feat(windows): support full host deployment

.adr/0001-one-managed-front-door.md

@@ -0,0 +1,81 @@
+# 0001 — Collie manages exactly one front door
+
+- **Status:** Accepted
+- **Date:** 2026-07-27
+- **Shipped in:** 0.16.0
+- **Trail:** [PR #26](https://github.com/AltanS/collie/pull/26) (declined,
+  [reasoning](https://github.com/AltanS/collie/pull/26#issuecomment-5085567630)) ·
+  [PR #36](https://github.com/AltanS/collie/pull/36) (what we kept from it)
+
+## Context
+
+Collie is remote shell access. Whatever sits in front of the loopback bridge is the only thing
+between a stranger and a terminal running as you, so "which front door" is a security question
+before it is a convenience one.
+
+**The bridge is already tunnel-agnostic.** Its entire Tailscale coupling is *one* line —
+`req.headers.get("tailscale-user-login")` in `bridge/server.ts`. Everything else is a convenience in
+`scripts/collie-ctl.sh` and the README's voice. The bridge binds loopback, speaks plain HTTP, and
+gates on `Host`, `Origin`, and two optional headers, one of which (`COLLIE_DEVICE_HEADER`) is
+deliberately vendor-neutral.
+
+PR #26 proposed a **second managed front door**: `COLLIE_FRONT_DOOR=tailscale|netbird|proxy`, a
+supervised `netbird expose` sidecar with its own systemd unit and teardown, and config plumbing for
+NetBird's auth flags. 1441 additions across 12 files. The work was careful, and it raised a fair
+question — is Collie too tied to Tailscale, and are non-Tailscale users being hindered?
+
+Three things settled it, each checked rather than assumed:
+
+1. **Nobody was blocked.** `COLLIE_SKIP_SERVE=1` plus `netbird expose 8787` *is* the whole
+   integration. What the PR added on top was supervision and teardown of that one command — the same
+   thing Variant C already, deliberately, declines to do for anyone's Caddy.
+2. **We would have been shipping blind.** NetBird isn't installed on the deployment host and there's
+   no CI for it, so its CLI contract — flag names, the v0.66 floor, what `expose` actually publishes
+   — would have been maintained by reading a PR description rather than by anything that runs.
+3. **Managing someone else's authenticated process means owning their credentials.** The PR
+   demonstrated the cost rather than hypothesising it: the generated runner passed `--with-pin` and
+   `--with-password` as command-line arguments, so `ps -eo args` and `/proc/<pid>/cmdline` (mode
+   `444`) handed them to any local user.
+
+And the precedent doesn't scale. Cloudflare Tunnel, ZeroTier, Twingate and Nebula all have equal
+claim, each with a different CLI and auth model, all as `case` branches in one bash script. That is a
+plugin-shaped problem being solved in the wrong shape.
+
+## Decision
+
+**Collie manages exactly one front door: `tailscale serve`.**
+
+We own its lifecycle end to end — `collie-ctl.sh` publishes it, records the mapping in
+`<config-dir>/tailscale-managed-handler`, and only ever tears down a mapping still matching that
+record.
+
+**Every other tunnel is `COLLIE_SKIP_SERVE=1` plus [DEPLOYMENT.md Variant
+E](../DEPLOYMENT.md#variant-e--any-other-mesh-or-tunnel-netbird-zerotier-cloudflare-tunnel).** The
+operator owns the ingress; Collie publishes nothing, supervises nothing, and tears down nothing.
+
+The criterion is not popularity or quality. It is: **we manage only what we run and can test.**
+`tailscale serve` is on the deployment host, so a regression surfaces the same day.
+
+## Consequences
+
+**Accepted costs.** Non-Tailscale operators supervise their own tunnel — no sidecar unit from us, and
+`uninstall` won't remove it. That is exactly what Variant C has always promised for a reverse proxy,
+so it is a consistency, not a new gap.
+
+**What we keep owning.** The ownership tracking extracted from #26 (0.16.0) makes the one managed
+mapping precise in both directions: publishing refuses to replace a root mount we don't own, and
+teardown refuses to remove one that was replaced out from under us. A blind
+`tailscale serve --https=443 off` could previously unpublish a mapping Collie never created.
+
+**Documentation carries the load instead of code.** Variant E covers NetBird, ZeroTier, Cloudflare
+Tunnel and anything not yet invented, for zero runtime surface. When the honest fix for "users feel
+excluded" is a doc section, that is the fix.
