From fc7b473afef6f2140b1540555238908f420e010b Mon Sep 17 00:00:00 2001
From: James Maes <james@kof22.com>
Date: Tue, 12 May 2026 16:28:50 -0500
Subject: [PATCH 1/2] =?UTF-8?q?fix(bus):=20surface=20webview=20load=20fail?=
 =?UTF-8?q?ures=20via=20failHandshake=20+=20critical=20banner=20=E2=80=94?=
 =?UTF-8?q?=20closes=20#40?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`BridgeNavigationDelegate` only implemented `didFinish`. A 404 on the JS
bundle (`<script src="./assets/index-XXX.js">`), a JS parse error before
mount, or any pre-mount navigation failure left the handshake stuck in
`.idle` forever — `WebviewBridge.startHandshake()` (and its 2-second
timeout) only run from `didFinish`, so the user saw a silent black HUD
with no banner and no hard-block.

This adds the two failure arms (`didFailProvisionalNavigation` and
`didFail`) and routes them through:

  1. `WebviewBridge.failHandshake(reason:)` — new public surface that
     transitions the handshake state to the new terminal
     `HandshakeState.loadFailed(reason:)` case. Cancels the pending 2s
     timeout (so a late timeout-alert doesn't pile on after the
     load-failed alert) and fires the same `alertPresenter` the
     `.timedOut` and `.mismatched` paths already use (production wiring:
     `TCCAlertService.presentHardBlock` + AppDelegate's terminate hook).
     Idempotent — `.armed`/`.mismatched`/`.timedOut`/`.loadFailed` are
     terminal, so re-entry is a no-op.

  2. `HUDBannerCoordinator.enqueue(.bootHealthCritical(subsystem:
     "webview", ...))` via the new `AppDelegate.handleWebviewLoadFailure`
     hop. Same enqueue pipeline as the Round 4 critical-subsystem
     banners (memory off, no API key, no MCP tools, webview never
     armed); priority 1, non-dismissible, native NSPanel so the surface
     survives even when the webview itself is the broken subsystem.

`WebviewBootHealthProbe` gains a switch arm for the new `.loadFailed`
case (severity `.critical`, matching the existing `.timedOut`/`.mismatched`
treatment) so the boot-health summary reflects the failure.

Tests:
  - `HandshakeTests` (Bus package, +4 tests): `failHandshake` from
    `.sentHello` transitions to `.loadFailed` + cancels the 2s timeout
    + alerts exactly once; from `.idle` still transitions; idempotent
    on re-entry; no-ops after `.armed`.
  - `BridgeNavigationFailureTests` (App package, new file): drives
    `didFailProvisionalNavigation` + `didFail` directly on the delegate
    + the AppDelegate-level `handleWebviewLoadFailure` end-to-end
    (bridge transitions + critical banner enqueued + non-dismissible).

Refs audit-2026-05-12 bus-hud-audit.md §S1 (BridgeNavigationDelegate).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 App/AppDelegate.swift                         |  78 +++++++-
 App/Boot/BootHealthProbes.swift               |   8 +
 .../BridgeNavigationFailureTests.swift        | 169 ++++++++++++++++++
 packages/Bus/Sources/Bus/Handshake.swift      |  15 +-
 packages/Bus/Sources/Bus/WebviewBridge.swift  |  29 +++
 .../Bus/Tests/BusTests/HandshakeTests.swift   |  87 +++++++++
 6 files changed, 377 insertions(+), 9 deletions(-)
 create mode 100644 App/Tests/AppTests/BridgeNavigationFailureTests.swift

diff --git a/App/AppDelegate.swift b/App/AppDelegate.swift
index 471690c..5cf80a4 100644
--- a/App/AppDelegate.swift
+++ b/App/AppDelegate.swift
@@ -2706,10 +2706,17 @@ final class AppDelegate: NSObject, NSApplicationDelegate {
             return
         }
 
-        // Navigation delegate: fires handshake on first didFinish.
-        let navDelegate = BridgeNavigationDelegate { [weak self] in
-            self?.webviewBridge?.startHandshake()
-        }
+        // Navigation delegate: fires handshake on first didFinish; surfaces
+        // load failures (audit-2026-05-12 S1 / #40) via the bus + a critical
+        // banner so a missing/stale bundle is never a silent black HUD.
+        let navDelegate = BridgeNavigationDelegate(
+            onDidFinish: { [weak self] in
+                self?.webviewBridge?.startHandshake()
+            },
+            onDidFail: { [weak self] error in
+                self?.handleWebviewLoadFailure(error)
+            }
+        )
         bridgeNavigationDelegate = navDelegate
         panel.webView.navigationDelegate = navDelegate
 
