Console: a reloaded console keeps its HALT after the remote lifetime (#985)

[eaitbrahim]

Closes #985

What changes

Since #983 (PR #987) the server takes a halt carrying the session cookie and the halt token past the 12 h remote session lifetime on keel serve --external-host, but /api/pulse, the only endpoint that serves the token, keeps the lifetime. So a console reloaded after the lifetime drew no HALT button.

This follows the design the owner approved on the issue:

• Server. The expired-session refusal on GET /api/pulse carries Console: HALT should stay reachable when the Pulse payload fails to build #958's {halt_token, resume_command} (api.pulse_halt) when the request carries this session's cookie (KeelHandler._expired_pulse_halt, keyed on ApiRoute.halt_on_failure, so it applies to Pulse only). Without the cookie, or with a wrong one, the refusal carries halt: null. Nothing else changes: it is still a 403 "Session expired" with data: null. No release, setup write or other read is reopened, no other endpoint serves the halt token, and the gates token is served nowhere (Console: the HALT token served on /api/pulse also releases resume routes #968). do_GET is untouched.
• Client. In paint's data: null branch, the HALT arm (pulseFailedView) now comes before the 403 arm. It branches on whether halt is present, never on the refusal's title.
• Prose. Corrected the docstrings in server.py, security.py, gates.py, api.py, payload.py, api.js, render.js, actions.js and main.js that said a reloaded console cannot get the token. The An installed PWA cannot authorise itself after a serve restart — start_url carries no token #634 guard pin in test_pwa.py now allows the } else prefix and nothing else.

Tests (TDD: written first, failed because halt was None)

• With the cookie, an expired Pulse carries the halt token and the resume command, for both a running and a halted switch. The served token halts. The body contains no gates token, CSRF token or session token.
• With no cookie or a wrong cookie: halt: null and no token in the body.
• Every other /api/* GET (13 routes plus the CSV export, with a count asserted): halt: null.
• A POST to /api/pulse after expiry: halt: null.
• The served token releases neither Tier 1 action in either header, and the kill switch stays engaged.
• A fresh remote Pulse is unchanged: 200 with data.halt_token, envelope halt: null.
• Client structure: in paint, the halt arm comes before the refused arm, which comes before the stopped view. Each arm appears exactly once, and main.js contains no "Session expired" literal.

Mutation checks (each on a saved copy, with a check that the source changed, then restored): dropping the cookie check, the method check, the route check, the halt= argument or refusal_document's pass-through, serving the gates token, a dead client arm, and a branch on the title. All of them were killed.

Verification

• Full pytest: 8442 passed, 3 skipped. mypy, ruff and ruff format are clean. node --check is clean on main.js, render.js, api.js and actions.js.
• Real Chromium (Playwright) against a temp deployment on port 8791 with an external host and a lifetime set to end 45 s after start:
  • Before the lifetime ended, Pulse rendered as usual with one HALT button.
  • After it ended, a reload served the shell from the service worker. The Pulse page showed the HALT button above the "Session expired" card, with no reconnect form.
  • Clicking HALT and confirming showed the line "HALTED — resume with keel resume". kill_switch read true from the database (opened read-only).
  • A request without the cookie got halt: null.

Known limit, unchanged by this PR: a browser with no cached shell is refused the page itself after the lifetime, so the refusal still names keel kill.

🤖 Generated with Claude Code