Pup - Puppeteer Bridge

Show the user's Adom identity in the floating owner chip: since Chrome's own profile chip cannot take a custom local image (Google sign-in only), the owner chip now leads with the user's Adom avatar + name. New verb browser_set_identity {avatarB64,name,enabled,clear} stores the identity in pup-settings and repaints live windows. Owner-chip injection (attachTab) and the live-apply path both render the round avatar; falls back to the hexagon glyph when no identity is set.

Fix multi-monitor park overflow: a freshly opened pup window is launched off-screen then parked by reading screen.availWidth/Height, which reflects whichever monitor the window momentarily sits on. On a multi-monitor setup that could size the window for a LARGER monitor while it lands on the smaller primary, overflowing off the bottom-right so page content past the fold was unreachable until the slow 120s placement sweep re-parked it. placeOnScreen now settles then re-reads the destination monitor's work area and re-clamps immediately if it differs, so a window is never left bigger than the screen it is actually on.

Fix debugger-pause freeze: every pup tab now skips ALL debugger pauses (Debugger.setSkipAllPauses+resume) so a page's 'debugger;' statement or a stray breakpoint can never freeze the window and its 3D viewer (John's wiki viewer locked up behind a 'Debugger paused in another tab' banner). Fix overlay-paint spam: dedup desktop_taskbar — only paint when the composed icon+tooltip+target actually changed since the last paint, instead of re-sending identical overlays every few seconds and flooding AD's activity log. Enforcer now treats a genuinely no-favicon page's generic glyph as final after 3 upgrade attempts (retried on navigation) rather than re-composing it every 10s forever.

adom-you visual identity: name the shared profile 'Adom' and tint every adom-you window frame+toolbar Adom-teal via --install-autogenerated-theme (always-visible, no sign-in, no nag). Removed the gaia-picture avatar spoof, which rendered a generic gray chip AND a permanent 'Action required' nag on local profiles.

No more generic-globe flash: applyAppOverlay caches the last REAL favicon per session (keyed by URL) and reuses it instead of downgrading to the generic globe when a same-page repaint can't re-fetch the favicon (the post-re-stamp case). Gated on unchanged URL so a real navigation to a truly faviconless page still falls through to the generic glyph. Runtime-only, no icon-gen bump / no re-stamp.

Generic-overlay recovery cooldown 90s->10s: after an icon-gen re-stamp recreates buttons, overlays fall to the generic globe momentarily; the enforcer now re-fetches the real favicon within ~10s instead of leaving every window on the ugly generic globe for 90s+. No icon-gen bump (no re-stamp).

Remove the baked Adom-mark from the notch (John: it sabotages the clean-background purpose and bleeds through the transparent overlay favicon). The notch is now a clean EMPTY transparent cutout so the taskbar shows through behind the overlay; overlay presence is guaranteed by the 4s enforcer + event triggers, so no fallback mark is needed. Bumped icon gen i5->i6 to regenerate mark-free tiles + re-stamp.

Force ai-thread name as the session owner (John: 'sick of seeing sessionid, force ai-thread now'). browser_open_window now resolves the owner from the calling ai-thread (X-Adom-Caller-Thread header / args.caller.aiThread / args.aiThread); the sessionId is NEVER an identity fallback anymore (removed the auto- stopgap). An open with neither an ai-thread nor an explicit owner is REFUSED with caller_identity_required + the --ai-thread remedy. owner=ai-thread, and ownerSource now correctly reports caller-identity. SKILL.md updated: ai-thread is the owner, owner: arg is a legacy alias, sessionId is just the window key.

Batch-fix 8 open wiki issues. #434: shared-Chrome kill now checks live sessions+in-flight verbs on the profile (not the drift-prone refCount) so it can't kill Chrome out from under a live session. #437: wait-for-focus caption backs off (max 3 shows then silent), gated on fgCaption + honors fgCaptionMs (no more permanent nag). #435: add --disable-session-crashed-bubble/--hide-crash-restore-bubble so a crashed shared Chrome never restores dead-session tabs into the wrong window. #425: findTabForTarget resolves iframe/OOPIF-originated target=_blank popups by opener-frame URL (unique match) so they adopt as tabs. #338: sessions are never unowned (synthesize a stable auto- owner) closing the no-caller-identity ownership hole. #293: raceCrash trims the last 20s hang when an in-flight screenshot/eval races a renderer crash (detection+fast-fail already existed). #350: adCommand caller shorthand + sessionCaller forwards reason (chokepoint already forwards X-Adom-Caller-* + Delegate:pup). #280: self-install now sets PUPPETEER_SKIP_DOWNLOAD so it never hangs on the failing CfT fetch (self-heal already existed).

Fix wiki #468 (Drew: pup 100% unusable, 'never bound its port'). ROOT CAUSE: the heavy native requires (puppeteer, keytar via credential_vault, sharp, and chrome.js which itself requires puppeteer) ran synchronously at module load, blocking the event loop ~8s before the HTTP port could bind — long after AD's recover_not_listening reaps a not-yet-bound bridge (~2-3.6s). FIX: defer all four out of the sync module-load path into ensureHeavyInit(), which runs in the listen callback AFTER the port binds (recover_not_listening is a TCP listen check, so the post-bind load is safe) plus lazily on the first non-/health request. /health needs no heavy module (chrome.readiness guarded). Port now binds in <1s.