@@ -2816,6 +2823,36 @@ final class AppDelegate: NSObject, NSApplicationDelegate {
         panel.webView.loadFileURL(entryURL, allowingReadAccessTo: resourcesDir)
     }
 
+    /// Audit-2026-05-12 S1 / #40 — webview navigation failure handler.
+    /// Routes `didFailProvisionalNavigation` and `didFail` from
+    /// `BridgeNavigationDelegate` into:
+    ///
+    ///   1. `WebviewBridge.failHandshake(reason:)` — transitions the
+    ///      handshake state machine to `.loadFailed` and fires the same
+    ///      `alertPresenter` (TCCAlertService.presentHardBlock) the
+    ///      `.timedOut` and `.mismatched` paths already use.
+    ///   2. A critical-severity banner via `HUDBannerCoordinator` so the
+    ///      user sees a HUD-native error surface (matching the pattern
+    ///      `.bootHealthCritical` uses for memory-off / no-API-key /
+    ///      no-MCP-tools / webview-never-armed failures).
+    ///
+    /// Both surfaces fire — the alert is the hard-block path that already
+    /// terminates the app on handshake-mismatch / timeout; the banner is
+    /// a defense-in-depth render path that survives even if the alert is
+    /// suppressed (e.g., AppDelegate test seam with a silent
+    /// `alertPresenter`).
+    @MainActor
+    func handleWebviewLoadFailure(_ error: Error) {
+        let nsError = error as NSError
+        let reason = "\(nsError.domain) \(nsError.code): \(nsError.localizedDescription)"
+        systemLogger?.critical("webview navigation failed — surfacing as load-failed: \(reason)")
+        webviewBridge?.failHandshake(reason: reason)
+        bannerCoordinator?.enqueue(.bootHealthCritical(
+            subsystem: "webview",
+            reason: "HUD bundle failed to load (\(reason))"
+        ))
+    }
+
     // MARK: - Wizard
 
     /// `BannerSink` adapter so `InputMonitoringProbe` (Shell) can enqueue onto
@@ -2984,14 +3021,43 @@ final class AppDelegate: NSObject, NSApplicationDelegate {
 /// the main actor via `MainActor.assumeIsolated` — the same Swift 6 pattern
 /// `WebviewBridge` uses for `WKScriptMessageHandlerWithReply`.
 @MainActor
-private final class BridgeNavigationDelegate: NSObject, WKNavigationDelegate {
+final class BridgeNavigationDelegate: NSObject, WKNavigationDelegate {
     let onDidFinish: @MainActor () -> Void
-    init(onDidFinish: @escaping @MainActor () -> Void) {
+    /// Audit-2026-05-12 S1 / #40 — invoked on either
+    /// `didFailProvisionalNavigation` or `didFail`. Without this hook the
+    /// 2s handshake timeout never arms (it's scheduled inside
+    /// `startHandshake`, which only runs on `didFinish`), so a bundle-404
+    /// or JS-parse-error before mount left the HUD a silent black square.
+    let onDidFail: @MainActor (Error) -> Void
+    init(
+        onDidFinish: @escaping @MainActor () -> Void,
+        onDidFail: @escaping @MainActor (Error) -> Void
+    ) {
         self.onDidFinish = onDidFinish
+        self.onDidFail = onDidFail
     }
     nonisolated func webView(_ webView: WKWebView, didFinish navigation: WKNavigation!) {
         MainActor.assumeIsolated { onDidFinish() }
     }
+    /// Provisional navigation = "the server / file URL didn't even start
+    /// loading" (404 on `file://`, missing index.html, DNS / sandbox
+    /// rejection). The WKError comes via `error`.
+    nonisolated func webView(
+        _ webView: WKWebView,
+        didFailProvisionalNavigation navigation: WKNavigation!,
+        withError error: Error
+    ) {
+        MainActor.assumeIsolated { onDidFail(error) }
+    }
+    /// Post-provisional navigation failure — the page started loading and
+    /// then errored (subresource 404 mid-stream, decode error after a 200).
+    nonisolated func webView(
+        _ webView: WKWebView,
+        didFail navigation: WKNavigation!,
+        withError error: Error
+    ) {
+        MainActor.assumeIsolated { onDidFail(error) }
+    }
 }
 
