fix(chat): keep in-flight answers alive across in-app view switches

Root cause (owner repro, verified in a real browser 2026-09-06): the
five navbar views (Chat, RAG, Sources, Tuning, History) were separate
HTML documents, so a navbar click was a REAL cross-document navigation
— the chat page unloaded, the in-flight SSE fetch was aborted, and the
phase-48 teardown (app/api/chat.py `finally`, "chat: turn cancelled")
stopped the model. Observed: send question -> click RAG mid-stream ->
click Chat -> the answer never finished: no `query_log` row, and on
return a dangling question with no brain record (the pre-token pagehide
partial persist skips because `acc` is empty).

Phase-48 LOCKED-DECISION REFINEMENT (owner-confirmed 2026-09-06,
flagged per AGENTS.md rule 3, not silently deviated): "real navigation
cancels the fetch" now means LEAVING THE APP — tab close,
external/other-document navigation, the Stop button. In-app navbar
switches are client-side view switches and no longer cancel.

Fix — Option A (SPA shell), chosen over B (Service Worker owns the
stream) and C (server-side turn registry + resume):
- frontend/index.html is the shell: ONE `<main id="main">` holds the
  five `<section class="view">` blocks; hidden views carry BOTH
  `hidden` and `inert` (WCAG — no focus/keyboard traversal). The
  shared header, the single `doc-modal-*` skeleton, and the
  `#app-version` footer each exist exactly once; the per-view copies
  from the four folded pages are dropped.
- New frontend/assets/router.js (vanilla module — no framework, no
  bundler, No-CDN rule intact): lazy-imports a view module on FIRST
  show only (mount-once, hide-forever — the chat view's in-flight SSE
  reader persists across switches; that persistence IS the fix);
  intercepts same-shell navbar links with preventDefault +
  history.pushState (never a document load); handles popstate; single
  writer of `.nav-link` active state (is-active + aria-current),
  document.title, and the per-view meta description (values carried
  over from the old pages' heads, brand-resolved at write time).
- Each folded page's JS becomes `export async function mount(root)` —
  root-scoped queries; `initSharedHeader()` dropped (the header boots
  once in the shell via the chat module; the admin flag comes from the
  same cached `fetchIsAdmin()` promise — zero extra requests).
- app/main.py: a small list-driven route factory serves the shell for
  /tuning.html, /sources.html, /git-sources.html, /history.html —
  registered AFTER the API routers and BEFORE the static catch-all
  (routes-first). The phase-33 caching middleware applies no-cache +
  `?v=` rewriting unchanged; app/core/caching.py needed NO change
  (the view paths did not change — pinned by the integration tests).
- The four old view .html files are DELETED (one source of truth);
  deep links to the old URLs keep working (the router picks the view
  from the pathname); `/?chat=<id>` is unaffected; the Containerfile
  bundles router.js (inlining the lazy view modules) and drops the
  folded page files.
- app/schemas.py: HistoryTurn.text cap 4000 -> 32000 — the shell
  keeps long saved answers in the chat, and the old cap (stricter than
  the 24_000-char total history budget) 422-rejected any second turn
  in such a chat (found by the phase-42 E2E suite on the shell).

Boundaries: login.html, shared.html, doc-edit.html, document.html
REMAIN separate documents (flow pages, not navbar tabs); a mid-stream
navigation to doc-edit/document.html still cancels per phase 48
(follow-up candidate, out of scope). The SSE API is unchanged. Real
departures still cancel the turn — phase 48 intact (pinned by
tests/e2e/test_stop_generation.py, unchanged, and by the new suite's
real-departure control).

Tests:
- Phase-20 suite REWRITTEN to the new semantics
  (tests/e2e/test_sources_midstream_bug.py): a navbar switch no longer
  cancels — the stream survives the switch and the FULL answer
  settles; the pagehide partial persist REMAINS for real departures
  (the partial's exact shape — first streamed chunk prefix, no done
  metadata — is still pinned there).
- NEW story suite tests/e2e/test_nav_switch_keeps_stream.py (mock
  LLM): the owner repro (send -> RAG mid-stream -> Chat: window
  sentinel survives = same document, FULL answer, exactly one brain
  turn in bor.chat.v1, exactly one settled query_log row, auto-saved
  row matches) + the same mid-stream switch against the other three
  views + the real-departure-still-cancels control + the no-switch
  baseline.
- tests/unit/test_frontend_router.py: source-level pins of the router
  invariants (click interceptor targets ONLY same-shell view paths,
  pushState-only switches, mount-once guard, hidden+inert pair,
  single-writer active state/title); shell-route integration tests
  (each folded path serves the shell with no-cache + `?v=` body; a
  non-view path still 404s); the file-reading unit pins re-pointed at
  the shell (the four view files are gone — the shell is the source
  of truth).

