Query dialogs: fix Search AI filter leak + a11y coverage gap, strip plan tags, trim docs

Final pre-merge cleanup for the query-dialogs overhaul. Two blockers and a docs sweep:

- **Search AI stale-filter leak (correctness):** a second AI run that returned no size/date bound silently kept the first run's filter (for example a ≥ 5 MB lower bound survived "find PDFs"). `applySizeFromAi` / `applyDateFromAi` no-op on a null bound, so `applyAiSharedFilters` now resets `sizeFilter` / `dateFilter` to `any` before applying each translation, matching what Selection already does and the documented contract in `apply-ai-filters.ts`. `typeFilter` is deliberately left alone (the AI omitting type keeps the user's choice). Pinned by a red-first regression test plus a no-recall guard test (reopening in AI mode renders persisted results without re-calling the cloud translate).
- **a11y coverage gap:** `FilterDropdown.svelte` shipped without a tier-3 a11y test, so `a11y-coverage` failed once uncached. Added `FilterDropdown.a11y.test.ts` (closed, span-heading grid, and `labelFor` single-control states); not allowlisted.
- **Plan-tag strip:** removed the `M2`/`M4`/`M5`/`M6` milestone tags that leaked into shipped code, tests, and docs, replacing each with a descriptive reference. Pre-existing unrelated milestone tags (FilePane git browser, indexing, the older Open-in-pane test) are left as-is.
- **Doc trim:** moved depth out of three over-length push-tier `CLAUDE.md` files into colocated `DETAILS.md` (new for `filter-chips/` and `selection-dialog/`), keeping every invariant/gotcha/guardrail: `filter-chips` 1836 → 543 words, `selection-dialog` 1619 → 501, `query-ui` 1066 → 928 (the rest is all must-knows; can't drop further without losing guardrails). The `claude-md-length` allowlist auto-shrink-wrapped the two now-under-threshold entries.

Full `pnpm check --fresh` (uncached) is green.

Author: vdavid

apps/desktop/src-tauri/src/search/history.rs

@@ -665,7 +665,7 @@ mod tests {
         // The type filter is an additive `#[serde(default)]` field: a new value serializes
         // and deserializes cleanly, AND an old file missing the key still loads (as `None`),
         // all on schema v1. This pins "no schema bump needed".
-        assert_eq!(CURRENT_SCHEMA_VERSION, 1, "M4's type filter must NOT bump the schema");
+        assert_eq!(CURRENT_SCHEMA_VERSION, 1, "the type filter must NOT bump the schema");
 
         let mut e = entry(HistoryMode::Filename, "*.png");
         e.filters.is_directory = Some(true);

apps/desktop/src/lib/query-ui/CLAUDE.md

@@ -13,75 +13,68 @@ popover, and the `createQueryFilterState()` factory. Filter-chip internals live
 - `QueryBar`, `ModeChips`, `AiPromptStrip`, `QueryResults`, `EmptyState`, `PathPills`, `SearchRowMenu`,
   `recent-items/*`: UI pieces. Pure helpers: `enter-action.ts`, `path-pills-layout.ts`, `recent-chips-layout.ts`.
 - `query-filter-state.svelte.ts`: factory owning the cross-consumer state. `filter-chips/`: chip subsystem.
-- `apply-ai-filters.ts`: shared `applySizeFromAi` / `applyDateFromAi` / `applyTypeFromAi` over a `QueryFilterState`;
-  both wrappers call them, so the AI-result-to-chip mapping is in one place.
-- `ai-summary.ts`: pure `buildAiSummary()` → the `AiPromptStrip`'s human-readable mirror of the produced pattern +
-  Size/Modified/Type. The strip is a MIRROR; the live chips stay the editable truth.
+- `apply-ai-filters.ts`: shared `applySizeFromAi` / `applyDateFromAi` / `applyTypeFromAi` over a `QueryFilterState` (one
+  place for the AI-result-to-chip mapping). `ai-summary.ts`: pure `buildAiSummary()` → the `AiPromptStrip`'s
+  human-readable mirror (a MIRROR; the live chips stay the editable truth).
 