+
+**The funnel prohibition generalises.** "Never `tailscale funnel`" was never about Tailscale; it is
+about reachability. Any tunnel offering a public URL inherits it, and auth in front of a public URL
+is not a substitute for not having one. A shared PIN guarding a root shell is a root password.
+
+**What would justify revisiting.** If the deployment host itself moves to another mesh, that mesh
+becomes testable and its front door becomes ownable. The rule that survives is *exactly one managed
+front door* — not one per vendor. Adding a second, whatever the vendor, means maintaining a CLI
+contract we cannot exercise, and this ADR should be superseded rather than quietly ignored.

.adr/0002-invert-the-light-terminal-mirror.md

@@ -0,0 +1,156 @@
+# 0002 — The light terminal mirror is inverted, not re-themed
+
+- **Status:** Accepted
+- **Date:** 2026-07-28 (revised 2026-07-29)
+- **Shipped in:** _(set at the release commit)_
+- **Trail:** every figure is measured. Colour-form counts come from live panes read through the
+  production path (`pane.read` → `/api/pane/:id`); contrast is rasterized through a canvas to
+  resolve `oklch()`/`light-dark()` and composited against the real ancestor stack.
+
+## Context
+
+The obvious light mirror is a light ANSI palette: define `--ansi-0…15` twice, emit `var(--ansi-N)`
+from `lib/ansi.ts`, let CSS swap them. This work carried that design for most of its life, built
+and tested, before anyone measured whether it would matter.
+
+**Only one of the three colour forms is themeable, and it is the rare one:**
+
+| form | meaning | redirectable by a palette? |
+| --- | --- | --- |
+| `38;2;r;g;b` | an absolute sRGB value | **no** |
+| `38;5;n`, n ≥ 16 | the 6×6×6 cube / greyscale ramp | **no** |
+| `30–37`, `90–97`, `38;5;n` n < 16 | one of the 16 palette slots | **yes** |
+
+Both spellings in that third row are the same slot — `31m` and `38;5;1` — and must be counted
+together. An earlier revision of this ADR tabulated all of `38;5` as "256-colour", hiding palette
+slots inside the unthemeable cube and making the measurement blind to the one harness that uses
+them.
+
+**What agents emit**, per harness, TUI output only (shell prompt and MOTD excluded):
+
+| harness | truecolor | 256-cube | **themeable** |
+| --- | --- | --- | --- |
+| opencode | **100%** (508 seqs) | 0% | **0%** |
+| pi | 89% | 5% | 5% |
+| claude | 79% | 20% | 1% |
+| codex | 7% | 34% | **59%** |
+
+For three of four, truecolor dominates — and truecolor names an absolute value with no slot to
+redirect. Codex is the exception; see the Decision.
+
+**Absolute values authored for black are unreadable on white.** Of 13 distinct colours in a real
+pane, eight fall below 3:1 on white — including a `●` at **1.0:1** and Monokai's foreground
+`#f8f8f2` at **1.07:1**. This is faithful — the same agent looks equally bad in a real light
+terminal — but the mirror is the app's primary reading surface, so fidelity is not the goal.
+
+Two other exits, both rejected for losing the syntax highlighting that makes output scannable:
+keeping the mirror permanently dark (what an IDE does, but it leaves a dark slab in a light app),
+and clamping absolute colours to a luminance floor (an arbitrary mapping that misrepresents what
+the program emitted).
+
+## Decision
+
+**Render the mirror in dark space under every theme, and invert it in light.** The `<pre>` carries
+`filter: invert(1) hue-rotate(180deg)`, reset to `none` under the `dark:` variant. The `hue-rotate`
+is what makes this more than a negative: it approximately restores hue after inversion flips
+lightness, so green stays green and syntax highlighting survives.
+
+Three rules follow, all load-bearing:
+
+1. **Everything inside the `<pre>` is authored for a dark ground** — palette, find-match highlight,
+   muted rule glyphs. A `dark:` variant inside the mirror is a bug: it tracks the root theme, which
+   is backwards in inverted space.
+
+2. **Colours inside the `<pre>` are written as literals — a convention, not a constraint.**
+   `color-scheme: dark` on the element *does* flip an inherited `light-dark()` token; resolution is
+   element-scoped, per spec (verified in Chromium: with the root pinned light, `--muted-foreground`
+   resolves to its light half outside the `<pre>` and its dark half inside). The literals here are
+   byte-exact matches for those dark halves, so either would render identically. Literals win
+   because they sit beside truecolor nothing can re-theme, and they say at the point of use that
+   the value is deliberately theme-independent. What matters is that the mirror does not mix the
+   two.