Verification (this commit): full suite green — 1565 unit+integration
tests, app/ coverage 99% (>90% floor); ruff + pyright clean; the
phase's E2E suites green in isolation (house protocol, AGENTS.md rule
9). Owner repro verified in a real browser against the real LLM
(dev server :8010, headful Chromium): "tell me about everquest" ->
RAG mid-stream -> Chat — the answer completed with one brain bubble
and no error banner, `query_log` gained exactly one settled row
(deflected=True: the dev KB holds no EverQuest docs — the settle, not
the topic, is the proof), zero "chat: turn cancelled" lines for that
turn; the control (real navigation to /shared.html mid-stream) still
cancelled (no settled row, the cancel line logged, the partial
persisted on return). Screenshots: .agents/screenshots/76_manual_*.

Phase 76 (76_spa_nav_shell) complete — moved to
.agents/phases/complete/.

app/main.py

@@ -18,6 +18,7 @@ from pathlib import Path
 from fastapi import FastAPI
 from fastapi.staticfiles import StaticFiles
 from starlette.middleware.sessions import SessionMiddleware
+from starlette.responses import FileResponse
 
 from app.api.auth import router as auth_router
 from app.api.chat import router as chat_router
@@ -51,6 +52,39 @@ settings = get_settings()
 logger = logging.getLogger("app")
 
 
+def _shell_routes(app: FastAPI, static_dir: Path, paths: tuple[str, ...]) -> None:
+    """Phase 76: the navbar views are views of ONE shell document.
+
+    Every registered path serves ``frontend/index.html`` (the shell)
+    instead of its own page file: the client-side router
+    (``frontend/assets/router.js``) reads ``location.pathname`` at boot
+    and shows the matching view, so a direct load of e.g.
+    ``/tuning.html`` deep-links to the Tuning view. Registered AFTER the
+    API routers and BEFORE the static catch-all mount (routes-first),
+    so the phase-33 caching middleware — which wraps the whole app and
+    already lists every one of these paths in ``HTML_PAGES`` — applies
+    the no-cache + ``?v=<token>`` contract to the response untouched.
+    The list is driven by the caller: tasks 02/03 fold the remaining
+    views in by extending the tuple (task 03 lands History — all four
+    non-chat navbar views are in; the old per-view ``.html`` files are
+    deleted in the same change as their shell route lands — one source
+    of truth).
+    """
+    shell_file = static_dir / "index.html"
+
+    async def _shell_view() -> FileResponse:
+        return FileResponse(shell_file, media_type="text/html")
+
+    for path in paths:
+        # GET (document loads, the browser path) + HEAD — the pre-fold
+        # static file answered both, so the shell route keeps that
+        # method parity (the body is the same FileResponse; HEAD ships
+        # headers only).
+        app.api_route(
+            path, methods=["GET", "HEAD"], include_in_schema=False
+        )(_shell_view)
+
+
 def create_app() -> FastAPI:
     # Fail loud BEFORE serving anything (phase 16): missing
     # BOR_ADMIN_PASSWORD / BOR_SESSION_SECRET raises at boot, naming the
@@ -98,6 +132,20 @@ def create_app() -> FastAPI:
 
     static_dir = Path(settings.static_dir).resolve()
     if static_dir.is_dir():
+        # Phase 76: the folded navbar views serve the shell — the
+        # router picks the view from the pathname. Task 01 landed
+        # Tuning; task 02 folds RAG + Sources; task 03 lands History
+        # (list-driven — all four non-chat navbar views are in).
+        _shell_routes(
+            app,
+            static_dir,
+            (
+                "/tuning.html",
+                "/sources.html",
+                "/git-sources.html",
+                "/history.html",
+            ),
+        )
         app.mount("/", StaticFiles(directory=static_dir, html=True), name="static")
     else:
         logger.warning("static dir %s not found — serving API only", static_dir)

app/schemas.py

@@ -40,16 +40,20 @@ class HistoryTurn(BaseModel):
     ``thinking`` travels to the model as ``reasoning_content`` on the
     assistant message (the wire convention :mod:`app.rag.llm` already
     documents for the response side) — only when non-empty (A4).
-    ``text`` mirrors :attr:`ChatMessage.text`'s answer shape; the
-    thinking cap is looser (scratchpads run longer than answers). These
-    are boundary sanity caps only — the real trimming budget is the
-    settings pair ``history_max_turns`` / ``history_max_chars``
-    (``app.config``, A3: a capped-out turn is dropped whole, never
-    truncated).
+    ``text`` mirrors :attr:`ChatMessage.text`'s answer shape; long
+    answers (and the scratchpads that ride along as ``thinking``) both
+    run to tens of kilobytes of text, so both share the same loose
+    boundary cap. These are boundary sanity caps only — the real
+    trimming budget is the settings pair ``history_max_turns`` /
+    ``history_max_chars`` (``app.config``, A3: a capped-out turn is
+    dropped whole, never truncated). The old 4000-char text cap was
+    stricter than the 24_000-char default total budget and rejected
+    any second turn in a chat whose history held a long answer (422 —
+    found by the phase-42 E2E suite on the phase-76 shell).
     """
 
     who: Literal["user", "brain"]
-    text: str = Field(min_length=1, max_length=4000)
+    text: str = Field(min_length=1, max_length=32_000)
     thinking: str | None = Field(default=None, max_length=32000)