[twilightsaurus]

Summary

Slice 26 PR 2 only: require explicit confirmation before saving a switch away from a persisted Direct configuration with a saved pairing token. The warning covers local URL/token removal, cancellation preserving saved settings and pending edits, deliberate server rotation if the token is no longer available, and restart-only application.

• Cancel, Close and Escape never authorize deletion.
• Destination mode and SSH-target edits invalidate prior confirmation; failed saves require fresh confirmation.
• Repeated submit/confirmation events cannot bypass the warning or start concurrent saves.
• Direct-to-Direct token preservation/replacement and native canonical persistence remain unchanged.

Review found and fixed a stale-authorization gap: editing the Managed SSH target while the warning was open previously kept confirmation active.

Permanent regression coverage

• 15 actual ConnectionDialog.svelte interaction tests cover all destination modes, cancellation and pending edits, explicit confirmation, deferred/concurrent saves, stale mode/target/settings changes, failed-save retry, Close/Escape, Direct preservation/replacement, and absence of a saved Direct credential.
• One real App → Hud → ConnectionDialog integration test verifies saving does not reload runtime configuration, replace/close the active socket, restart the source, or change its active authentication token.
• One test-only dependency, jsdom, supports Svelte's native mount/flushSync/unmount APIs. Separate node/DOM Vitest projects preserve existing SSR tests. No browser-testing framework or copied state machine.

Verification

• npm run test --workspace @imp/desktop -- --project dom: 16 passed.
• npm run test --workspace @imp/desktop: 168 passed across 21 files.
• Final npm run check: passed, including all formatting/lint/docs/version checks, typechecks, suites, e2e and production build.
• git diff --check: passed.
• Temporary Chromium smoke against the actual component: warning and all actions fit at widths 280/360/480px; no horizontal overflow, Cancel focused, destructive action visually distinct. Temporary fixture/server/browser removed.

Scope and limitations

• Based on current main/v0.4.2; no release-version or CHANGELOG edits.
• No native persistence, server credential, provisioning, TinyFugue, protocol, Caddy or live infrastructure changes. Slice 26 PR 3/4 not started.
• Packaged Windows/WebView interaction remains unverified. Readily available mirror contains only stale installers and no matching executable; Chromium/jsdom results are not native acceptance.
• Native tunnel_config::tests previously passed 26 tests; not rerun because native persistence is unchanged. Frozen server acceptance is not required for this renderer-only change.