 ## Must-knows
 
-- **Three pieces of state are QueryDialog's alone; consumer callbacks MUST NOT write them:** (1) `state.lastDialogEvent`
-  (drives `deriveEnterAction` + the `⏎` swap), (2) `state.lastAiPrompt` / `lastAiCaveat` (orchestrator sets the prompt
-  before `translateAi`), (3) `state.results` / `totalCount` / `cursorIndex` (set after `runQuery` resolves). `runQuery`
-  returns `{ entries, totalCount }`; `translateAi` returns `{ caveat, highlightedFields }`. Writing these from a
-  consumer breaks the ⏎ ownership swap.
+- **Three pieces of state are QueryDialog's alone; consumer callbacks MUST NOT write them:** `state.lastDialogEvent`
+  (drives `deriveEnterAction` + the `⏎` swap), `state.lastAiPrompt` / `lastAiCaveat` (orchestrator sets these before
+  `translateAi`), and `state.results` / `totalCount` / `cursorIndex` (set after `runQuery` resolves). `runQuery` returns
+  `{ entries, totalCount }`; `translateAi` returns `{ caveat, highlightedFields }`. Writing these from a consumer breaks
+  the ⏎ ownership swap. Full ownership table in DETAILS.md § Ownership contracts.
 - **AI translation errors surface once, in QueryDialog, for both consumers.** The consumer's `translateAi` must let the
   typed `AiTranslateError` throw (don't swallow it). QueryDialog catches and calls `showAiTranslateErrorToast`. A `null`
   return means a benign empty translation, distinct from a throw. Don't re-add a per-consumer catch.
 - **`createQueryFilterState()` owns ONLY cross-consumer fields.** When adding a field, ask "would Selection care?" Yes →
   core factory. No → the consumer's extras module (`createSearchExtrasState()` etc.). Don't share via the core when
   semantics diverge (`lastAiLabel` is the textbook "no").
 - **`typeFilter: 'both' | 'file' | 'folder'`** (core, default `'both'`) maps to the existing IPC
-  `SearchQuery.isDirectory: Option<bool>` in `buildBaseSearchQuery` (`both → null`, `file → false`, `folder → true`): no
-  new IPC field, no engine change. Selection's matcher reads it via `getIsDirFor`; it round-trips as
-  `HistoryFilters.isDirectory` (additive `#[serde(default)]`, no schema bump).
+  `SearchQuery.isDirectory: Option<bool>` (`both → null`, `file → false`, `folder → true`): no new IPC field, no engine
+  change, no schema bump (`HistoryFilters.isDirectory` is additive `#[serde(default)]`). Mapping detail in DETAILS.md §
+  State shape.
 - **`recordAiTranslation` (core) writes ONLY `handTyped[mode]`.** The Search-only label/pattern slots live in the extras
   and are written separately. Don't fold them into the core method.
 - **`stopPropagation()` on every dialog `keydown`** (shields the file explorer behind it; without it, keys trigger
   quick-search/nav). All `use:trapFocus` listeners run in the capture phase so this can't starve the trap.
 - **Don't wipe state from `onDestroy` / any lifecycle hook.** The dialog mounts on open and unmounts on close; state
   survives unmount by design. The ONLY sanctioned reset is `⌘N` (the consumer's clear hook). Wiping on unmount turns
   every close+reopen into lost work.
-- **Reopen re-derives results so they show immediately, not the empty state.** `hasSearched` is component-local (resets
-  to `false` each mount), so it's seeded from `getLastRunQuery() !== null` (the precise "a prior run exists" flag,
-  nulled by `⌘N`/`clearCore`) so persisted results render on mount. For a restored NON-AI session (a prior run + a
-  non-empty query or active filter, via `hasRestorableQuery()`), `onMount` sets `runOnMount` so the query re-runs:
-  Select re-derives against the freshly-snapshotted current folder (more correct than showing rows from the old folder),
