Face rooms person-first; per-Bot face-room Auto-send (#457)

[Birfy]

Fixes #457

What

Face-to-face rooms are now person-first, as the owner decided on 2026-10-20:

• One tile / row per person. The waiting grid and the room overview draw one tile per person (FacePersonTile: the person's name, Me (you) for me, with that person's Bots underneath). Group settings and the details drawer show Members · N, where N counts people, with one FacePersonRow per person (person mark, name, Bots; my Bots open their chat). faceRoomCount counts people through the new facePeople.
• "(you)" only on people. Every Bot is Bot (person), mine too (Chief (SelfB)). This applies in bubble headers (faceBotLabel), Members, and the @ menu. In a face room, Everyone in @ shows the Bot count (2 Bots).
• Mentions stay bound after a person leaves. faceMentionables also matches left seats, after the live ones, so @Chief (SelfA) no longer re-binds to my own Chief.
• Leaner bubble headers. A friend's Bot in a face room reads Researcher (SelfA), name only, with the handle on hover. The globe/handle line and the lowercase id are gone.
• My own line stays mine. It is no longer greyed as "held" while a Bot's reply waits, so it no longer flips colour. It carries my person mark and name.
• Auto-send is one switch per Bot (owner option a, off by default):
  • The overview shows Auto-send Chief → room for each of my Bots in the room. It calls social/face-auto { botId, on } and is stored in this home's settings.faceAutoSend.
  • When that Bot's line comes back pending_approval and Bot Social's hold has no DLP reason or risk flag, the host approves it at once. A flagged line, or a line from a Bot whose switch is off, still waits for the owner's click.
  • The old account-wide auto_approve_face_rooms reads as "every switch on". The first per-Bot change keeps the others on locally and turns the account-wide flag off.
  • Auto-send from now on on a face-room card turns on only the writing Bot's switch.

Why

Before this fix, the room was still Bot-first: two tiles per person, Members counted Bots, "(you)" appeared on Bots, mentions re-bound after a leave, and bubble headers were bloated. Auto-send was a single account-wide switch.

Test

• New test core/test/face-person-first.test.js covers: people and count, (you) only on people, FacePersonRow, faceBotLabel, a mention after a leave, the remote header, and my own line.
• Core tests updated: at-menu, mention-rule, face-at-filter, face-people, user-bubble.
• Plugin tests: per-Bot face-auto with the legacy flag migration, an MCP write failure, a host test that auto-approves a clean held line but leaves flagged lines and other Bots' lines held, person tiles, and per-Bot toggles.
• ARCH_DOCS_BASE=origin/main TZ=UTC npm run verify: passes, 0 failures (core 1025, social 283).
• Not run: live Mac instances or the production Bot Social server.

Risk tier: T3 (estimate; matches the risk-gate report; the controller sets the label). It changes when face-room Bot lines are approved, though only behind an explicit per-Bot owner switch and never for flagged holds.

[Birfy]

Self-review: PASS
Tip SHA: d03379b
Ran:

• cd core && npm test: pass 1025, fail 0
• cd plugins/social && TZ=UTC npm test: pass 283, fail 0
• cd core && npm run build, then node scripts/ds-bot-patches.mjs generate and check: ok, 10 patches apply cleanly, core/ equals ds-bot/ + patches
• node .github/scripts/changelog.mjs check: ok
• ARCH_DOCS_BASE=origin/main TZ=UTC npm run verify: exit 0, all suites 0 failures, arch-docs OK
• CI on the tip: all checks green (tests-ok, ubuntu Node 24, plugins social/tree/timeline, package)
• Read through the diff: person-first face-seats/Members/tiles, mentions bound to left seats, face-room bubble headers, my own line no longer greyed, and per-Bot Auto-send (host approves only that Bot's clean hold, never a DLP- or risk-flagged one; the old account-wide flag migrates on the first per-Bot change)
  Not run:
• Live Mac instances (3080/3081) and the production Bot Social server: not restarted or deployed
• A live two-home face room end to end

[Birfy]

Self-review: PASS
Tip SHA: cdff039
Ran:

• Merged origin/main (196c917, incl. Show other homes' face-room lines as bubbles at once, never in the composer queue #466 / Face room: other home's lines arrive as raw queued '[Group post from …]' text above the composer, not bubbles; line breaks flattened #455 and Face room lifecycle: unknown number opens no room, room stays open while 2+ people remain (#458) #467 / Face room lifecycle: wrong number silently opens a room, countdowns differ, leave closes room for all, room leaks into Chief preview, number hidden #458) into the branch; no rebase, no force-push. Conflicts only in docs/subsystems/core-client.md and docs/subsystems/social.md, resolved keeping both sides (Face room: other home's lines arrive as raw queued '[Group post from …]' text above the composer, not bubbles; line breaks flattened #455 line-breaks / shown bullet + Face room still Bot-first: two tiles per person, Members counts Bots, '(you)' on Bots, mention re-binds after leave, bloated bubble headers #457 person-first bullets; Face room still Bot-first: two tiles per person, Members counts Bots, '(you)' on Bots, mention re-binds after leave, bloated bubble headers #457 per-Bot Auto-send waiting-room text + Face room lifecycle: wrong number silently opens a room, countdowns differ, leave closes room for all, room leaks into Chief preview, number hidden #458 lifecycle paragraph). Code auto-merged; reviewed the overlaps (waiting room: Face room still Bot-first: two tiles per person, Members counts Bots, '(you)' on Bots, mention re-binds after leave, bloated bubble headers #457 person tiles with Face room lifecycle: wrong number silently opens a room, countdowns differ, leave closes room for all, room leaks into Chief preview, number hidden #458 "Waiting for others to join…" alone check, Leave/Enter chat beside, Nobody/Start a room; TriggerCell shown skip; person-bubble pre-line).
• Semantic fix in the merge: the new Face room still Bot-first: two tiles per person, Members counts Bots, '(you)' on Bots, mention re-binds after leave, bloated bubble headers #457 face Auto-send test joins with start: true, as Face room lifecycle: wrong number silently opens a room, countdowns differ, leave closes room for all, room leaks into Chief preview, number hidden #458 now requires for a number nobody else uses.
• git checkout origin/main -- patches/ds-bot, cd core && npm run build, node scripts/ds-bot-patches.mjs generate then check: ok, 10 patches apply cleanly, core/ equals ds-bot/ + patches
• node .github/scripts/changelog.mjs check: ok
• ARCH_DOCS_BASE=origin/main TZ=UTC npm run verify: exit 0, plugin lint + pack-import ok, arch-docs OK; core 1029/0 fail, social 291/0, tree 80/0, timeline 80/0, .github scripts 88/0, interop 37/0, live-e2e 16/0
• CI on the tip: all checks green (tests-ok, ubuntu Node 24, plugins social/tree/timeline, package, risk tier, reviewed tip)
  Not run:
• Live Mac instances (3080/3081) and the production Bot Social server: not restarted or deployed
• A live two-home face room end to end