 // MARK: - Voice subsystem adapters (Plan 06-05)
diff --git a/App/Boot/BootHealthProbes.swift b/App/Boot/BootHealthProbes.swift
index bb32a38..3b5b44e 100644
--- a/App/Boot/BootHealthProbes.swift
+++ b/App/Boot/BootHealthProbes.swift
@@ -492,6 +492,14 @@ public struct WebviewBootHealthProbe: BootHealthProbe {
                 status: .failed(reason: "JS never acked hello — webview bundle missing or crashed at startup", severity: .critical),
                 evidence: "HandshakeState.timedOut after 2s"
             )
+        case .loadFailed(let reason):
+            // Audit-2026-05-12 S1 / #40 — bundle navigation failed before
+            // `didFinish` could fire. Same severity as `.timedOut`: the
+            // user sees no HUD until the bundle is rebuilt.
+            return ProbeOutcome(
+                status: .failed(reason: "webview bundle load failed: \(reason); rebuild webview bundle", severity: .critical),
+                evidence: "HandshakeState.loadFailed(\(reason))"
+            )
         }
     }
 }
diff --git a/App/Tests/AppTests/BridgeNavigationFailureTests.swift b/App/Tests/AppTests/BridgeNavigationFailureTests.swift
new file mode 100644
index 0000000..7c22ef9
--- /dev/null
+++ b/App/Tests/AppTests/BridgeNavigationFailureTests.swift
@@ -0,0 +1,169 @@
+import XCTest
+import AppKit
+import WebKit
+@testable import Jarvis
+@testable import Bus
+@testable import Config
+@testable import Keychain
+@testable import Shell
+
+/// Audit-2026-05-12 S1 / #40 regression tests:
+///
+/// `BridgeNavigationDelegate.didFail*` arms surface a HUD-native critical
+/// banner + transition the handshake state machine to `.loadFailed` so a
+/// missing/stale bundle is never a silent black HUD. Before this fix, the
+/// delegate only implemented `didFinish` — a 404 on the JS bundle (or any
+/// pre-mount JS error) left the handshake stuck in `.idle` forever and the
+/// 2s `HandshakeTiming.timeout` was never armed.
+@MainActor
+final class BridgeNavigationFailureTests: XCTestCase {
+    // MARK: - Fakes (mirror existing AppDelegateBusWiringTests pattern)
+
+    private struct FakeKeychain: KeychainStore {
+        let apiKeyStored: Bool
+        func set(_ value: String, for item: KeychainItem) throws {}
+        func get(_ item: KeychainItem) throws -> String {
+            guard apiKeyStored else { throw KeychainError.itemNotFound }
+            return "sk-ant-fake"
+        }
+        func delete(_ item: KeychainItem) throws {}
+    }
+
+    private struct FakeHIDProbe: HIDAccessProbe {
+        let granted: Bool
+        func requestListenEventAccess() -> Bool { granted }
+    }
+
+    private struct EntitlementYes: EntitlementGateProbe { func isVerified() -> Bool { true } }
+
+    private func makeSnapshots() -> (LaunchSnapshot, PerTurnSnapshot) {
+        let launchJSON = """
+        {"schemaVersion":1,"ollama":{"baseURL":"http://127.0.0.1:11434"},"applescript":{"confirmationRequired":true},"toolBlocklist":[],"confirmationPolicy":{"timeoutSeconds":60},"logging":{"fileLevel":"info","osLogLevel":"info"}}
+        """.data(using: .utf8)!
+        let perTurnJSON = """
+        {"schemaVersion":1,"provider":"anthropic","tts":{"tier":"tier1"},"stt":{"whisperKitFallback":false},"featureFlags":{}}
+        """.data(using: .utf8)!
+        return (
+            try! JSONDecoder().decode(LaunchSnapshot.self, from: launchJSON),
+            try! JSONDecoder().decode(PerTurnSnapshot.self, from: perTurnJSON)
+        )
+    }
+
+    private func cleanUp(_ delegate: AppDelegate) {
+        if let item = delegate.statusItem {
+            NSStatusBar.system.removeStatusItem(item)
+        }
+        delegate.wizardController?.close()
+    }
+
+    private func makeDelegate(apiKey: Bool = true) -> AppDelegate {
+        let delegate = AppDelegate()
+        delegate.entitlementProbe = EntitlementYes()
+        delegate.configLoader = { _ in self.makeSnapshots() }
+        delegate.configWriter = { _ in self.makeSnapshots() }
+        delegate.keychainStore = FakeKeychain(apiKeyStored: apiKey)
+        delegate.hidProbe = FakeHIDProbe(granted: true)
+        delegate.loggingBootstrap = {}
+        return delegate
+    }
+
+    // MARK: - Tests
+
+    /// `handleWebviewLoadFailure` transitions the bridge to `.loadFailed` and
+    /// enqueues a critical banner. Before this fix, a stale bundle reference
+    /// (e.g. `<script src="./assets/index-XXX.js">` 404) left the handshake
+    /// stuck in `.idle` forever — `startHandshake` only runs from
+    /// `didFinish`, and `didFinish` never fires when the page errors before
+    /// completing.
+    func test_handleWebviewLoadFailureTransitionsBridgeAndEnqueuesBanner() {
+        let delegate = makeDelegate()
+        delegate.applicationWillFinishLaunching(Notification(name: .init("t")))
+        guard let bridge = delegate.webviewBridge else {
+            XCTFail("WebviewBridge must be installed by installBus()")
+            cleanUp(delegate)
+            return
+        }