+
+3. **The filter is scoped to the `<pre>` alone.** The interactive blocks (prompt-select, wizard,
+   preview, multi-select) are siblings, not children, so they keep normal app theming.
+
+`--ansi-0…15` therefore has **one** set of values, the dark one. `lib/ansi.ts` still emits
+`var(--ansi-N)`: the variables remain the seam where indexed colour is defined once, and both
+spellings route through them.
+
+### Why codex does not reopen this
+
+Codex is the one harness drawing its chrome from themeable slots, and the one that asks the
+terminal what background it is on (`OSC 10`/`OSC 11`). That looks like an argument for re-theming.
+It is not: **herdr answers neither query, so codex falls back to dark** — and Collie could not
+answer anyway, since it reads a rendered buffer downstream of the PTY. Measurements and
+consequences in [`HERDR_API.md`](../HERDR_API.md).
+
+## Consequences
+
+Same pane, light against dark, sampling rendered pixels:
+
+| | background | min | median | max |
+| --- | --- | --- | --- | --- |
+| dark (unchanged) | `#0a0a0a` | 1.34 | 7.46 | 21.0 |
+| light (inverted) | `#f5f5f5` | 1.43 | 6.73 | 18.69 |
+
+Light tracks dark almost exactly — it inherits whatever readability the agent designed for instead
+of fighting it. (Sub-2 values are antialiasing edges, present in both.)
+
+What it costs:
+
+- **Colours are approximations.** `hue-rotate` is a linear matrix, not a true hue rotation, so
+  saturated colours shift. The mirror shows a palette *interpreted*, not reproduced.
+- **Diffs and inverse-video become dark slabs in light.** Legibility survives; only visual weight
+  inverts. Greying them is worse.
+- **Unmeasured scroll cost.** A CSS filter over a `<pre>` running to thousands of lines has not been
+  profiled on a phone.
+- **A trap for contributors.** Every instinct — use the token, add a `dark:` variant — is wrong
+  inside the `<pre>`, and wrong in a way that type-checks and often passes a computed-style test.
+  `components/ansi-output.test.tsx` guards rules 1 and 2.
+
+  The sharpest edge is **cancelling the filter**, which the find highlight does so its yellow isn't
+  reinterpreted as brown. Re-applying `invert + hue-rotate` cancels it — but only for colours the
+  element sets *itself*. The current match survives because `text-black` pins its text (black →
+  invert → white → invert → black). The same cancellation on a non-current match, which sets no
+  text colour, sent its *inherited* text light → dark → light: invisible on its own highlight. It
+  looked symmetrical and was not. **Cancel the filter only on an element that fully specifies both
+  its foreground and its background.**
+
+### Known limitation: an agent on a light theme
+
+The agent's own theme travels **as content, not metadata**. Claude Code under `theme: light` emits
+the same 75 sequences and 16 distinct colours as under `theme: dark`, values inverted (foreground
+`#333333` rather than `#f8f8f2`). Nothing in the chain carries a theme *field*, so Collie cannot
+detect which is in use — and such a pane is unreadable in **both** Collie themes (1.57:1 dark,
+1.47:1 light).
+
+**Pre-existing**: the shipped dark-only mirror fails it identically. Recorded because the fix, if
+wanted, is a per-pane "don't invert this one" — so any storage added for mirror preferences should
+be keyed to let that layer on later.
+
+### Alternatives closed off
+
+- **A light ANSI palette.** Reaches 0–5% of what three of four harnesses emit. The set was actually
+  built — VS Code's light terminal palette, verified against upstream (including catching that
+  `ansiGreen` moved from `#00BC00` to `#107C10`) — and is in the git history if the premise changes.
+- **Set the agent to a light theme and don't invert.** Strictly *more* faithful: colours authored
+  for white rather than negated onto it. Rejected only because Collie cannot detect the agent's
+  theme, so it cannot know when to suppress the filter. Revisit alongside a per-pane override or a
+  reliable detection heuristic.
+- **Per-harness colour maps** (translate claude's dark palette to its light one). Needs a table per
+  harness, per theme, per release; breaks silently when a harness retunes a colour; and cannot cover
+  output from the tools and programs an agent runs, which is in no table. If per-harness knowledge
+  is ever wired in, the payload should be **one bit** — "authored for dark/light" — not a colour
+  map. One bit is all the mirror needs.
+
+**What would justify revisiting:**
+
+- **A measured codex real-output profile showing majority palette.** The 59% above is chrome only,
+  n=29, captured while its auth was stale, so it never rendered a diff or a highlighted code block.
+  If real output is also palette-dominated, the answer is per-harness rendering — re-theme codex,
+  keep inverting the rest — not a global change.
