feat(desktop): pick session rows with shift and cmd

[Astro-Han]

Summary

The requirement comes from #4365, merged this morning, and this is a continuation of it rather than a reversal of it.

#4365's first revision was this interaction. Its own description records why it was dropped:

Rows were handed their group's session ids so a Shift-click range could know where it may reach. […] The prop is gone, and with it the modifier-click gestures it existed for — the mode is checkboxes now and nothing in it needs a range.

The modifier gestures were not judged worse than a mode. They were given up because handing every row its group's id array broke the rail's #4109 render budget at 12 of 12, and no memoisation fixes it: every candidate key derives from rail.sessions, whose identity moves on a session switch. The checkbox mode is what was reachable once that door closed.

This PR removes the constraint instead of living with it. The rendered order is never a prop. It is read off the DOM at the moment of the click — one query per click, nothing per render, and it is the true order, groups and collapsed projects included, rather than a reconstruction. With that, a range costs the budget nothing, and the mode is no longer the only shape available.

Which matters, because a mode carries two costs that are permanent rather than adjustable:

• It taxes every click to pay for the few that need it. The rail's job is navigation. Whether a plain click opens a task or ticks it came to depend on state entered earlier, from a menu the user opened looking for 置顶 or 重命名.
• The bar and the checkbox column are surfaces Astryx does not have. They were assembled from Astryx parts, but the shapes are new — two elements added to a 260px surface whose whole job is to list tasks. Moving the bar or narrowing the checkbox would not make them fewer.

So: plain click opens and picks; ⌘/Ctrl-click adds or removes one row without moving the main pane; Shift-click picks the run from the anchor. Nothing to enter or leave, so Escape just drops the picks. Finder, VS Code, Claude Desktop and Codex all spell it this way, and nothing is added to the rail.

• One ground. Picked rows and the open row share the same var(--color-neutral) that Astryx's isSelected compiles to. isSelected stays on the open row alone — it renders aria-current="page", and picked rows are not current pages; "picked" rides in the row's existing visually-hidden description.
• One menu. Right-click opens the row's own ⋯, so the two entrances cannot disagree — feat(desktop): select several tasks in the Session rail #4365 could offer to act on one row with twelve marked. Verbs count the set (置顶 3 项 / 归档 3 项); a set pinned throughout offers 取消置顶. No 重命名 in a set menu — renaming names one task.
• Delete leaves the rail (first commit). It cannot be undone, and Settings › 已归档任务 can only reach a task archived first. Archiving a set does not confirm, matching the single row. 全选 is not built: a range is one Shift-click.

What #4365 established, and what this replaces

Kept, because they were right and are not specific to the mode:

• A sweep never discards a pick it did not submit. Raised as a P2 in review of feat(desktop): select several tasks in the Session rail #4365; the rule survives, its mechanism does not. feat(desktop): select several tasks in the Session rail #4365 kept it by unmarking the submitted ids on completion, which is "the selection follows the catalog" said a second time — redundant for archive, which refreshes the catalog before it resolves, and wrong for pin, which leaves its rows listed and had the set empty itself out from under the next action. Pruning is now the only owner. session-selection-sweep-race.test.ts drives the catalog to prove it, since a fixture whose session list never changes cannot tell the two cases apart.
• Pruning the selection against the catalog, so a count does not include ids another client removed. Extended to the anchor, which a range would otherwise reach from.
• The two-cause diagnosis of the render budget — a per-render array prop and a context every row subscribes to. Both causes are why the picked set reaches rows as props here: a plain click now changes the selection, so a context the rows subscribed to would redraw ~1,000 fibers for a switch that moved two.

Reshaped — same capability, different gesture: multi-select itself, and bulk archive. Set-wide 置顶 / 取消置顶 is new; #4365's bar offered 归档 and 删除 only.

Three capabilities the rail no longer offers. Each is a decision with a reason, not an oversight, and each is stated here rather than left inside an implementation name:

Gone from the rail	Where it went, and why
Bulk delete	Settings › 已归档任务. Deleting cannot be undone, and Settings can only reach a task archived first — that archive step is what makes the intent deliberate.
Select-all / the master checkbox	Not rebuilt. It existed to make a large set reachable without a range; a range is now one Shift-click.
Delete/Backspace on the marked set	Removed with the rail's delete entirely (first commit), along with the single-row 删除 that predates #4365.

#4365's linked-subtask contract is not lost with the rail's bulk delete: previewRemoval still runs for the Settings purge (session-row-actions.ts:212), which is the surface that now owns every deletion. What this PR removes is the rail's entrance to it, not the accounting behind it.