+        guard let banners = delegate.bannerCoordinator else {
+            XCTFail("BannerCoordinator must be installed before installBus()")
+            cleanUp(delegate)
+            return
+        }
+        XCTAssertNil(banners.currentBanner, "no banner before failure")
+
+        // Synthesize a representative WKWebView navigation error — domain +
+        // code mirror what WebKit emits for a missing file:// resource.
+        let error = NSError(
+            domain: "NSURLErrorDomain",
+            code: -1100, // NSURLErrorFileDoesNotExist
+            userInfo: [NSLocalizedDescriptionKey: "The requested file does not exist."]
+        )
+
+        delegate.handleWebviewLoadFailure(error)
+
+        // Bridge state must be terminal `.loadFailed`.
+        if case .loadFailed(let reason) = bridge.handshakeState {
+            XCTAssertTrue(reason.contains("NSURLErrorDomain"))
+            XCTAssertTrue(reason.contains("-1100"))
+        } else {
+            XCTFail("expected .loadFailed, got \(bridge.handshakeState)")
+        }
+
+        // A critical banner must be on screen.
+        XCTAssertEqual(banners.currentBanner?.id, "boot-health-critical-webview")
+        XCTAssertEqual(
+            banners.currentBanner?.priority,
+            1,
+            "webview load failure is critical-priority (1)"
+        )
+        XCTAssertEqual(
+            banners.currentBanner?.nonDismissible,
+            true,
+            "load-failure banner must be non-dismissible (user can't click away a black HUD)"
+        )
+
+        cleanUp(delegate)
+    }
+
+    /// `BridgeNavigationDelegate.didFailProvisionalNavigation` invokes the
+    /// `onDidFail` closure. Drives the protocol method directly with a
+    /// synthesized error to verify the arm exists and routes correctly.
+    func test_bridgeNavigationDelegateDidFailProvisionalRoutesToOnDidFail() {
+        var captured: Error?
+        let expectation = self.expectation(description: "onDidFail fires")
+        let delegate = BridgeNavigationDelegate(
+            onDidFinish: { XCTFail("didFinish must not fire on failure path") },
+            onDidFail: { error in
+                captured = error
+                expectation.fulfill()
+            }
+        )
+
+        let error = NSError(domain: "WebKitErrorDomain", code: 102, userInfo: nil)
+        let webView = WKWebView(frame: .zero)
+        delegate.webView(webView, didFailProvisionalNavigation: nil, withError: error)
+
+        wait(for: [expectation], timeout: 0.5)
+        XCTAssertEqual((captured as NSError?)?.code, 102)
+    }
+
+    /// `BridgeNavigationDelegate.didFail` (post-provisional) also routes to
+    /// `onDidFail` — separate arm but same closure target.
+    func test_bridgeNavigationDelegateDidFailRoutesToOnDidFail() {
+        var captured: Error?
+        let expectation = self.expectation(description: "onDidFail fires")
+        let delegate = BridgeNavigationDelegate(
+            onDidFinish: { XCTFail("didFinish must not fire on failure path") },
+            onDidFail: { error in
+                captured = error
+                expectation.fulfill()
+            }
+        )
+
+        let error = NSError(domain: "WebKitErrorDomain", code: 204, userInfo: nil)
+        let webView = WKWebView(frame: .zero)
+        delegate.webView(webView, didFail: nil, withError: error)
+
+        wait(for: [expectation], timeout: 0.5)
+        XCTAssertEqual((captured as NSError?)?.code, 204)
+    }
+}
diff --git a/packages/Bus/Sources/Bus/Handshake.swift b/packages/Bus/Sources/Bus/Handshake.swift
index f5e0553..bae1124 100644
--- a/packages/Bus/Sources/Bus/Handshake.swift
+++ b/packages/Bus/Sources/Bus/Handshake.swift
@@ -6,16 +6,25 @@ import Foundation
 ///   `.idle` → `.sentHello(deadline:)` → `.armed`
 ///                                    ↘  `.mismatched(swift:, js:)`
 ///                                    ↘  `.timedOut`
+///                                    ↘  `.loadFailed(reason:)`
 ///
-/// Once the state reaches `.armed`, `.mismatched`, or `.timedOut`, it does
-/// not move. Mismatch and timeout are terminal — the HUD bundle must be
-/// rebuilt.
+/// Once the state reaches `.armed`, `.mismatched`, `.timedOut`, or
+/// `.loadFailed`, it does not move. Mismatch, timeout, and load-failure are
+/// terminal — the HUD bundle must be rebuilt or the navigation error fixed.
+///
+/// `.loadFailed` covers the bundle-navigation failure path (audit-2026-05-12
+/// S1, issue #40): if `index.html`, the JS bundle, or any sub-resource
+/// 404s / fails to parse, `didFinish` never fires, so `startHandshake`'s 2s
+/// timeout is never armed. `BridgeNavigationDelegate.didFail*` arms route
+/// to `WebviewBridge.failHandshake(reason:)` which transitions to this
+/// state and surfaces the error to the user.
 public enum HandshakeState: Equatable, Sendable {
     case idle
     case sentHello(deadline: Date)
     case armed
     case mismatched(swift: String, js: String)
     case timedOut
+    case loadFailed(reason: String)
 }
 
