Why: at 390px the single-pane layout lands on 对话 after login and hides
the whole context sidebar (both sidebar and rail forms); scenario 7 must
switch to the 上下文 pane via the top bar before the entry exists.
Evidence: tsc clean, vitest green, build green (SELF); seven-scenario
rerun to be recorded on the Dev I4 card.
Impact: e2e spec only.
Refs: rollout I4
Why: at 390px the compact layout swaps the sidebar for an icon rail; the
cockpit entry remains reachable as an icon button but not as .tsb-tool,
so scenario 7 timed out waiting for the sidebar form.
Evidence: tsc clean, vitest green, build green (SELF); seven-scenario
rerun to be recorded on the Dev I4 card.
Impact: e2e spec only.
Refs: rollout I4
Why: the cockpit refresh reloaded overview and tree but left the node
detail at its old snapshot, so the 刷新对齐 banner persisted after
refreshing (DV-R05 wants every projection to advance). PanoramaNode now
refetches when the overview snapshotRevision advances. Scenario 4 also
scoped its tree clicks to the 验证主体报告 branch — the unscoped first
caret expanded an unrelated rdm-self doc.
Evidence: tsc clean, vitest green, build green (SELF); seven-scenario
rerun to be recorded on the Dev I4 card.
Impact: cockpit panorama + e2e spec.
Refs: rollout I4
Why: scenario 4 relied on a pending draft proposal advancing the
snapshot watermark, but rdm.draft.propose commits nothing (wm:58 before
and after) and draft adoption is high-danger (client cannot forge
Confirmed). rdm.reqs.import with a unique probe item is a committed
low-danger mutation that advances the watermark — the honest DV-R05
driver.
Evidence: tsc clean, vitest green, build green (SELF); wm 58->60 probe
against the seeded data recorded in session.
Impact: e2e spec only.
Refs: rollout I4
Why: the I4 scenarios assert the version collapsible for a selected
section in the panorama (not only the reader); the panorama node view
had no version block, so .cockpit-versions-toggle never existed there.
Also normalize null list projections in the panorama node detail fetch
(same Go nil-slice issue fixed for the panel earlier).
Evidence: tsc clean, vitest green, build green (SELF); seven-scenario
rerun to be recorded on the Dev I4 card.
Impact: cockpit panorama only.
Refs: rollout I4
Why: rdm.cockpit.node projects empty conflicts as items:null (Go nil
slice) while sources arrive as []; the panel read items.length on null
and crashed, so the conflicts empty state never rendered (I4 e2e
scenario 3).
Evidence: tsc clean, vitest green, build green (SELF); seven-scenario
rerun to be recorded on the Dev I4 card.
Impact: cockpit panel only.
Refs: rollout I4
Why: the local ProjectView interface invented 'id'; rdm.project.list
returns projectId. Every option value was undefined, so auto-select set
pid to undefined and the overview request was never issued — cockpit
showed 加载概览… forever after the project list loaded (I4 e2e scenario 1).
Evidence: tsc clean, vitest green, build green (SELF); network probe shows
rdm.cockpit.overview 200 and .cockpit-stats rendered; seven-scenario rerun
to be recorded on the Dev I4 card.
Impact: cockpit entry only.
Refs: rollout I4
Why: the cockpit rendered the project dropdown with no project selected
and an empty main area — the design's 首屏 default (first visible project
drives the overview) was never implemented; caught by I4 e2e scenario 1
which got past the project list but never saw .cockpit-stats.
Evidence: tsc clean, vitest green, build green (SELF); seven-scenario
rerun to be recorded on the Dev I4 card.
Impact: cockpit entry only.
Refs: rollout I4
Why: #102 rewrote the bare-array fallback into a multi-line callback and
turned 'if (!c) setProjects(...)' into an early 'if (!c) return', which
skips setProjects on the normal (non-cancelled) path — the cockpit then
hangs on 加载中 forever, caught by I4 e2e scenario 1.