-  Search re-hits the index. AI restored sessions must NOT re-run (cloud cost): the `onMount` gate excludes
-  `mode === 'ai'`, so the seeded `hasSearched` renders the persisted results without re-calling translate. A first-ever
-  open (no prior run) still rests on the empty state.
-- **⌘⏎ and ⇧⏎ are explicit no-ops** (swallowed with `preventDefault`); bare Enter is the only key that runs a search or
-  opens the cursor row, dispatched via `enterAction`. `⌘N` is captured before the dialog's `stopPropagation` so it
-  doesn't reach the route-level new-tab handler.
+- **Reopen re-derives results so they show immediately, not the empty state.** `hasSearched` (component-local) is seeded
+  from `getLastRunQuery() !== null` so persisted results render on mount. A restored NON-AI session (prior run +
+  `hasRestorableQuery()`) sets `runOnMount` to re-run on reopen. AI restored sessions must NOT re-run (cloud cost): the
+  `onMount` gate excludes `mode === 'ai'`, so the seeded `hasSearched` renders the persisted results without re-calling
+  translate. Don't loosen the `mode !== 'ai'` gate. Full lifecycle (cold-open / hot-prefill / index-not-ready) in
+  DETAILS.md § `runOnMount` consumer.
+- **⌘⏎ and ⇧⏎ are explicit no-ops** (`preventDefault`); bare Enter is the only key that runs a search or opens the
+  cursor row, via `enterAction`. `⌘N` is captured before the dialog's `stopPropagation` so it doesn't reach the
+  route-level new-tab handler.
 - **Path pills are mouse-only, `tabindex="-1"`** (keyboard equivalents `⌥←` / `⌥→`); making them tabbable breaks the
-  row's arrow-down flow in the virtualized list. The `nested-interactive` axe rule is deliberately disabled on the
-  populated-results a11y test with a comment pointing at the rationale; don't "fix" it by retabbing.
-- **Status bar stays empty whenever the content area shows a state message** (Searching / No files match / Loading).
-  When you add a content-area state in `QueryResults`, make `getStatusText()` return `''` for it, or it reads as broken.
-- **`.results-container` carries `role="listbox"` ONLY when option rows actually render** (the `showingRows` derived:
-  `isIndexAvailable && isIndexReady && !isSearching && results.length > 0`). Don't gate it on `results.length > 0`
-  alone: on reopen the dialog re-runs with the persisted `results` still set while the spinner shows, so a length-only
-  gate puts `role="listbox"` on a container with no `option` children = axe `aria-required-children` (critical). Pinned
+  row's arrow-down flow. The `nested-interactive` axe rule is deliberately disabled on the populated-results a11y test;
+  don't "fix" it by retabbing.
+- **Status bar stays empty whenever the content area shows a state message** (Searching / No files match / Loading):
+  make `getStatusText()` return `''` for any new content-area state, or it reads as broken.
+- **`.results-container` carries `role="listbox"` ONLY when option rows actually render** (the `showingRows` derived,
+  not `results.length > 0` alone): on reopen the dialog re-runs with persisted `results` set while the spinner shows, so
+  a length-only gate yields `role="listbox"` with no `option` children = axe `aria-required-children` (critical). Pinned
   by the "searching with stale results" test in `QueryResults.a11y.test.ts`.
-- **Content chip is visible-disabled with NO shortcut** (`⌘4` reserved): wiring a shortcut to a disabled control is
-  hostile UX. When Content ships it claims `⌘3` and Regex moves to `⌘4`.
+- **Content chip is visible-disabled with NO shortcut** (`⌘4` reserved): when Content ships it claims `⌘3` and Regex
+  moves to `⌘4`.
 - **AI mode never auto-applies** (cost); filename/regex auto-apply behind `search.autoApply` (default on, 1,000 ms