 /// Timing parameters for the handshake. 2s is the RESEARCH §HUD-05 budget —
diff --git a/packages/Bus/Sources/Bus/WebviewBridge.swift b/packages/Bus/Sources/Bus/WebviewBridge.swift
index f24dc5b..f695613 100644
--- a/packages/Bus/Sources/Bus/WebviewBridge.swift
+++ b/packages/Bus/Sources/Bus/WebviewBridge.swift
@@ -141,6 +141,35 @@ public final class WebviewBridge: NSObject {
 
     // MARK: - Handshake surface
 
+    /// Audit-2026-05-12 S1 / #40 — surfaces a navigation-layer failure
+    /// (bundle 404, JS parse error before mount, etc.) where `didFinish`
+    /// will never fire and `startHandshake` would otherwise never run.
+    ///
+    /// Idempotent: only transitions on the first call (subsequent calls
+    /// no-op, matching `handleTimeout`'s idempotency guard). Cancels any
+    /// in-flight timeout Task. Routes through the same `alertPresenter`
+    /// surface as `.timedOut` and `.mismatched` so production wiring
+    /// (`TCCAlertService.presentHardBlock` + AppDelegate's banner
+    /// coordinator enqueue) lights up consistently across all three
+    /// terminal-failure paths.
+    public func failHandshake(reason: String) {
+        // Idempotent: once we've reached a terminal state, stay there.
+        switch handshakeState {
+        case .armed, .mismatched, .timedOut, .loadFailed:
+            return
+        case .idle, .sentHello:
+            break
+        }
+        timeoutTask?.cancel()
+        timeoutTask = nil
+        logger.critical("bus handshake load-failed: \(reason)")
+        handshakeState = .loadFailed(reason: reason)
+        alertPresenter(
+            "Jarvis HUD couldn't start",
+            "The HUD bundle failed to load: \(reason). Rebuild Jarvis from source."
+        )
+    }
+
     /// Transitions to `.sentHello`, schedules the 2s timeout, and sends the
     /// `hello` frame over the outbound path. Called by `AppDelegate` on
     /// `WKNavigationDelegate.webView(_:didFinish:)`.
diff --git a/packages/Bus/Tests/BusTests/HandshakeTests.swift b/packages/Bus/Tests/BusTests/HandshakeTests.swift
index fcbd9eb..6f636a5 100644
--- a/packages/Bus/Tests/BusTests/HandshakeTests.swift
+++ b/packages/Bus/Tests/BusTests/HandshakeTests.swift
@@ -103,6 +103,93 @@ final class HandshakeTests: XCTestCase {
         XCTAssertEqual(alerts.count, 0, "armed handshake must suppress timeout alert")
     }
 
