Make the presence roster the single source of truth for online status

Online status had three server-side candidate populations and two
client-side deciders, so the feed roster and the /messages indicators
could legitimately disagree.

PresenceRelayService built its online set from whichever topics happened
to be subscribed on a given tick: the roster candidates on /feed, only
the per-uid dot rows on /messages. Different populations meant a
different hysteresis baseline, so the same user could be online in one
place and offline in the other. On top of that, PresenceManager re-derived
online status client-side from a frozen data-presence-last-seen with a
strict timeout and no hysteresis, re-evaluated every 20s, so any element
whose relay frame was missed drifted grey after the timeout and stayed
there. AppChat carried a third renderer with its own PubSubClient that
only ever wrote online/offline, plus hand-built dot markup duplicating
_presence_dot.html.

The relay now collapses to one set on one topic. Each tick it reads the
online population in a single indexed query (online_candidates, capped by
the new PRESENCE_TRACK_LIMIT), applies hysteresis once, and publishes
{count, online, users} on public.presence.roster only when the uid set
changes. online is the authority for every avatar dot; users is the same
set trimmed to PRESENCE_ONLINE_LIMIT for the feed panel. The per-uid
public.presence.{uid} topics are gone, which also removes one
subscription per distinct author on a page.

is_online(user) is now stays_online(seconds_since(last_seen), False), so
the server-rendered initial state and the live set apply one formula.

PresenceManager makes one subscription and renders every
[data-presence-uid] element as membership of that set, with no clock and
no expiry timer; before the first frame the server-rendered state stands.
Relative "last seen" text is a <time data-dt data-dt-mode="ago"> handled
by the shared LocalTime. AppChat lost its presence code entirely, and the
new Avatar.badgeElement is the JS twin of _presence_dot.html, so dot
markup now lives in exactly two places.

Also fix the awards column ensure-block, which the awards tests exposed.
backfill_api_keys opened with an "if users not in db.tables" guard, but
on a brand-new database that is precisely the state at init_db time, so
the whole users ensure-block was skipped. The first signup then created
users with only the columns of that INSERT, leaving every ensured-but-
unwritten column absent from the server's reflected metadata for the rest
of the process lifetime. That is why the awards tab, the prominent award
banner and the avatar award badge were invisible on a fresh database. It
now calls get_table("users") unconditionally.

test_avatar_badge_on_feed_when_prominent asserted that any online user
carries an award badge while only awarding a user who was never active,
so it passed only by accident. It now makes the awarded user active and
asserts the badge on that user's roster entry.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/api/feed.py

@@ -381,6 +381,29 @@ def test_feed_shows_online_now_section(app_server):
     assert f'class="online-user" title="{name}"' in html
 
 
+def test_online_now_avatar_uses_the_shared_presence_dot(app_server):
+    name = _unique("0ros")
+    s = requests.Session()
+    s.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    uid = _db_user(name)["uid"]
+    html = s.get(f"{BASE_URL}/feed").text
+    panel = html.split('data-online-users-list', 1)[1].split("</div>", 2)[0]
+    # the roster avatar is driven by the same subscribed dot as every other avatar,
+    # never a hardcoded green marker
+    assert f'data-presence-uid="{uid}"' in panel
+    assert "data-presence-last-seen" in panel
+    assert '<span class="presence-dot online" aria-hidden="true"></span>' not in panel
+
+
 def test_feed_shows_poll_results_without_voting(app_server):
     s, _ = _session_polls()
     title = f"feedpoll-{int(time.time() * 1000)}"

tests/api/messages/index.py

@@ -180,3 +180,31 @@ def test_messages_conversation_list_avatar_has_presence_dot(app_server):
     assert "conversation-item" in html
     assert "presence-dot" in html
     assert f'data-presence-uid="{other_uid}"' in html
+
+
+def test_chat_presence_agrees_with_the_feed_online_roster(app_server):
+    sender, _ = _member()
+    # the roster is alphabetical and capped, so name the partner to sort first
+    other_name = _unique("0chat")
+    other = requests.Session()
+    other.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": other_name,
+            "email": f"{other_name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    other_uid = _db_user(other_name)["uid"]
+
+    # the partner is active, so the feed roster - the single source of truth - lists them
+    roster = sender.get(f"{BASE_URL}/feed").text
+    assert f'class="online-user" title="{other_name}"' in roster
+
+    # ...and the chat header must say exactly the same thing
+    chat = sender.get(f"{BASE_URL}/messages?with_uid={other_uid}").text
+    header = chat.split('id="messages-presence"', 1)[1].split("</span>", 1)[0]
+    assert header.endswith("online"), header
+    assert f'data-presence-uid="{other_uid}"' in header

tests/e2e/messages.py

@@ -188,6 +188,25 @@ def test_messages_page_loads(alice):
     assert page.is_visible(".messages-layout")
 