Evidence: tsc clean, vitest 324/324, build green (SELF); seven-scenario
browser suite rerun recorded on the Dev I4 card.
Impact: cockpit entry only.
Refs: rollout I4
Why: the forced password gate still submitted an empty current password
after the backend began requiring it (current_required), locking every
account seeded with an initial password out of the workbench, and the
admin user panel had no client for the owner-confirmed recovery
proposal contract that replaced one-time key issuing (HTTP 410).
Evidence: npm test 300 passed; tsc -b && vite build ok; knip issues
54 <= baseline 55 (SELF).
Impact: mode-aware ChangePasswordGate with current-password input,
admin recovery proposal panel, owner-side account settings section,
recovery proposal client methods; no backend changes.
Refs: backend 8dfc223, b9c0a34; frontend #94
Why: independent review flagged the issue client still targeting the 410
endpoint and a hint sentence ending with a period.
Evidence: npm run build + npm test re-run on the fix (SELF).
Impact: api client surface only.
Refs: review brief /tmp/review-brief-admin-user-contract.md
Why: backend 8dfc223 replaced POST /api/admin/users with strict
{owner, profile} decoding and returned 410 for login-key issuing, so the
UI create form failed with 400 unknown field name. Creation now sends
{owner, profile:{name}} only; password input, admin checkbox and the
login-key issue entry are removed; notice points to the local CLI
initialize-account flow. passwords.ts lost its only consumer.
Evidence: npm run build + npm test (34 files/293 passed) + knip identical
to baseline on the task worktree (SELF).
Impact: UsersPanel and api client only; no style/token changes.
Refs: backend 8dfc223, b9c0a34
Why: S9 acceptance finding 3 — the project settings modal exposed the
host override settings (including the model/key group, masked) to plain
project members; the duties data plane was already permission-enforced,
but the host settings surface had no gate.
Evidence: vitest 34 files / 293 tests pass with the change; tsc reports
no errors in the modified file. Ruling per the acceptance plan P1-B:
the modal entry stays (granted duty managers need the RDM tabs), while
the host override settings group renders only for the project owner or
a system admin; RDM tabs keep their own fail-closed gating.
Impact: ProjectSettingsModal project tab renders an explanatory empty
state for non-privileged viewers; members/duties/matrix tabs unchanged.
Refs: S9 acceptance report P1-B
Why: Approving an extra package, rebuilding the base layer, reclaiming unused layers, and uploading a wheel need an admin surface that uses the existing admin controls.
Evidence: SELF tsc of the new panel reported no errors in frontend sources. UI package type errors come from missing node_modules in this worktree, not from this panel.
Impact: Administrators get a Python 环境 section. Other admin sections are unchanged.
Refs: .task/feature-layered-python-env.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: a lost write response was keeping the old duty version, so the next save replayed it, and a busy save could stay locked if another request advanced the sequence.
Evidence: SELF vitest duty-draft 6 passed, tsc passed, knip 43, Playwright duty flows 3 passed.
Impact: an unknown save reloads server roles, confirmation resets, and busy clears even if a later read is discarded.
Refs: docs/proposals/2026-10-15-rdm-duty-matrix-rework.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: project settings must keep the shared duty draft and must not regain template document creation from main.
Evidence: SELF vitest 292 passed, tsc --noEmit passed, knip unused exports 43.
Impact: the duties tab stays assignment-only while conversation ordering from main is included.
Refs: docs/proposals/2026-10-15-rdm-duty-matrix-rework.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Wait for the unrelated foreground reply before measuring duplicate replies.
Evidence: All 24 scenarios passed against deployed 8788; independent replay passed the targeted scenario.
Impact: Test synchronization only; the duplicate-reply assertion is unchanged.
Refs: Agent-System-Frontend #89; Agent-System-Dev #565
Why: Completion or progress from an earlier task could appear in the process of an unrelated newer answer.
