Lab #2574: Dashboard sidebar is not collapsible on mobile, crushing the main content panel

Problem

The swamp serve dashboard (packages/dashboard) renders with a fixed 220px-wide sidebar navigation on the left and a main content panel. The App.tsx wraps both in <div className="app">, and styles.css defines:

.app {
  display: grid;
  grid-template-columns: 220px 1fr;
  height: 100vh;
}

There are no media queries or responsive breakpoints for the sidebar layout. The only @media (max-width: 900px) rules adjust inner grids (.stats-grid, .panels-grid, .sys-grid), but the root .app grid stays at 220px. On a 375px-wide phone, the sidebar eats ~60% of the screen, leaving ~155px for the main panel — most content goes off-screen or becomes unreadable.

The Sidebar.tsx component has no collapse button, no hamburger toggle, and no mobile-aware behavior whatsoever.

Context

This is the web UI served under swamp serve (route /dashboard/, proxied to the serve API on port 9090). It's a React + Vite SPA in packages/dashboard.

Lab #1283 — "Extensions page: Search bar missing on mobile" (feature, closed)
Lab #1253 — "Search box collapses to near-zero width on mobile on the Extensions page" (bug, shipped)

Those address specific page-level mobile bugs, but there is no overarching issue for the sidebar itself being non-collapsible.

Suggested approach

Add a collapse toggle (hamburger/chevron) to the sidebar header.
On mobile (< 768px or similar), hide the sidebar off-canvas and reveal it via an overlay.
On desktop, allow collapsing the sidebar to an icon-only rail (optional but consistent with Lab #114 which shipped collapsible left rail for the swamp-club website).
Add a @media (max-width: 768px) rule for .app that switches the sidebar to a fixed/absolute off-canvas drawer.

Key files: packages/dashboard/src/App.tsx, packages/dashboard/src/components/Sidebar.tsx, packages/dashboard/src/styles.css

serve shutdown does not wait for worker status writes, and its listener accepts workers after the gateway is disposed

Registry rescore: secret-safe-docs passes a secret README line on versions whose stored metadata predates the sensitive flag (follow-up to #3783)

Docs: manual states the old pre-flight check rule and scores fast-check by deno doc --lint

stagecraft: rename work mode `method` to `behavior`, matching swamp's rename of models to behaviors

behavior validate gives pre-flight checks unparsed global arguments (no zod defaults), unlike behavior run

invalid-acceptance refuses an apostrophe in a swamp-quality-ignore reason and leaves the finding unresolved

extension quality --json reports percentage but not the grade that extension info and the registry show

workflow validate passes a CEL behavior target with a resolvable default, so a misspelled method passes

auth token create --json fields key and signinToken are undocumented; no token-mode service setup page

trigger.schedule is evaluated in the serve host's local time zone, with no zone field and no doc saying so

workflow validate/run say "Workflow not found" for a file that doctor workflows explains is misnamed

telemetry stats says "No telemetry data found" right after successful sends; say the spool is empty because it flushed

workflow validate reports a string-form dependsOn as an [FTL] error with a zod stack trace, not a validation failure

auth login on a non-TTY stdin with no --username prompts, then fails with "Username and password are required"

Homebrew tap README omits the brew trust step Homebrew 7 requires, so brew install swamp refuses the formula

Docs: publish typed-secrets Phase 4.6 expression and delivery semantics

Extension registry page: a supported way to include media (images) in the README

Docs: define the sensitive-output fallback vault order and document the doctor vaults fallback warning

scanFleet: support a different SSH user per host (user@host entries)

CEL: data.latest(...).version is a double, but data.version() only accepts int, so "version - 1" fails at run time

workflow resume --run refuses workflows with the same step name in two jobs, though validate and run accept them

@swamp/cve/dirtyfrag: scan flags suspicious XFRM SAs on every unprivileged Linux scan (greps 'error' in /proc/net/xfrm_stat counter names)

extension push (package.json mode): two installed copies under one declared range are audited once, so the second shipped version goes unaudited

Update public OpenTelemetry manual for remote waterfalls and execution metrics (#3786)

Share the extension quality rubric between the swamp CLI and swamp-club instead of mirroring it

@swamp/cve/dirtyfrag: report and README print the old swamp model command spelling

@swamp/cve/php-rce-2026-10: match RHEL fixes for the PHP RCEs

cve/emudhra page: Windows and macOS support, and shared CVE layer fixes (follow-up to #3710 and #3766)

Docs: dependency trust across push, quality, fmt and the registry — Deno-config resolution, read-only lock, package.json mode, the archive's audit record (merges #3728)

