Why: RDM now anchors annotations on nodeId + textStart + textEnd + textHash
(spec 06 §2) and acceptance 10 §5 requires accurate comment ranges. The
workspace only sent whole-node annotations and ignored quote/needsReanchor.
- Selecting text inside one node's title in the reader view records a
code-point range (Array.from indices; surrogate pairs and ZWJ emoji are
counted as runes, half-pair endpoints widen) and sends textStart/textEnd
plus quote, so RDM rejects rather than misplaces a drifted range.
- No selection keeps whole-node behavior; replies never carry range params;
textHash/range are never sent; a range is dropped if it belongs to another
node.
- Selections spanning several nodes or containing no node text record no
range and show a notice that the whole node will be annotated; the composer
always shows the scope with a "whole node" escape.
- Annotation items show the server quote and a visible needs-reanchor state;
review_anchor_invalid: errors map to readable Chinese text.
- Reader titles become role=button spans because browsers do not allow text
selection inside <button>.
Evidence: npm test 40 files / 486 tests pass (30 new in
test/review-annotation-anchor.test.ts); npm run build exit 0;
node scripts/check-knip.mjs "50 <= 51"; design-guard 7/7; playwright
--list compiles 13 tests; headless Chromium check of the selection reader
(single, multi-node, triple-click clamp, emoji offsets).
Impact: document review UI only; base-gate decision source anchoring is
unchanged. Offsets are computed on the displayed node title (no frozen-text
read endpoint exists), guarded by quote equality on the server.
Refs: unified renderer plan Task 13; phase1 F2; spec 06 §2
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Browser acceptance (/tmp/renderer-browser-acceptance/20261017T061021Z) found
§11-4 showed 25/25 diagnostics as 未定位节点 because the renderer nodeId is the
canonical mapping id (pp.cover.document-number.value) while the workspace tree uses
dn-… ids; RDM now adds treeNodeId to every diagnostic. §11-3 failed only because
the e2e spec still expected 已验证/未发布 although all 44 DHF profiles are published.
Evidence: npx tsc --noEmit exit 0; npx vitest run 39 files / 445 tests passed (4 new
in test/document-render-workspace.test.ts covering treeNodeId, nodeId fallback,
unknown ids and per-node counts); npm run build ok; node scripts/check-knip.mjs
unused exports 51 <= 51; e2e/document-renderer.playwright.ts type-checks (tsc exit 0)
and playwright test --list loads 13 tests. Real rdm.render.profiles payload in
evidence/network/item3-author.jsonl: template rule state=published,
publicationAllowed=true, no blockedReason, refusal controlled_requires_exact_profile.
Impact: normalizeDiagnostics keeps treeNodeId; locateDiagnostic resolves treeNodeId
first and falls back to nodeId, otherwise the diagnostic stays explicitly unlocated.
Badges and the 有诊断问题 filter count by the located tree node. Clicking a located
diagnostic selects the node and scrolls it into view in canvas or reader, also on a
repeated click. Diagnostics loading keeps its single request guard. §11-3 now asserts
已发布, 可正式交付, an enabled option and no reason, and still asserts source, version,
the no-fallback notice and refusal. Not run against a live backend or browser here.
Refs: unified renderer plan Task 13 §11 items 3 and 4; spec 10 §11 item 3;
summary.md root causes §A and §B.
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The base gate (cmdbus.RequiresProjectWorkDecision) refuses rdm.review.doc.approve/reject/final unless the request carries a committed conversation source as top-level conversationId and anchorMessageId. The workspace sent bare params, so the decision buttons were refused in the real product.
Evidence: vitest 39 files / 441 tests passed (22 new in test/document-decision.test.ts); npx tsc --noEmit clean; npm run build ok; check-knip unused exports 51 <= 51; e2e/document-renderer.playwright.ts type-checks and lists 13 tests. Request shape from pins/agent-system-backend: internal/server/server.go:1276-1304 (body decode), internal/cmdbus/cmdbus.go:109-134 and 385, internal/app/app.go:646-665 (preflight), server.go:1010-1150 (message POST returns the committed message).
Impact: approve/reject/final first post a Chinese decision message to the host project's 文档审签记录 conversation (reused, or created), then dispatch with its id as the anchor (entrance button). Identity is never sent. Any failing step shows a readable refusal and nothing is dispatched. Double-click is ignored while an action is in flight, and retries reuse the operation id so the server returns the same source message. rdmCommand takes an optional source; rdm.render.* is unchanged. The e2e spec drives §11-5c through the workspace only and asserts the anchored, committed receipt. Not run against a live backend or browser here.