Evidence: The new ownership regression fails before the guard and passes afterward; the frontend suite, TypeScript and unchanged export gate pass.
Impact: Project child progress only into its originating live turn while still reconciling background results.
Refs: feature/workbench-flow-completion chronological display requirement
Why: Full execution history must retain outputs after the 500-event API page boundary.
Evidence: Ordered 502-event replay and nonadvancing-cursor rejection tests pass.
Impact: Add regression coverage only; production source is unchanged.
Refs: feature/workbench-flow-completion review testing gap
Why: the settings page only needs the draft operations the views call. Extra aliases and unused helpers pushed the unused-export count over the baseline.
Evidence: SELF node scripts/check-knip.mjs reported 43 <= 43, and duty-draft vitest passed.
Impact: chapter-review command aliases are gone from the settings gate. The draft behavior is unchanged.
Refs: modules/frontend/knip-baseline.json
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: A rejected result-reference request could discard the user text or uploads after the composer cleared.
Evidence: 286 frontend tests, TypeScript and the unchanged unused-export gate pass; mixed-input browser regression preserves the draft.
Impact: Validate incompatible inputs before clearing, retain failed pending input with its request identity, and require explicit retry while other messages can continue.
Refs: feature/workbench-flow-completion review frontend-races finding
Why: the three views, the blocked empty-reviewer save, and the narrow-screen matrix need a browser check that does not depend on a live account.
Evidence: SELF playwright e2e/rdm-duties.playwright.ts, 3 passed against the local Vite server.
Impact: the duties end-to-end file now drives assignment, stale responses, and the narrow-screen guidance.
Refs: feature/rdm-duty-matrix
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the settings page was mixing duty assignment with whole-document review and chapter objects. The three views need one draft and one save check.
Evidence: SELF vitest run of the frontend suite, 278 tests passed, including duty-draft and design-guard.
Impact: the duties tab assigns existing documents only. Submit, approve, reject, and final stay out of this page. Commands that are not ready keep the tab hidden.
Refs: feature/rdm-duty-matrix
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: The frontend unused-export gate rejected a helper used only within its module.
Evidence: The unchanged knip baseline and TypeScript checks pass.
Impact: Remove an unnecessary export without changing replay behavior.
Refs: feature/workbench-flow-completion
Why: Keep persisted task decisions aligned across Go and TypeScript.
Evidence: make contracts generated both consumers from Core 1a5ef6b.
Impact: Include the reserved run identity and typed dispatching state.
Refs: feature/workbench-flow-completion
Why: Repeated progress and coupled scrolling obscured chat, and task choices lacked a reliable independent interaction path.
Evidence: 285 frontend unit tests and 23 browser scenarios pass locally before the shared event-loader extraction; final combination checks follow in Dev.
Impact: Coalesce cumulative progress, retain execution records, show timestamps and quiet notifications, support versioned work actions and explicit result references without automatic chat backfill.
Refs: feature/workbench-flow-completion
Why: Consume the Core work result and optional decision snapshot.
Evidence: Generated with make contracts from Core 00f1826.
Impact: Add optional types without changing existing cards.
Refs: feature/workbench-flow-completion
Why: Independent review found component-local color derivation, a private transition, and missing dark/molv coverage in the visual candidate.
Evidence: Frontend design guard passes and 19 Playwright scenarios cover light, dark, molv, and 320-1920px layouts.
Impact: Keeps the approved visual direction while moving color ownership to @ui tokens and removing private motion.
Refs: Agent-System-Dev feature/workbench-visual-redesign
Why: The inherited light-theme divider and hover treatment disappeared inside the new inverse create button.
Evidence: Focused browser layout test and production build pass locally.
Impact: Changes only the create action divider and hover surface.
Refs: Agent-System-Dev feature/workbench-visual-redesign
Why: Spacing-only refinements still looked like the original flat gray workspace and did not satisfy the approved visual redesign.
