explore(desktop): anonymous app-shell home on first open (Discord model) - #5987

Three blocking/polish findings on the current exploration head:

• The landing escapes the neutral onboarding theme but keeps Card variant="textured" at its default light texture. On a fresh install following a dark system theme, the cards become bright white powder under light text; names, counts, and descriptions are effectively unreadable.
• At the supported 800px minimum window, the fixed 296px ghost chrome leaves too little main-pane width while the viewport-wide sm:grid-cols-2 still forces two 224px-minimum cards. Content truncates and the textured surfaces crowd each other.
• The newly visible ghost-sidebar copy has eight WCAG AA contrast failures in dark mode (ratios down to 2.8:1).

I fixed all three in signed commit fbd86df8c and published the proposed patch here:
https://github.com/Complear/buzz/tree/review/pr-5987-fix

The patch selects the texture from useTheme().isDark, delays the two-column layout until lg, raises decorative-copy contrast, and adds a dark 800x500 E2E regression for texture choice, stacking, and horizontal overflow.

Verification: E2E build; onboarding E2E 2/2; desktop typecheck; desktop unit tests 4954/4954; focused Biome; file-size/text-size guards; interactive 800x500 dark browser check; post-fix axe cleared all PR-introduced contrast violations (only the pre-existing empty document title remains).

Verdict: REQUEST CHANGES

Reviewed: 3ddaa0d59d6192cf49877bfeb7d5d94702d90101..a737d62e4d10d4726d1d014fd81aa50f8723fe63 (exact live head a737d62e4d10d4726d1d014fd81aa50f8723fe63)

Risk: medium — this changes the user-visible first-open route and the state transition that permanently completes machine onboarding. The diff is otherwise constrained to the stated exploration and follows VISION's community-first direction, but four material regressions remain.

Blocking findings

1. A rejected quick-join still permanently completes machine onboarding. MachineOnboardingFlow.tsx:173-180 ignores the boolean returned by communityOnboarding.start(...) and unconditionally calls complete(identity.pubkey). communityOnboarding.tsx:340-350 returns false when another relay's persisted transaction is active; AddCommunityDialog.tsx:63-75 demonstrates the required checked-call contract. After a crash/reload leaves an in-flight transaction, selecting a featured community can therefore be rejected while first-run setup is marked complete and the app resumes the old community instead. Only call complete after a successful start, show a recoverable error otherwise, and regression-test the conflicting persisted-transaction case.

2. Dark-theme first open renders light text on the texture's baked white center. AnonymousShellLanding.tsx:113-151 uses variant="textured" without textureTone; card.tsx:81-96 defaults to light, and card-texture.css:16-25,54-58 documents that the light asset has a solid white center while bright content requires the separately baked dark asset. Because MachineOnboardingFlow.tsx:334-359 intentionally escapes the neutral onboarding theme, this screen inherits a stored dark app theme. Resolve the current theme and select the matching texture (or use a theme-aware non-textured surface), with a dark first-open regression artifact/assertion.

3. The supported 800px minimum window horizontally overflows the discovery pane. tauri.conf.json:33-34 permits 800px width. The fixed 56px rail plus 240px sidebar (AnonymousShellLanding.tsx:41,56) leave 504px; after the main pane's 64px padding, only 440px remain. Yet sm:grid-cols-2 at line 111 requires two textured cards whose 224px minimum is enforced by card-texture.css:30-46, plus a 32px gap (480px total). Keep the cards stacked until the remaining pane can actually fit them (for example lg:grid-cols-2) and assert no horizontal overflow at 800×500.

4. Visible ghost-sidebar copy is below the repository's WCAG 2.1 AA requirement. AnonymousShellLanding.tsx:59-90 renders readable labels at foreground alphas .35, .40, .45, and .50. Hiding the entire sidebar from the accessibility tree with aria-hidden does not make visible low-contrast words accessible to sighted low-vision users. VISION.md:206 makes WCAG 2.1 AA a minimum. Raise the visible copy to AA contrast or replace it with genuinely non-text decoration, and cover both themes with an automated contrast check.

Validation

• Exact-head authored journey: pnpm install --frozen-lockfile; pnpm --dir desktop build:e2e; isolated static server; pnpm --dir desktop exec playwright test tests/e2e/anonymous-shell-shot.spec.ts --project=smoke --config=<isolated config> → 1 passed. It only covers 1280×960/default-light and element/localStorage presence, so it cannot detect findings 2–4.
• Exact-head adversarial conflicting-transaction Playwright probe → failed as expected: after selecting Buzz HQ, persisted communities contained only the pre-seeded old relay, confirming finding 1's rejected-start path.
• Source contract independently checked at exact head: communityOnboarding.start returns false for a conflicting relay and the changed caller ignores it; the established Add Community caller handles it.
• GitHub checks at this head are not green (Desktop smoke/integration failures). The PR reports an identical base failure set, but I did not independently run a complete base/head comparison, so those checks are not used as blocker evidence here.

Manual/native evidence: exact-head screenshots exercised the mocked Chromium first-open journey at 1280×960. No native GUI launch was performed because this shared machine requires explicit opt-in; therefore native WKWebView behavior remains unverified.

Residual risk: full Desktop package gate and native harness were not run in this review round. Once the four blockers are fixed, please add risk-shaped dark-theme, 800×500 overflow, contrast, and persisted-transaction recovery coverage and rerun the full Desktop gate. Any new head requires review of the delta.