-  debounce), gated also by IME composition. The split lives in `scheduleSearch()`'s early-return chain.
-- **The AI translation overwrites `query` + `mode`.** The original prompt lives in `lastAiPrompt`; use
-  `getLastAiPrompt()`, don't assume `query` still holds natural-language input after an AI run.
+  debounce, IME-gated), in `scheduleSearch()`'s early-return chain.
+- **The AI translation overwrites `query` + `mode`.** Use `getLastAiPrompt()` for the original prompt; don't assume
+  `query` still holds natural-language input after an AI run.
 - **The `AiPromptStrip` is a human-readable MIRROR, never the source of truth.** `buildAiSummary()` (`ai-summary.ts`)
-  turns the current chip state (pattern + Size/Modified/Type) into the strip's "Here's what the agent did:" lines; the
-  live chips stay the editable representation. The first-person agent voice is a SANCTIONED exception to the
-  no-first-person copy rule (David-decided), alongside onboarding / About.
+  renders the current chip state into the strip's "Here's what the agent did:" lines; the live chips stay editable. Its
+  first-person agent voice is a SANCTIONED exception to the no-first-person copy rule (alongside onboarding / About).
 - **The spinner covers the AI translate round-trip.** `runAiSearch` sets `isSearching` true BEFORE the cloud translate
-  (the slow part) and leaves it on through `executeQuery` (which clears it in `finally`); its early-returns reset it so
-  it can't stick. `QueryResults` shows `.spinner` off `isSearching`, and `getStatusText()` returns `''` for it. The
-  global `.spinner` honors `prefers-reduced-motion` in `app.css`.
-- **Type-in-AI is leave-alone-if-null; size/date are reset-first. Don't "consistency-fix" this.** The AI RECEIVES the
-  current type as context (`translateSearchQuery` / `translateSelectionQuery` take a `currentType` arg, via
-  `typeFilterToIsDirectory`) and may set or stay silent. `applyTypeFromAi` writes only on a non-null `isDirectory`; a
-  `null` keeps the user's choice. Unlike `applySizeFromAi` / `applyDateFromAi` (callers reset to `any` first), callers
-  must NOT pre-reset `typeFilter`. The `'type'` highlight flashes the toggle via a wrapper span (`ToggleGroup` has no
-  `highlighted` prop).
+  and leaves it on through `executeQuery` (cleared in `finally`; early-returns reset it so it can't stick). Detail in
+  DETAILS.md § Shared UI behavior.
+- **Type-in-AI is leave-alone-if-null; size/date are reset-first. Don't "consistency-fix" this.** Each AI run resets
+  `sizeFilter` / `dateFilter` to `'any'` before applying the translation (the helpers no-op on a null bound, so without
+  the reset a prior run's filter leaks). Type is the deliberate asymmetry: `applyTypeFromAi` writes only on a non-null
+  `isDirectory`, so the AI staying silent keeps the user's choice. Callers must NOT pre-reset `typeFilter`. Full
+  contract in `apply-ai-filters.ts`.
 
 Architecture, flows, and decision detail: [DETAILS.md](DETAILS.md). Read it in whole before structural changes here.

apps/desktop/src/lib/query-ui/DETAILS.md

@@ -218,7 +218,7 @@ losing the user's words is worse than handing them text they may need to tweak.
 **Precedence on an empty target buffer** (reconciling the carry-over with the AI-pattern probe):
 
 1. `aiPatternProbe(target)` first. It returns the AI's structured, kind-correct pattern (filename gets the glob, regex
-   gets the regex) and is the post-AI editing handoff (M6's "tweak what the agent did" loop depends on it). The raw
+   gets the regex) and is the post-AI editing handoff (the "tweak what the agent did" loop depends on it). The raw
    carry-over must NOT clobber it.
 2. The outgoing term second, as the fallback when there's no probed pattern.