Evidence: 272 unit tests, 16 browser scenarios across 320-1920px, and the production build pass locally.
Impact: Gives navigation, authored messages, assistant results, and work details clearly different visual surfaces while preserving behavior.
Refs: Agent-System-Dev feature/workbench-visual-redesign
Why: The three-column workspace read as flat and visually scattered, making conversation, current work, and navigation difficult to distinguish.
Evidence: 272 unit tests, 16 focused browser scenarios across 320-1920px, and the production build pass locally.
Impact: Refines the existing workbench presentation without changing its data flow or fast/slow task behavior.
Refs: Agent-System-Dev feature/workbench-visual-redesign
Why: Status words shared with a final reply could suppress a child completion record.
Evidence: 272 frontend unit tests, build, and 15 isolated browser scenarios.
Impact: Tag client-side collaboration replay so partial-delta deduplication preserves agent notes.
Refs: Agent-System-Dev feature/work-companion-visibility UI1
Why: A dropped delta batch can leave a short event prefix next to the complete saved message.
Evidence: 271 frontend unit tests, build, and 14 isolated browser scenarios.
Impact: Suppress overlapping partial replay text and thinking while retaining saved content.
Refs: Agent-System-Dev feature/work-companion-visibility UI1
Why: Event replay could hide saved retry notes and leave completed cards outside the active work filter.
Evidence: 270 frontend unit tests, build, and 14 isolated browser scenarios.
Impact: Merge replay into saved history, retain child progress, and locate cards under the right scope.
Refs: Agent-System-Dev feature/work-companion-visibility UI1 UI2
Why: Fast and slow channel cards duplicate across panes and completed replies hide process output.
Evidence: npm test; npm run build; 12 isolated Playwright scenarios with reload and responsive widths.
Impact: Preserve ordered folded process history, load durable run events, and give work cards one detailed pane.
Refs: Agent-System-Dev feature/work-companion-visibility UI1 UI2 UI3
Why: Complete the authorized export entry while preserving current main project and session behavior.
Evidence: SELF full frontend tests and build, 263 unit tests; deferred browser races reproduced then all 6 passed. Raw records stay outside source until Dev task closure.
Impact: Export callbacks are invalidated on project, identity and unmount changes. Command readiness and current main security paths remain intact.
Refs: Dev PR #488; Frontend PR #73; user takeover authorization on 2026-10-14
Why: Current main carries the same corrected lowercase command ID as this member candidate.
Evidence: Preserve the canonical wrapper and set-role ID; compare the final tree against the independently tested 2ba275b object.
Impact: Update ancestry only; no intended product behavior change.
Refs: Frontend PR83; project-member-access
Why:
Fresh documents had no first-submit action, reading active duties opened
confirmation dialogs, and delayed detail or status queries could overwrite
another selection and send its document ID with the wrong duty draft.
Evidence:
SELF real-browser regressions observed the missing action, render-time
dialogs, detail/status races, and a follow-up query after panel unmount.
Five focused Playwright scenarios passed after the fix, together with the
full npm test, npm run build, and git diff --check commands. Receipts:
/tmp/project-member-duties-browser-green-20261013.json and
/tmp/project-member-duties-full-build-green-20261013.json.
Impact:
Offer first submission independently of an existing review round. Ask for
invalidation only on a dirty save click. Guard queries and continuations
with project lifetime, selection, and request sequences; keep the existing
Picker, canonical project routing, controls, and UI tokens.
Refs:
Dev project-member-access Task 4; independent synchronized Frontend P2 review
Why: Current main supplies member pickers and duty catalogs that must keep verified project identity.
Evidence: Frontend 259 tests and build pass after resolving panel conflicts; final canonical set-role dispatch and fixed combo checks follow.
Impact: Preserve upstream panels with canonical project commands and read-versus-work state guards.