Notch margin symmetry (John: 2px cutout on the left of the overlay but only 1px below - unprofessional). The inner (bottom-left) corner radius curved the notch inward where the favicon's bottom-left sits, eating the bottom margin while the straight left edge kept its full margin. Dropped the inner-corner radius to near-sharp (rx 11% -> 2%) so both the left and bottom cutouts are uniform straight edges = even margin around the overlay. Bumped PUP_ICON_GEN i4->i5 so live buttons re-stamp with the new geometry.

Fix: the 'Switch to logged-in view' jump-list task did nothing. browser_wiki_set_view short-circuited with unchanged:true (only bringToFront) whenever pup BELIEVED the window was already in the requested view — but the task promises a harmless reload and pup's view belief is unreliable (default-authed may not have actually signed in; cookies expire). Now a real USER click (caller aiThread user-taskbar-menu) ALWAYS re-asserts the view via the mint/navigate path (a genuine reload that guarantees signed-in), instead of skipping. Programmatic same-view calls still short-circuit.

No redundant Adom mark on the overlay when AUMID is ON (John: the teal category tile is already the 'Adom controlled' indicator). The favicon overlay now carries the Adom mark ONLY when aumidIcons is off (plain Chrome base needs the branding); when AUMID is on the overlay is the clean site favicon alone. Cache key now includes AUMID state so the badge recomposes on toggle.

Fix: notch never appeared on the LIVE taskbar button. The icon FILES changed (added the notch) but PUP_ICON_GEN was not bumped, so the AUMID appId stayed the same and Windows kept the un-notched button it baked at creation (it never re-reads an icon for an unchanged appId; only a new appId forces a fresh button). Bumped i3->i4 so every window re-stamps with the notched tile. Also: notchedIconPath now serves the cached notched icon as soon as it exists on disk (not only after this run's build), so a respawn re-stamps notched immediately instead of flashing the un-notched tile.

Overlay GUARANTEE hardening + graceful notch (John: bare window = broken-looking empty notch; overlays must always be present). ROOT CAUSE of missing overlays: applyAppOverlay REFUSES to paint when it can't confirm the window's hwnd (the Edge-protection guard), and your AD rebuilds constantly respawn+re-adopt windows, forcing hwnd re-resolution and transient bareness. Fixes: (1) baked a small Adom-mark fallback into the notch so a bare window shows a tidy branded corner, not a hole; (2) enforcer sweeps every 4s (was 10s) with a 4s bare cooldown (was 20s) so a bare window heals in seconds; (3) enforcer no longer SKIPS the overlay paint when a base-tile re-stamp is pending (they're independent now).

Notch shape fix (John: overlay favicons are SQUARE, not circles). The notch was a rounded-rect with a 30%-of-side radius, which rounds all four corners into a circular blob. Overlays are square (favicon fills 48x48 + Adom mark corner), so the notch is now a SQUARE: the mask rect extends past the top and right edges so those corners fall off-canvas and only the inner corner is rounded, giving a clean square opening flush to the tile edges. Cache path bumped (-sq) to regenerate.

Notched category tiles (John's idea): punch a transparent rounded notch into the UPPER-RIGHT of each pup category .ico so the favicon overlay AD paints there sits on the clean taskbar background instead of the busy teal art. Generated at bridge runtime (sharp, desktop-only) into a cache dir via a minimal PNG-frame ICO encoder (format validated); baked into the static tile so there's NO per-window/per-favicon churn, only a one-time re-stamp. pupIconPath serves the notched copy once built. Notch geometry (50% upper-right) tuned live.

Taskbar favicon overlay fix (John: icons still wrong). ROOT CAUSE: the badge compositor decided ICO-vs-image by the favicon URL ending in .ico, but analyzeIconBytes had already re-encoded it to PNG, so icoLargestPng ran on PNG bytes, returned null, and dropped the favicon -> bare Adom mark (hit Google Docs and any .ico-suffixed favicon). Now sniffs the real magic bytes. SECOND bug: the generic-glyph fallback set src but never populated iconPng (which is the only thing the composite draws), so undecodable favicons also went mark-only; now it renders the glyph into iconPng and marks src.href generic so the LED shows amber, not a lying green.

Credential import goes LIVE against AD 1.9.220's desktop_decrypt_browser_credentials. Vault (credential_vault.js) now identity-tagged: keep BOTH on a (host,username) conflict from different source accounts, newest-wins within an identity, getCredentialForUrl picks by preferred identity then most-recently-used; passwords in keytar under per-entry composite accounts, index never holds a password (offline-tested). Dashboard Import button calls the decrypt helper LOCALLY (bridge->AD direct API, never relay), handles consent_declined/elevation_declined/relay_forbidden/helper_missing, merges rows, drops plaintext, returns counts only.

Overlay drift fix: the favicon taskbar badge now recomputes on the NAVIGATION EVENT (framenavigated), not just on explicit mutating verbs. Any nav pup didn't initiate — JS redirect, meta refresh, form submit, SPA route change, OAuth bounce, in-tab link click, browser_login submit — previously left a STALE badge; now every navigation from any source re-triggers the recalc (debounced, honors overlayBadges pref, active/visible tab).