+    // MARK: - Audit-2026-05-12 S1 / #40 — failHandshake(reason:)
+
+    /// `failHandshake` from `.sentHello` transitions to `.loadFailed`, cancels
+    /// the pending 2s timeout, and fires exactly one alert.
+    func test_failHandshakeTransitionsToLoadFailedAndAlerts() async {
+        let alerts = AlertCollector()
+        let bridge = makeBridge(alertCollector: alerts)
+
+        bridge.startHandshake()
+        bridge.failHandshake(reason: "bundle 404: assets/index-XYZ.js")
+
+        XCTAssertEqual(
+            bridge.handshakeState,
+            .loadFailed(reason: "bundle 404: assets/index-XYZ.js")
+        )
+        XCTAssertEqual(alerts.count, 1, "exactly one alert on load failure")
+        XCTAssertEqual(alerts.titles.first, "Jarvis HUD couldn't start")
+        XCTAssertTrue(
+            alerts.bodies.first?.contains("assets/index-XYZ.js") ?? false,
+            "alert body should mention the underlying reason"
+        )
+
+        // The cancelled timeout must not fire — wait past the 2s deadline
+        // and confirm no second alert lands.
+        try? await Task.sleep(for: .milliseconds(2100))
+        XCTAssertEqual(
+            alerts.count,
+            1,
+            "cancelled timeout must not surface a second alert"
+        )
+        if case .loadFailed = bridge.handshakeState {
+            // ok
+        } else {
+            XCTFail("state must remain .loadFailed past 2s deadline, got \(bridge.handshakeState)")
+        }
+    }
+
+    /// `failHandshake` from `.idle` (before `startHandshake`) is still valid —
+    /// the navigation can fail before `didFinish` would have been called.
+    func test_failHandshakeFromIdleTransitions() {
+        let alerts = AlertCollector()
+        let bridge = makeBridge(alertCollector: alerts)
+
+        XCTAssertEqual(bridge.handshakeState, .idle)
+        bridge.failHandshake(reason: "provisional nav failed: -1100")
+
+        XCTAssertEqual(
+            bridge.handshakeState,
+            .loadFailed(reason: "provisional nav failed: -1100")
+        )
+        XCTAssertEqual(alerts.count, 1)
+    }
+
+    /// `failHandshake` is idempotent — once in a terminal state, calling
+    /// again no-ops (no second alert, no state change).
+    func test_failHandshakeIsIdempotent() {
+        let alerts = AlertCollector()
+        let bridge = makeBridge(alertCollector: alerts)
+
+        bridge.failHandshake(reason: "first")
+        bridge.failHandshake(reason: "second")
+
+        XCTAssertEqual(
+            bridge.handshakeState,
+            .loadFailed(reason: "first"),
+            "subsequent failHandshake calls must not overwrite the first reason"
+        )
+        XCTAssertEqual(alerts.count, 1, "subsequent failHandshake calls must not re-alert")
+    }
+
+    /// `failHandshake` after `.armed` no-ops — once the handshake succeeds,
+    /// a late navigation-failure callback (which would normally never fire)
+    /// must not transition out of `.armed`.
+    func test_failHandshakeAfterArmedNoOps() {
+        let alerts = AlertCollector()
+        let bridge = makeBridge(alertCollector: alerts)
+
+        bridge.startHandshake()
+        bridge.handleHelloAck(BUS_PROTOCOL_VERSION)
+        XCTAssertEqual(bridge.handshakeState, .armed)
+
+        bridge.failHandshake(reason: "late didFail")
+
+        XCTAssertEqual(bridge.handshakeState, .armed, "armed handshake must not regress to .loadFailed")
+        XCTAssertEqual(alerts.count, 0)
+    }
+
     func test_startHandshakeMovesToSentHello() {
         let alerts = AlertCollector()
         let bridge = makeBridge(alertCollector: alerts)
-- 
2.54.0


From 2bfe53f475ffa2ab51fcda5be87f4c55e6285da0 Mon Sep 17 00:00:00 2001
From: James Maes <james@kof22.com>
Date: Tue, 12 May 2026 16:30:22 -0500
Subject: [PATCH 2/2] =?UTF-8?q?fix(hud):=20fan=20HudState=20emit=20to=20Me?=
 =?UTF-8?q?nuBarIconController=20so=20icon=20animates=20per=20state=20?=
 =?UTF-8?q?=E2=80=94=20closes=20#41?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`MenuBarIconController.transition(to:)` shipped with a full per-state
CABasicAnimation surface (breath / rotate / shimmer / glow / idle) and
was exhaustively unit-tested, but no production code ever called it.
`HudStateCoordinator`'s emit closure only fanned state changes to
`WebviewBridge.send(.hudState(_:))` — the menu-bar icon stayed in its
default static state for the entire app lifetime regardless of
`.listening` / `.thinking` / `.speaking` activity. Only `applyHealth(_:)`
(Round 4 boot-health tint) was wired.

This expands the emit closure in `installBus()` to ALSO call
`menuBarController?.transition(to: appState)` on every distinct resolved
HudState. The bus dispatch stays in a `Task { @MainActor in … }` (because
`bridge.send` is async); the icon transition is a direct main-actor call
(no await needed). `[weak bridge, weak self]` preserves the existing
retain-cycle hygiene.