+- **Herdr answering `OSC 11`, or a palette protocol letting the client supply the ground.** Either
+  restores the premise that a re-themed palette can work.
+- **A measured scroll regression on a mid-range phone** — which reopens it in favour of keeping the
+  mirror dark, not of re-theming it.

.adr/0003-one-shared-seen.md

@@ -0,0 +1,71 @@
+# 0003 — "Seen" is one shared fact, and Collie only trusts what happened in Collie
+
+Status: **Accepted** (2026-07-28)
+
+## Context
+
+The dashboard sorts the herd by attention and then by recency, and it surfaces a **Ready · unseen**
+section: agents that finished while you weren't looking. Both need to know two things per pane —
+when the agent last moved, and when *you* last looked at it.
+
+Herdr supplies neither. Its pane, tab, and workspace records carry **no timestamps of any kind**
+(see [`HERDR_API.md`](../HERDR_API.md)), so every notion of "when" in this feature is one Collie
+derives and owns. That forced two questions that would otherwise never have been asked out loud.
+
+**Where does "seen" live?** Collie is a phone UI for a herd you also drive from a desk, and the same
+person uses both. The bridge already persists exactly this kind of state — `snooze.json`,
+`notify-prefs.json` — bridge-wide rather than per-device, on the same reasoning: a notification
+fans out to every device, so muting it on one must mute it on all.
+
+**What counts as looking?** Herdr reports a `focused` flag per pane, so the bridge *could* see you
+working in a pane at the desk and count that as having seen it. That was considered and rejected
+during design.
+
+## Decision
+
+**One shared "seen", recorded bridge-side and persisted to the state dir.** `activity.json` holds
+`{activeAt, seenAt}` per pane, keyed by session name (pane ids are session-scoped and collide across
+sessions). Not per-device, not in `localStorage`.
+
+**Only what happens in Collie counts as seeing.** `seenAt` is stamped when a request reaches
+`/api/pane/:id` — opening the pane, replying, sending keys, reading its history. A Herdr focus at
+the desk does not stamp it, and neither does anything else the bridge merely observes.
+
+**"Seen" is a comparison, not a stored flag.** An agent is unread exactly when
+`status === "done" && activeAt > seenAt`. There is no read-receipt table and nothing to keep in
+sync: opening the pane bumps `seenAt` past `activeAt`, and the row leaves the section by itself.
+
+**A first sighting is seeded as already-seen** (`activeAt = seenAt = now`), so only transitions
+observed *after* Collie first saw a pane can mark it unread. This is the same rule the state engine
+already applies to notifications — a first sighting never fires a transition, so a fresh start
+doesn't notify for agents that were already blocked.
+
+## Consequences
+
+- **A second device agrees with the first.** An alert cleared on the phone is cleared on the laptop.
+  This is the whole point, and it's why per-device storage was rejected: the failure mode there is
+  an alert you already dealt with still shouting at you somewhere else.
+- **Two people sharing one bridge share one "seen".** Accepted. Collie's threat model is a personal
+  tailnet with one operator; a bridge is remote shell access, not a multi-tenant service.
+- **Working in a pane at the desk does not clear its Collie alert.** This is the deliberate cost.
+  Counting a Herdr focus would let a pane you merely clicked past silently clear an alert you never
+  read — a false negative on the one thing the dashboard exists to surface. A false *positive* (an
+  item still listed as unseen after you dealt with it at the desk) costs one tap; a false negative
+  costs a missed agent.
+- **The ledger writes on a debounce.** An open pane polls about once a second and each poll stamps
+  `seenAt`; in memory that's free, on disk it would be a write per second forever. Flushes are
+  capped at one per 10s plus one on shutdown, so an unclean kill can lose up to ten seconds of
+  precision — imperceptible in a feature whose finest unit is "just now".
+- **The state can be thrown away.** Delete `activity.json` and the next poll re-seeds every pane as
+  seen. Nothing else depends on it.
+
+### What would justify revisiting
+
+- Herdr starts reporting real per-pane activity timestamps — then `activeAt` should come from the
+  source rather than from Collie's own observation, and a bridge restart would stop being a
+  re-seed.
+- Collie grows genuine multi-user support (distinct identities, not just distinct devices). Then
+  "seen" becomes per-identity, and this ADR is superseded rather than amended.
+- Evidence that clearing-at-the-desk actually matters in practice — i.e. the false positives are
+  frequent and annoying enough to outweigh the missed-agent risk. That's a usage question, not a
+  design one, and it should be answered with usage.