent refusal work:

• Agents list, a row refusal that is not about grants (retry ownership on a stale row, finding D812): at 390 px the alert sits far above the row, which showed only a natively disabled, faded icon with no note and no description, so keyboard and screen reader users could not reach the reason. Coming back to the window dropped the alert, and the row then read only "Deleting".
• Agents list refocus (D814): after a refused row Stop or Delete and a re-grant, coming back to the window lifts the refusal but keyboard focus falls to the page body. A row write makes the list one the refocus check never reuses, so it rebuilds, and focus restore only handled a reused view.
• Agent page, Request Stop again (D815): the confirmation for an Agent already requested to stop used the running-stop copy ("This interrupts the current runtime gateway...").
• Agent page refocus (r54 row 11): a re-granted reader kept a refused Stop, Request Stop again or Delete after coming back to the window; only header Refresh reread the permission answer. The Agents list already follows refocus.

Change

• agents/collection.mts: a non-grant row refusal keeps the alert as the row's refusal. The row note reads "Not deleted: see above" or "Not stopped: see above", with the alert's sentence as its tooltip and hidden reason. Both icons stay in the Tab order, aria-disabled, described by the alert (refused icon) or the note (the other), and focus stays on the refused icon. A refocus that rebuilds the list shows the same refusal again until Refresh; any other load drops it. Other unsettled outcomes (404, 409, unknown) are unchanged.
• console.mjs: a refocus that rebuilds the Agents list returns focus to the control with the same data-refocus-key (row name link, Stop and Delete icons). Reused views keep the existing restore.
• console.mjs + agents/detail.mts: after the in-place refocus recheck of a mounted Agent page succeeds, the page rereads its Agent permission answer (the same path the administration-ended recheck uses), so Stop, Delete and the draft follow a grant or revocation without Refresh.
• agents/stop.mts: the Stop row no longer replaces its controls when they are unchanged; doing so detached the focused Stop when a re-grant lifted its refusal.
• agents/lifecycle-confirmation.mts: Request Stop again on a stopped Agent says "This Agent is already requested to stop. This sends the stop request again; use it if an earlier stop did not finish." plus the usual retained-resources sentence.
• Flow doc, Storybook scenarios (Pages / Agents / Delete from the list refused for another reason, Components / Stop Agent / Repeat confirmation) and the focus workflow are updated.

No server, API, IAM or authorization change.

Verification

Tested head 7179e45e12 (code unchanged since bcb17ae0d8; the last commit moves two doc sentences).

• New and changed browser tests fail with main's console source and pass on this head (remote test VM): console-lifecycle-refusals (non-grant row note, reachable icons and refocus; Agent page re-grant lifted by refocus for Stop and Delete), console-refocus-focus (rebuilt list keeps focus on the row icon), console-agent-detail and console-agent-detail-2 (repeat Stop copy, with and without a selected version).
• Mutants: 8/8 killed (repeat copy dropped, rebuilt list restores no focus, Delete without refocus key, empty non-grant note, refusal not carried through refocus, held icons natively disabled, refocus recheck handlers not run, Stop row always replacing its controls).
• Pins 20/20 at 2 CPUs in a private network namespace: console-lifecycle-refusals, console-refocus-focus, console-agent-detail, console-agent-detail-2.
• CI-shaped lanes on a remote test VM: static (on 7179e45e12), Console Browser and Console Browser 2 (on bcb17ae0d8) pass; pnpm run typecheck passes; Prettier and ESLint clean on touched files.

Storybook fixture frames (simulated UI proof; no backend or real refusal), before = main's console source, after = this head:

Pages / Agents / Delete from the list refused for another reason, 1440 before / after:

390 (full page) before / after, then after coming back to the window (alert, note and focus kept):

Video at 390: refused Delete, window refocus, then Refresh makes the icons available

Components / Stop Agent / Repeat confirmation, before / after at 1440 and 390:

The two refocus behaviors (D814 focus, Agent page re-grant) have no Storybook state of their own; the browser tests above cover them against the real controller and Native IAM with in-memory storage.

Risks

• Each refocus of an Agent page now sends one more GET .../permissions. It is not an audited read and is skipped while the Agent is deleting.
• The kept non-grant refusal lives in module state and is shown again only on a refocus rebuild of the same Namespace's list whose Agent is still listed.
• Not addressed: a permanently failed deletion still reads "Deleting" and the retry-ownership refusal does not name the initiating actor (finding 2961). Both need an API field; see the related open Track Agent deletion through controller-confirmed cleanup #3390.
• Track Agent deletion through controller-confirmed cleanup #3390 and fix(console): keep agent detail stop available after readable failure #3942 also touch collection.mts / stop.mts; a later merge may need a small rebase of these hunks.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.