feat(hub): pin the app controls while a library scrolls

Files, Videos, Music and Photos are read by scrolling, and everything that
steers that reading left with the first screenful. Three bands now pin under
the navigation bar, in a group and on the Search page alike: the tab bar (the
search field, on Search), the application's own toolbar, and the file table's
column heads. The group's name and description still scroll — they say nothing
a reader needs while walking a directory, and the height they would cost is
height the list does not get.

A band's offset is the heights of the bands above it, and those are not
constants: the toolbar wraps to three rows on a phone, grows a field while a
folder is being named, and loses its filter on Search. So each band measures
itself and publishes `--chrome-h` / `--toolbar-h` (static/sticky.js) and the
stylesheet does the arithmetic in calc(), rather than a number written down
twice — the fault CLAUDE.md already records against this layout twice over.
A band publishes height *plus its own bottom margin*, and paints that margin
as a ring of page colour, so the pinned layout is pixel-identical to the flow
layout and nothing shifts at the moment a band pins.

Three overflow faults came out of it, all of the same class and all of them
what "the header does not stay" actually meant on Android — a document wider
than the screen leaves everything pinned attached to a viewport the reader can
no longer see, the navigation bar included:

  - a directory's name cell was a bare <td>, so an unbreakable folder name
    (`Rage_Against_The_Machine_Discography_1992-2000_FLAC`) set the column's
    minimum: a 527px table in a 390px window
  - Search's group column did the same at 442px with an underscored group
    name. It also goes entirely below 768px, where there is no room for it and
    the breadcrumb already names the group
  - the shared-directories table has four columns of controls with a combined
    minimum near 440px, none of it compressible. On a phone the row stops
    being a row: the name and its eject/remove pair on one line, the two
    switches — each carrying the column head's own string as a label — on the
    next
  - and, found by measuring at 360px, the tab bar itself was 19px too wide

`.file-table` moves to separated borders: a collapsed border belongs to the
table rather than to the cell, so the column heads lost their rule the moment
they pinned.

Measured, not read. tests/harness/sticky_header_probe.py drives the shipped
GroupPage and SearchPage against a stub node, walks to each application,
scrolls to the end and reports every rectangle — 11 views x 4 widths x 2
engines. Its fixture says what real data says: the first version used
`note-007.txt` and `un groupe`, which fit any screen, and found none of the
above. A fixture narrower than real data tests the fixture.

Also: `test_desktop_shell` no longer looks for the CSP after the first `-->`,
which made it fail on correct markup as soon as a comment was added above it,
and `search-page.js` joins test_hook_ordering's file list.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Tx16FhyD2BUdpooGb5jcyN

1 files changed, 24 insertions, 0 deletions

diff --git a/CLAUDE.md b/CLAUDE.md
index b02eda7..269598e 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -533,6 +533,30 @@ anything that assumes one key per person.
   bound. Every await on a download path is now bounded and says which chunk it
   gave up on — an unbounded one is a freeze nobody can report
 
+- **A name with no spaces in it sets a table column's minimum width, and on
+  Android that unpins the whole page.** Sticky headers were added to Files,
+  Videos, Music and Photos on 2026-09-09 and reported broken on a phone: not
+  the new bands but *everything*, the navigation bar included, which had been
+  `position: sticky` for months. That is the tell. A document wider than the
+  screen leaves everything pinned attached to a viewport the reader can no
+  longer see, so a header doing exactly what it was told looks like one that
+  was never pinned — **look for horizontal overflow before doubting the
+  sticky rules**. The overflow came from two `<td>`s that had no wrapping rule
+  because `.file-name` was only ever on a *file's* name: a folder called
+  `Rage_Against_The_Machine_Discography_1992-2000_FLAC` made a 527px table in a
+  390px window, and Search's group column did the same at 442px with an
+  underscored group name. `word-break: break-word` is what lets such a cell
+  stop driving the column, and it has to be on every cell that carries a name
+  somebody else chose.
+  Two things cost more than the fix. The harness had measured this page in two
+  engines at three widths and found nothing, because its fixture said
+  `note-007.txt` and `un groupe` — **a fixture narrower than real data tests
+  the fixture**, and names are the one thing a file browser cannot be given
+  short. And a first diagnosis blamed the soft keyboard (the Search field is
+  `autofocus`, and Android's `interactive-widget` default splits the visual
+  viewport from the layout one), which was plausible, cost a round trip, and
+  was wrong; the screenshot showing no keyboard was already in hand.
+
 - **Three headers decide whether a page may frame itself, and they must agree.**
   The same streamed download navigates a hidden iframe to `/_mbdl/<id>`.
   `frame-src` was reCAPTCHA's two origins with no `'self'`, `frame-ancestors`