Refs: feature/project-member-access; origin/main c294835
Why:
Project readiness is a write gate. Applying it to member, permission, and
document status queries hides history that the backend intentionally keeps
readable after archival or closure.
Evidence:
SELF archived and closed read regressions failed before the fix. Full npm
test, npm run build, and git diff --check passed with the amended code.
Receipts: /tmp/project-member-frontend-archived-read-red-20261013.json and
/tmp/project-member-frontend-archived-read-green-20261013.json.
Impact:
Resolve canonical project IDs separately from command readiness. Preserve
known read commands and existing settings tabs for historical projects;
keep mutations and new work blocked with existing disabled controls.
Server authorization remains authoritative.
Refs:
Dev project-member-access Task 4; independent Frontend review P2
Why:
An identity can change after an operation has passed its first response guard.
Later project loads, cleanup calls, and attachment refreshes must not reopen
private context or return the previous account's result to the new session.
Evidence:
SELF regressions failed before the guards: delayed project opening, task
creation success, completed-card cleanup, and upload artifact-ID return.
SELF npm test, npm run build, and git diff --check passed; full command
receipt: /tmp/project-member-frontend-final-checks-20261013.json.
Impact:
Guard post-await continuations with the same identity epoch. Preserve the
original server-side result and ignore stale client projections; do not undo
the previous account's already completed work.
Refs:
Dev feature-project-member-access implementation plan Task 4
Why:
Project members need RDM commands to address the registered domain project.
Failed project states and responses from a previous account must not create
work, report a rejected mutation as successful, or restore private content.
Evidence:
SELF npm test: 32 files and 251 tests passed, including project command,
mutation rejection, archived history, and delayed account response coverage.
SELF npm run build and git diff --check passed. Original regressions were
observed before implementation; root owns composition and independent replay.
Impact:
Keep host IDs for conversation and base settings APIs; send the decorated
domain ID to RDM project commands. Reuse existing sidebar, settings and toast
states. Reset identity projections and invalidate old asynchronous responses.
No deployment, database change, push, merge, or workspace cleanup.
Refs:
Dev feature-project-member-access task card and implementation plan Task 4
Why: The login recovery contract requires a real-browser acceptance
spec covering admin issue -> key-only redeem -> forced set-password ->
relogin, and the changepw spec needed the same deterministic gate
synchronization.
Evidence: Both specs pass against an isolated auth-on instance
(serve --auth on, binary backend=467718a+frontend=9fc7da2); receipts
be7ae9a2/b3a9e691 bound to Dev HEAD 268ef29 (SELF). changepw-form also
passes (5.9s) alongside login-key (12.2s) on a reused instance,
proving idempotency.
Impact: New e2e/login-key.playwright.ts (skip-guarded like existing
suites); changepw login() waits for the gate heading and success page
before returning to login, fixing a stale-fill race that submitted
empty gate fields.
Refs: Dev docs/svc-deploy/2026-10-13-login-recovery-contract.md; Dev PR #504.
Why: The 2026-10-13 login contract makes username/password the default
login, replaces the browser ask_ tab with a one-time recovery key
entry, requires the forced set-password gate to drop the current
password field, and routes admin password recovery through admin-issued
login keys instead of direct password resets.
Evidence: vitest 218 passed, npm run build OK, check-knip 43<=43,
design-guard green (SELF, local run in task worktree).
Impact: LoginPage gains a redeem-only key tab (no key persistence);
ChangePasswordGate shows server-confirmed owner plus new/confirm only
and returns to the login page after success (reloginRequired); App
gates on sessionScope=set_password_only; UsersPanel replaces reset
password with issue/revoke login key UI showing plaintext once.
Refs: Dev task feature/svc-login-recovery-flow; backend companion
commit 467718a.
Why: when rdm.role.list is rejected (e.g. the operator lost the RDM
domain-admin ledger to an acceptance bootstrap), the roles table spun on
'加载中…' forever and the banner dumped the raw 400 receipt JSON.