Server-driven warning and info messages to CLI users, targeted by swamp version (exploration)

Serve: delegate namespace-scoped extension pulls and reload without granting administrator access

workflow cancel --server ignores --ca-cert and SWAMP_CA_CERT

Preserve active worker execution across serve restarts and upgrades; reconnect and reattach dispatches

v3: chunk durability barrier costs a full drive-cache flush per command on macOS; use an ordering barrier

vary/forEach object values with no key/name/id produce data names Windows refuses

issue-lifecycle start drops issue comments: context.comments is always empty

swamp core: a non-string sensitive value reads back as a JSON string

Generated vault keys carry raw data-name and vary characters that strict vault providers reject

bundleExtension 'bundles on different caches do not wait for each other' test fails under CPU load

extension install and extension pull leave different bundles for the same extension version

Registry drops contentMetadata.extensions (method grafts) at confirm-push

Multi-model skill eval: gpt-5.4 and gemini jobs fail preflight every run (OpenAI credits exhausted, Google API key invalid)

local_source_failed drops the indexing error: a transient local extension failure leaves no cause (follow-up to 1672)

Finer-grained method locking: a long-running method on one definition blocks unrelated objects managed by the same definition

Surface (or warn about) values a model method returns besides dataHandles, with sensitive-field support

workflow placement: run a workflow transparently on a specified host, local or via swamp workers (incl. nested child workflows)

issue-lifecycle: pr_merged and ship report success and advance the phase when swamp-club is unreachable, writing nothing upstream

auth login leaves auth.json apiKey empty and stores the key only in ~/.config/swamp/api-key, which the auth gate never reads

swamp-extensions CI: Review Integrity explains a stalled or failed audit (streamed progress, timeout, did-not-finish comment)

Workflow run cancellation on concurrency-key conflict

Read non-string sensitive resource fields back with their type

Run index repair-by-stat misses an in-place, same-size record rewrite that restores mtime within the same second as its entry: ctime is reported in whole seconds

Configurable storage tiers: runs, outputs, data versions and audit move through an ordered list of user-defined tiers, and stay queryable across them

A global argument that evaluates to swamp-namespace expression text is silently dropped, and literal() cannot pass it through

serve: the per-IP WebSocket burst limit can't be configured, so workers behind one NAT IP throttle each other

extension pull: safety analysis scans the bundle the extension runs

verification: run the upgrade-path test in parallel, and skip the dynamic test for no-op bumps

S3-backed serve: a poll that pulls one file invalidates the whole data catalog, so the next query re-reads every version

swamp-extensions: CI check that every manifest declares license: and ships a LICENSE file

extensions_search index is never created if the first attempt fails, until the process restarts

S3/GCS datastore sync: shared sync service lets one sync clear another's dirty marks and pull over unpushed files

swamp-uat: the SIGTERM drain test does not check that the run succeeded

stagecraft: a factory-wide read of work items waiting on a person (no studio, no per-item status loop)

stagecraft: rebind a work item to another tracker (mirrored built-in tickets to Jira)

s3-datastore: first push on a fresh cache prints 'Index merge failed' for a missing local .datastore-index.json

swamp-extensions: use explicit npm:/jsr: specifiers in root extensions/models

stagecraft: studio state_test 'after its event stream reconnects' is timing-flaky under load

Activity projector fails with ZooKeeper "Bad version" error on swamp.score_grants during keeper instability

s3-datastore: model-scoped pullChanged lists and walks the whole namespace

extension safety analyzer does not warn on node:child_process or cluster subprocess spawning

extension push: a swamp-quality-ignore directive after a comment holding an apostrophe is silently ignored

Model types: decide whether names like @/@x/y or a+b/c should be legal (type grammar)

seed:collective cannot produce a superseded personal trial or a returned trial, so the UAT cannot cover them

serve HA: pull a token's definition on an auth miss so a peer accepts a new token at once

extension push: accept attestation-backed adversarial-review evidence (lookup by extension and content hash), generated provenance, and carry the evidence to the registry at confirm (design: Lab #3023)

Decide a stricter naming rule for workflow step and job names

s3-datastore/serve: readResource without a version returns an older version; the latest marker is rewritten backwards

Publish agent-facing projections of the manual: /llms.txt, .md pages, and llms-full.txt

Let agent-runner drive more agent CLIs (Kilo Code and others)

s3-datastore: every fast-path miss re-downloads every _index shard, so a busy serve pulls the whole index every poll (~230 GB/day S3 egress)