 
+def test_chat_presence_is_driven_by_the_shared_roster(alice, bob):
+    bob_page, _ = bob
+    bob_page.goto(f"{BASE_URL}/feed", wait_until="domcontentloaded")
+    bob_uid = get_table("users").find_one(username="bob_test")["uid"]
+    page, _ = alice
+    page.goto(
+        f"{BASE_URL}/messages?with_uid={bob_uid}", wait_until="domcontentloaded"
+    )
+    presence = page.locator("#messages-presence")
+    expect(presence).to_be_visible()
+    expect(presence).to_have_class(re.compile(r"\bonline\b"))
+    # the chat header and the feed roster read the same subscribed uid, never a
+    # second client-side clock over a frozen last_seen
+    assert presence.get_attribute("data-presence-uid") == bob_uid
+    dots = page.locator(f".presence-dot[data-presence-uid='{bob_uid}']")
+    assert dots.count() >= 1
+    expect(dots.first).to_have_class(re.compile(r"\bonline\b"))
+
+
 def test_messages_search_input(alice):
     page, _ = alice
     page.goto(f"{BASE_URL}/messages", wait_until="domcontentloaded")

tests/e2e/profile/awards.py

@@ -104,6 +104,15 @@ def test_guest_can_read_awards_tab(browser):
 def test_avatar_badge_on_feed_when_prominent(alice):
     page, _ = alice
     _seed_published("bob_test", "alice_test", "Badge feed")
+    # the Online now roster only lists active users, so make the awarded user active
+    get_table("users").update(
+        {
+            "uid": get_table("users").find_one(username="bob_test")["uid"],
+            "last_seen": datetime.now(timezone.utc).isoformat(),
+        },
+        ["uid"],
+    )
     page.goto(f"{BASE_URL}/feed", wait_until="domcontentloaded")
-    if page.locator(".online-user").count() > 0:
-        expect(page.locator(".online-user .award-badge").first).to_be_visible()
+    entry = page.locator(".online-user[title='bob_test']")
+    expect(entry).to_be_visible()
+    expect(entry.locator(AWARD_BADGE)).to_be_visible()

tests/unit/services/presence.py

@@ -31,6 +31,18 @@ def test_is_online_unparseable_is_offline():
     assert presence.is_online({"last_seen": "not-a-timestamp"}) is False
 
 
+def test_is_online_is_the_first_observation_of_stays_online():
+    from devplacepy.config import PRESENCE_ONLINE_MARGIN_SECONDS
+
+    for seconds in (0, 5, PRESENCE_TIMEOUT_SECONDS - 1, PRESENCE_TIMEOUT_SECONDS + 1,
+                    PRESENCE_TIMEOUT_SECONDS + PRESENCE_ONLINE_MARGIN_SECONDS + 1):
+        row = {"last_seen": _iso(seconds)}
+        expected = presence.stays_online(
+            presence.seconds_since(row["last_seen"]), was_online=False
+        )
+        assert presence.is_online(row) is expected
+
+
 def test_seconds_since_none_on_missing_or_bad():
     assert presence.seconds_since(None) is None
     assert presence.seconds_since("") is None
@@ -151,3 +163,22 @@ def test_online_candidates_uses_grace_window(local_db):
     assert band not in strict
     # a user past the grace window is in neither
     assert beyond not in candidates
+
+
+def test_online_candidates_tracks_beyond_the_display_limit(local_db):
+    from devplacepy.config import PRESENCE_ONLINE_LIMIT, PRESENCE_TRACK_LIMIT
+
+    # the display roster is capped for the feed panel, the tracked authority set is not
+    assert PRESENCE_TRACK_LIMIT > PRESENCE_ONLINE_LIMIT
+    now = datetime.now(timezone.utc).isoformat()
+    users = get_table("users")
+    made = []
+    for index in range(PRESENCE_ONLINE_LIMIT + 5):
+        uid = str(uuid_utils.uuid7())
+        users.insert(
+            {"uid": uid, "username": f"trk{index:03d}{uid[:6]}",
+             "email": f"{uid[:8]}@o.test", "last_seen": now}
+        )
+        made.append(uid)
+    tracked = {u["uid"] for u in presence.online_candidates()}
+    assert set(made) <= tracked

tests/unit/services/presence_relay.py

@@ -0,0 +1,45 @@
+# retoor <retoor@molodetz.nl>
+
+from devplacepy.config import PRESENCE_ONLINE_LIMIT
+from devplacepy.services.presence_relay import ROSTER_TOPIC, roster_payload
+
+
+def _rows(count):
+    return [
+        {"uid": f"u{index:03d}", "username": f"user{index:03d}", "avatar_seed": None}
+        for index in range(count)
+    ]
+
+
+def test_roster_topic_is_the_single_presence_channel():
+    assert ROSTER_TOPIC == "public.presence.roster"
+
+
+def test_payload_only_carries_the_online_set(local_db):
+    rows = _rows(4)
+    payload = roster_payload(rows, {"u000", "u002"})
+    assert payload["online"] == ["u000", "u002"]
+    assert [user["uid"] for user in payload["users"]] == ["u000", "u002"]
+    assert payload["count"] == 2
+
+
+def test_dots_and_display_roster_come_from_one_set(local_db):
+    rows = _rows(PRESENCE_ONLINE_LIMIT + 7)
+    online = {row["uid"] for row in rows}
+    payload = roster_payload(rows, online)
+    # every online user is authoritative for their avatar dot...
+    assert set(payload["online"]) == online
+    # ...while the feed's avatar panel stays capped for display
+    assert len(payload["users"]) == PRESENCE_ONLINE_LIMIT
+    assert payload["count"] == PRESENCE_ONLINE_LIMIT
+    assert set(payload["online"]) >= {user["uid"] for user in payload["users"]}
+
+
+def test_avatar_seed_falls_back_to_username(local_db):
+    payload = roster_payload([{"uid": "u1", "username": "ada", "avatar_seed": None}], {"u1"})
+    assert payload["users"][0]["avatar_seed"] == "ada"
+
+
+def test_offline_users_are_absent_everywhere(local_db):
+    payload = roster_payload(_rows(3), set())
+    assert payload == {"count": 0, "online": [], "users": []}