Refs: unified renderer plan Task 11; RDM cmdbus gate (pins/agent-system-backend internal/cmdbus/cmdbus.go:109-134); live-verify sequence /tmp/live-verify/run.sh lines 56-70 and 140-146.
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The renderer browser acceptance still recorded GAP markers for approve, final, rule binding and the full package, which the workspace now provides; the spec must exercise those entries through the UI first, falling back to the API only when an entry is absent.
Evidence: tsc --noEmit on e2e/document-renderer.playwright.ts exits 0; playwright test --list loads 13 tests (adds §11-2b and §11-3b); the spec still skips without PLAYWRIGHT_BASE_URL and RBA_OUT, so no browser run was possible here; leak scan in §11-8 is untouched.
Impact: approve and final are attempted from the workspace and asserted by success text or a readable failure; the package download asserts a ZIP header; binding asserts the refresh and the controlled-document refusal copy. Not run against a real product in this session.
Refs: unified renderer acceptance §11 items 2, 3, 5 and 6; RDM 7169944 (review decision contract), 4b7ac2a (profile bind), 75ba50c (package).
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Probes sent with page.request do not raise page response events, so
the §11-8 leak scan only covered passive page responses.
Evidence: Final run 20261016T065123Z item8-scan.json counted 18 responses,
all passive; probe bodies were checked only for rejection and payload.
Impact: Every probe and host API body is scanned for project A names, the
controlled and uncontrolled document titles and review markers.
Refs: unified renderer plan Task 13 §11
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The Task 11 spec was never run and assumed a seed, login gate and
navigation the real product does not have. §11 acceptance needs all nine
items covered with three duties, two projects, auth on, screenshots,
network logs and leak scanning for the user without permission.
Evidence: Driven by /tmp/renderer-browser-acceptance/browser-acceptance.sh
against RDM d63f1db; per-test results, screenshots, downloads and network
logs under $RBA_OUT/evidence; receipt composed into browser-receipt.json.
Impact: Product capability gaps are recorded as soft GAP/BLOCKER failures
naming the owning repository instead of being skipped; steps only reachable
by direct commands in the user's own session are tagged API_ASSISTED.
Refs: unified renderer plan Task 13 §11
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Independent review of a81e94a..85428b4 found five contract mismatches
against the RDM server: profile sources document-type/project-default were
dropped, the refusal object {code,message} was ignored, submit receipts were
read as `id` instead of `submissionId`, diagnostics were expected inside
preview/export receipts (they live in a separate diagnostics delivery blob),
and rdm.inspect.tree was treated as recursive although it returns one level.
Evidence: New tests use the server JSON shapes (RenderProfileOptions,
RenderDeliveryReceipt, DocSubmissionRec, rdmRenderDownload, InspectTree); 26
of them fail against the previous implementation. npx vitest run: 35 files,
359 tests passed; npm run build: ok; scripts/check-knip.mjs: unused exports
43 <= 43; git diff --cached --check: clean.
Impact: Rules panel lists all five sources with Chinese labels and keeps the
server's selected default; refusals render readably; a new submission is
auto-selected; diagnostics are fetched via rdm.render.download kind=diagnostics
under a sequence/epoch guard with readable failures and a Chinese receipt
state label; the document tree is walked breadth-first (depth 12, 2000 nodes,
concurrency 4) with a truncation notice. Playwright spec asserts per-node
diagnostic anchors after preview (authored, not run).
Refs: unified renderer plan Task 11 review findings
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: unified renderer Task 11 needs a reader/delivery UI over the RDM
document tree: four-level rule selection with controlled-document
no-fallback explanation, preview with node-linked diagnostics, a
structure canvas and a linear reader sharing one selection and filter,
review annotations/revisions, and per-delivery downloads.
Evidence: npx vitest run -> 35 files, 338 tests passed (45 new in
test/document-render-workspace.test.ts, design-guard green);
npm run build -> tsc -b + vite build ok; npx knip -> findings identical
to the pre-existing baseline (check-knip 43 <= 43); git diff --check
clean. e2e/document-renderer.playwright.ts authored, not executed.
Impact: new src/documentRenderPresentation.ts (pure helpers) and
src/components/DocumentRenderWorkspace.tsx, opened from a per-document
"阅读与交付" action in the audit materials tree; store gains an
rdmRender capability probe (fail-closed); audit export reuses the shared
base64 file saver; token-only styles appended to styles.css. Async
state is owned per hook with request guards plus identity epoch, and
the workspace remounts per identity/project/document scope.
Refs: unified renderer plan Task 11
Co-authored-by: Cursor <cursoragent@cursor.com>