Not a HUD-08 single-writer violation: `transition(to:)` writes the
icon's `currentState`, not `BusOutbound.hudState`. The single-writer
invariant covers the `.hudState(...)` constructor surface, not arbitrary
subscribers. `scripts/check-single-writer-hudstate.sh` continues to pass.

Test:
  - `MenuBarIconStateTransitionTests` (App package, new file): drives
    the live coordinator via the AppDelegate's retained
    `dormantAgentContinuation`, arms the handshake to promote the
    coordinator off `.booting`, yields `.thinking → .speaking → .idle`,
    asserts `menuBarController.state` advances on each transition.

Refs audit-2026-05-12 bus-hud-audit.md §S1 (MenuBarIconController).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 App/AppDelegate.swift                         |  21 ++-
 .../MenuBarIconStateTransitionTests.swift     | 135 ++++++++++++++++++
 2 files changed, 152 insertions(+), 4 deletions(-)
 create mode 100644 App/Tests/AppTests/MenuBarIconStateTransitionTests.swift

diff --git a/App/AppDelegate.swift b/App/AppDelegate.swift
index 5cf80a4..9028411 100644
--- a/App/AppDelegate.swift
+++ b/App/AppDelegate.swift
@@ -2733,11 +2733,24 @@ final class AppDelegate: NSObject, NSApplicationDelegate {
         // closure bridges App.HudState → Bus.HudState (rawValue round-trip)
         // and dispatches to the webview bridge on the MainActor. `[weak
         // bridge]` avoids a retain cycle with `self` via the bridge.
-        let coordinator = HudStateCoordinator(emit: { [weak bridge] appState in
-            guard let bridge else { return }
-            Task { @MainActor in
-                try? await bridge.send(.hudState(busHudState(from: appState)))
+        //
+        // Audit-2026-05-12 S1 / #41 — the emit closure ALSO fans state to
+        // `MenuBarIconController.transition(to:)` so the menu-bar icon
+        // animates per agent state (breath/rotate/shimmer/glow). Before
+        // this fan-out, `transition(to:)` was production-dead: the method
+        // existed and was unit-tested, but no production call site invoked
+        // it, so the icon stayed in `.idle` for the whole app lifetime
+        // regardless of agent activity. This is NOT a HUD-08 single-writer
+        // violation — `transition(to:)` writes the icon's `currentState`,
+        // not `BusOutbound.hudState`, which has only one constructor
+        // (`bridge.send(.hudState(...))` below).
+        let coordinator = HudStateCoordinator(emit: { [weak bridge, weak self] appState in
+            if let bridge {
+                Task { @MainActor in
+                    try? await bridge.send(.hudState(busHudState(from: appState)))
+                }
             }
+            self?.menuBarController?.transition(to: appState)
         })
 