Evidence: vitest test/rdmroles-reject.test.ts (SELF, run below); manual
repro on 8788 dev 2026-10-13 before the ledger fix.
Impact: placeholder row comes from rolesListPlaceholder (failure row when
a fetch rejected), domain-admin denials map via describeRoleListError to
a readable message naming the rdm.perm.transfer channel; other errors
pass through. No style tokens touched (design-guard clean).
Refs: Dev task feature/rdm-admin-lockout-recovery (R3)
Why: Upload inventory alone did not prove that the attachment-only user message included and persisted all three materials.
Evidence: Real upload IDs match the empty-text POST and the same user artifact_ref parts before and after reload; both live cases pass.
Impact: Stronger acceptance evidence only; retain mock-runner model-quality limits.
Refs: ce-code-review 20261012-165912-cb241b46 #4, UI01/UI04/U5
Why: Ordinary explanations were folded with tool activity and the oldest result was selected as current work.
Evidence: Findings #5/#6 red-to-green actual-component and live-projection checks are retained; current full Frontend suite passes 210 cases.
Impact: Preserve business text, errors and file references in reading order; retain active/pinned priorities and newest-first host ordering.
Refs: ce-code-review 20261012-165912-cb241b46 #5/#6, UI03/UI05
Why: Background frames blocked terminal reconciliation, stale failures left confirmations busy, and delayed page hydration changed mobile navigation.
Evidence: Review findings #1/#2/#3 have recorded red-to-green checks; all 210 Frontend tests, tsc and knip pass, plus six real navigation browser checks.
Impact: Keep sequence high-water and operation ownership, merge observations by object, and use an explicit preview-opening intent.
Refs: ce-code-review 20261012-165912-cb241b46 #1/#2/#3, UI04/UI09/UI10/UI11
Why: Retained React nodes alone did not prove actual browser scrolling was preserved.
Evidence: The settled Chromium case failed on the previous bundle, then all 11 browser cases passed with exact material, scroll and focus assertions.
Impact: Browser regression coverage only; fixture transport stays outside the production bundle.
Refs: UI10, ce-code-review UI finding #3, work-companion-ui
Why: Opening the auxiliary work pane should keep the conversation compact.
Evidence: Existing Playwright browser suite passed all 10 cases, including finished Collapsible transition.
Impact: Test and screenshot timing only; product behavior is unchanged.
Refs: Dev feature/work-companion-ui, UI03
Why: make material, background work, confirmations and files accessible to nontechnical users across desktop and mobile.
Evidence: Dev SELF receipts for Frontend tsc, 190 tests, knip baseline, build, nine fixture browser cases and two real HTTP/browser smoke cases using MockRunner.
Impact: existing API and permissions remain authoritative; stale events/queries and duplicate effects are guarded, while one file preview and reading state are preserved.
Refs: work-companion-ui design r0.2 and plan r1 U2-U5; UI01-UI13.
Why: auditors need to generate and download a watermarked report from the overview, and that must not appear when the export commands are off or change whether the workspace itself opens.
Evidence: SELF npm test, 138 passed. Playwright download case is in e2e/rdm-audit.playwright.ts and runs under scripts/e2e.sh.
Impact: the overview shows type, generate, draft confirmation, watermark, sha256, expiry, and download only when the three export commands are enabled.
Refs: RDM pull request 301
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Existing event and helper tests missed the SurfaceMeta to snapshot
reload path that blanked the app after the integration pointer regressed.
Evidence: New restore regressions fail on 1edd872 and pass on compatible
main; independent reviewer replays and real browser contract replay are
recorded in the Dev surface-black-screen-recovery task card.
Impact: Tests only; protects reload, partial failure, newer live revisions,
conversation switching, and two-page browser preview.
Refs: Frontend #68; Dev #454 and #452; Dev surface-black-screen-recovery
weichen