Also replaced, as implementation: SessionSelection.active and the enter/exit/select-all paths, SessionRailRowSelection, session-selection-bar.tsx, the checkbox column, data-selecting/data-selected, deleteSelected/sweepSessions, the bulkDelete* copy set.

Doing this now rather than later is the cheaper moment: nothing yet depends on the mode's shape or its API, and one day in, no user has built a habit on it. Happy to be argued out of any of it — the six interaction decisions above were settled one at a time and each can be revisited.

Third commit: only pickable rows

An adversarial review of this branch found that reading the rendered order off the DOM had traded one problem for another: rendered is not the same as reachable.

• A project collapses by grid track, not by unmounting, so a Shift range dragged past a collapsed group swept rows that were nowhere on screen — twenty tasks archived from a gesture that highlighted three.
• A session shared from another Host is handed no row actions for the same reason it has no ⋯, but nothing stopped it joining a set and being archived with it. Right-clicking one claimed the press, discarded the set, and opened nothing.
• Escape asked whether focus was in a text field, when the question is whether anything above the rail owns the press. Astryx's layer stack listens on document, below this handler in the bubble, and stands down on an already-defaultPrevented press — so Escape in a rename dialog cleared the set and left the dialog with no way to close.
• Forced colors flatten --color-neutral away, which is why Astryx's isSelected names a system color; only its default branch had been copied, leaving picked rows unmarked in high contrast.

One question was being answered in two selectors that only knew how to find a row. isPickableRow answers it once — ours to act on, and not inside an inert subtree — and the list reads it everywhere. A row with no actions is now a plain navigation item all the way down: a modifier on it navigates rather than dying, and a right-click goes to the native menu.

Known and left as-is, stated rather than hidden: the right-click menu is anchored on the ⋯ button rather than at the cursor, since MoreMenu takes a placement but not a virtual anchor — the price of one menu behind two entrances.

Refs #4365

Verification

Picking a set — same fixture, rendered on main and on this branch:

The row menu:

Passing locally: npm test (9731 tests), npm run typecheck, npm run build, npm run lint, npm run format:check, astryx:surface-inventory + :test, astryx:theme --check, knip (both workspaces), check:renderer-architecture, check:app-shell-hooks, check:asf-headers.

Tests: session-history-multi-select.test.tsx drives 19 real clicks (which gesture picks what, that a modifier never opens a task, that a rail with no selection wired up is unchanged, menu adoption, counted verbs, and the third commit's cases below); session-navigation-selection.test.ts covers the reducer (anchors, ranges both directions, re-dragging from the same origin, ranges from the open task, pruning); session-selection-sweep-race.test.ts drives the catalog around a sweep; parent-session-deletion.spec.ts now archives in the rail, then deletes in Settings.

Playwright: 99 passed, 4 skipped, including session-rail-render-contract.spec.ts (2 rows per session switch), the check most relevant to the props-not-context decision.

New story Product/Sidebar Multi Select › PickedRun, in apps/desktop/stories because the selection is the app's — it mounts the real SessionListPanel on the real useSessionSelection, and its initial set comes from two commands.pick calls rather than a seeded fixture.

A gap worth naming

Not a failure of #4365's review, and not something a reviewer could reasonably have been expected to catch — a structural blind spot in a gate we all rely on.

docs/astryx-surface-file-inventory.md scores a file by what it imports: blocker is a raw button/input/select, reimplementation is a @maka/ui export shadowing an Astryx component by name. A selection bar built from Button and CheckboxInput therefore lands in aligned, correctly by those rules. A surface assembled from compliant parts into a shape the design system does not have cannot be seen by an import-level check.

Storybook does not close it either: git grep across **/stories/** on main finds nothing touching the selection bar or any multi-select state. apps/desktop/stories/FIDELITY.md governs whether an existing story is reachable; it does not ask a new surface to have one.

Two closures, both decidable from a .paths diff:

1. A new line in docs/astryx-surface-file-inventory.paths is a new product surface — ask the PR to name the Astryx pattern it instantiates, or say why the design system has none.
2. Ask a new surface to ship with a story, the way FIDELITY.md already asks a story to name its real path.

Out of scope here; raising it for whoever owns that gate.

Review focus

Whether picked rows and the open task sharing one ground is right. Taken from Claude Desktop and Codex, it means the rail distinguishes "the task you are reading" from "the tasks you picked" only by weight and by aria-current.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Claude Opus 5 via Claude Code — interaction design, implementation, tests and the story, under human review at each decision. All three commits carry Generated-by: Claude Opus 5 via Claude Code.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No