         // Dormant producer streams. Phase 4 replaces `agentStream` with the
diff --git a/App/Tests/AppTests/MenuBarIconStateTransitionTests.swift b/App/Tests/AppTests/MenuBarIconStateTransitionTests.swift
new file mode 100644
index 0000000..4c59097
--- /dev/null
+++ b/App/Tests/AppTests/MenuBarIconStateTransitionTests.swift
@@ -0,0 +1,135 @@
+import XCTest
+import AppKit
+import AgentCore
+@testable import Jarvis
+@testable import Bus
+@testable import Config
+@testable import Keychain
+@testable import Shell
+
+/// Audit-2026-05-12 S1 / #41 regression tests:
+///
+/// `MenuBarIconController.transition(to:)` is wired through the
+/// `HudStateCoordinator` emit closure that drives the bus, so the menu-bar
+/// icon animates per agent state (breath/rotate/shimmer/glow). Before this
+/// fix the method existed and was unit-tested but had zero production call
+/// sites — the icon stayed in `.idle` for the whole app lifetime regardless
+/// of agent activity.
+///
+/// This is NOT a HUD-08 single-writer violation. `transition(to:)` writes
+/// the icon's `currentState`, not `BusOutbound.hudState` (whose sole
+/// constructor remains the coordinator's existing `bridge.send(.hudState(...))`
+/// call). `scripts/check-single-writer-hudstate.sh` covers the invariant.
+@MainActor
+final class MenuBarIconStateTransitionTests: XCTestCase {
+    // MARK: - Fakes (mirror existing AppDelegateBusWiringTests pattern)
+
+    private struct FakeKeychain: KeychainStore {
+        let apiKeyStored: Bool
+        func set(_ value: String, for item: KeychainItem) throws {}
+        func get(_ item: KeychainItem) throws -> String {
+            guard apiKeyStored else { throw KeychainError.itemNotFound }
+            return "sk-ant-fake"
+        }
+        func delete(_ item: KeychainItem) throws {}
+    }
+
+    private struct FakeHIDProbe: HIDAccessProbe {
+        let granted: Bool
+        func requestListenEventAccess() -> Bool { granted }
+    }
+
+    private struct EntitlementYes: EntitlementGateProbe { func isVerified() -> Bool { true } }
+
+    private func makeSnapshots() -> (LaunchSnapshot, PerTurnSnapshot) {
+        let launchJSON = """
+        {"schemaVersion":1,"ollama":{"baseURL":"http://127.0.0.1:11434"},"applescript":{"confirmationRequired":true},"toolBlocklist":[],"confirmationPolicy":{"timeoutSeconds":60},"logging":{"fileLevel":"info","osLogLevel":"info"}}
+        """.data(using: .utf8)!
+        let perTurnJSON = """
+        {"schemaVersion":1,"provider":"anthropic","tts":{"tier":"tier1"},"stt":{"whisperKitFallback":false},"featureFlags":{}}
+        """.data(using: .utf8)!
+        return (
+            try! JSONDecoder().decode(LaunchSnapshot.self, from: launchJSON),
+            try! JSONDecoder().decode(PerTurnSnapshot.self, from: perTurnJSON)
+        )
+    }
+
+    private func cleanUp(_ delegate: AppDelegate) {
+        if let item = delegate.statusItem {
+            NSStatusBar.system.removeStatusItem(item)
+        }
+        delegate.wizardController?.close()
+    }
+
+    private func makeDelegate(apiKey: Bool = true) -> AppDelegate {
+        let delegate = AppDelegate()
+        delegate.entitlementProbe = EntitlementYes()
+        delegate.configLoader = { _ in self.makeSnapshots() }
+        delegate.configWriter = { _ in self.makeSnapshots() }
+        delegate.keychainStore = FakeKeychain(apiKeyStored: apiKey)
+        delegate.hidProbe = FakeHIDProbe(granted: true)
+        delegate.loggingBootstrap = {}
+        return delegate
+    }
+
+    /// The `HudStateCoordinator` emit closure constructed in `installBus()`
+    /// fans state changes to BOTH the bus AND `menuBarController.transition(to:)`.
+    /// Drives the dormant agent-intent continuation through the live
+    /// coordinator and asserts `menuBarController.state` advances.
+    func test_menuBarIconAnimatesOnAgentStateChange() async throws {
+        let delegate = makeDelegate()
+        delegate.applicationWillFinishLaunching(Notification(name: .init("t")))
+        defer { cleanUp(delegate) }
+
+        guard let coordinator = delegate.hudStateCoordinator else {
+            XCTFail("HudStateCoordinator must be installed")
+            return
+        }
+        guard let icon = delegate.menuBarController else {
+            XCTFail("MenuBarIconController must be installed")
+            return
+        }
+        guard let agentCont = delegate.dormantAgentContinuation else {
+            XCTFail("dormantAgentContinuation must be retained")
+            return
+        }
+
+        // Arm the handshake so the coordinator promotes off `.booting` —
+        // otherwise the coordinator pins everything to `.booting` per the
+        // RESEARCH Open Q #4 boot gate, masking the agent intent.
+        delegate.webviewBridge?.handleHelloAck(BUS_PROTOCOL_VERSION)
+        try await Task.sleep(for: .milliseconds(60))
+        XCTAssertEqual(
+            coordinator.currentStateForTests,
+            .idle,
+            "coordinator must promote off .booting after handshake arms"
+        )
+
+        // Drive a sequence of agent intents and assert the icon follows.
+        // The icon was initialized to `.idle`; after each intent, the
+        // coordinator's emit closure routes to `transition(to:)`.
+        agentCont.yield(.thinking)
+        try await Task.sleep(for: .milliseconds(80))
+        XCTAssertEqual(
+            icon.state,
+            .thinking,
+            "menu-bar icon must reach .thinking when AgentHudIntent.thinking fires"
+        )
+
+        agentCont.yield(.speaking)
+        try await Task.sleep(for: .milliseconds(80))
+        XCTAssertEqual(
+            icon.state,
+            .speaking,
+            "menu-bar icon must reach .speaking when AgentHudIntent.speaking fires"
+        )
+
+        agentCont.yield(.idle)
+        try await Task.sleep(for: .milliseconds(80))
+        XCTAssertEqual(
+            icon.state,
+            .idle,
+            "menu-bar icon must return to .idle when AgentHudIntent.idle fires"
+        )
+    }
+}
-- 
2.54.0