Why: Keep the completed settings flows readable without adding unused API exports or duplicate helpers.
Evidence: SELF /tmp/project-settings-simplify-green-20261014-973d52c1.json records settings tests/vet, 284 Frontend tests, typecheck, the unchanged knip baseline and diff checks. Reuse and quality passes were independent read-only agents; efficiency was reviewed inline after the host rejected another review thread.
Impact: Preserve scope rules, write guards, DTOs, errors and ordering. Reuse Core ownership constants and path lookup; remove unused exports and keep permission selection in a typed local state.
Refs: P1/P7, docs/records/2026-10-14-rdm-settings-completion-contract.md
Why: Frontend and UI must consume the same Core scope vocabulary.
Evidence: Generated by make contracts; SELF /tmp/project-settings-contract-types-20261014-973d52c1.json records both TypeScript checks.
Impact: Generated contract update only; the Core object is fixed by the Dev composition.
Refs: P1, docs/records/2026-10-14-rdm-settings-completion-contract.md
Why: Raw identifiers and mixed settings scopes made project administration difficult and hid authorization boundaries.
Evidence: SELF receipts /tmp/project-settings-frontend-full-green-20261014-973d52c1.json and /tmp/project-settings-browser-fixture-final-20261014-973d52c1.json record 284 tests, typecheck, build and 15 real React browser fixture flows. Live composition and formal acceptance remain NOT_RUN.
Impact: Add searchable member and document selectors, role filters, versioned duty changes, removal impact review and shared permission details/matrix. Consume server capabilities and settings scopes, preserve personal preferences and default restoration, and discard late responses.
Refs: P3/P4/P5/P6/P7, docs/records/2026-10-14-rdm-settings-completion-contract.md
Why: the approved role filters, document lookup, capabilities and readable labels are still absent.
Evidence: SELF red receipt /tmp/project-settings-frontend-red-20261014-973d52c1.json reproduced five missing behaviors before implementation.
Impact: regression tests only; this test-first checkpoint intentionally precedes implementation and is not a passing candidate.
Refs: approved settings increment P3-P7; Dev feature/rdm-settings-completion
Why: Current main carries the same corrected lowercase command ID as this member candidate.
Evidence: Preserve the canonical wrapper and set-role ID; compare the final tree against the independently tested 2ba275b object.
Impact: Update ancestry only; no intended product behavior change.
Refs: Frontend PR83; project-member-access
Why:
Fresh documents had no first-submit action, reading active duties opened
confirmation dialogs, and delayed detail or status queries could overwrite
another selection and send its document ID with the wrong duty draft.
Evidence:
SELF real-browser regressions observed the missing action, render-time
dialogs, detail/status races, and a follow-up query after panel unmount.
Five focused Playwright scenarios passed after the fix, together with the
full npm test, npm run build, and git diff --check commands. Receipts:
/tmp/project-member-duties-browser-green-20261013.json and
/tmp/project-member-duties-full-build-green-20261013.json.
Impact:
Offer first submission independently of an existing review round. Ask for
invalidation only on a dirty save click. Guard queries and continuations
with project lifetime, selection, and request sequences; keep the existing
Picker, canonical project routing, controls, and UI tokens.
Refs:
Dev project-member-access Task 4; independent synchronized Frontend P2 review
Why: Current main supplies member pickers and duty catalogs that must keep verified project identity.
Evidence: Frontend 259 tests and build pass after resolving panel conflicts; final canonical set-role dispatch and fixed combo checks follow.
Impact: Preserve upstream panels with canonical project commands and read-versus-work state guards.
Refs: feature/project-member-access; origin/main c294835
Why:
Project readiness is a write gate. Applying it to member, permission, and
document status queries hides history that the backend intentionally keeps
readable after archival or closure.
Evidence:
SELF archived and closed read regressions failed before the fix. Full npm
test, npm run build, and git diff --check passed with the amended code.
Receipts: /tmp/project-member-frontend-archived-read-red-20261013.json and
/tmp/project-member-frontend-archived-read-green-20261013.json.
Impact:
Resolve canonical project IDs separately from command readiness. Preserve
known read commands and existing settings tabs for historical projects;
keep mutations and new work blocked with existing disabled controls.
Server authorization remains authoritative.
Refs:
Dev project-member-access Task 4; independent Frontend review P2
Why:
An identity can change after an operation has passed its first response guard.
Later project loads, cleanup calls, and attachment refreshes must not reopen
private context or return the previous account's result to the new session.
Evidence:
SELF regressions failed before the guards: delayed project opening, task
creation success, completed-card cleanup, and upload artifact-ID return.
SELF npm test, npm run build, and git diff --check passed; full command
receipt: /tmp/project-member-frontend-final-checks-20261013.json.
Impact:
Guard post-await continuations with the same identity epoch. Preserve the
original server-side result and ignore stale client projections; do not undo
the previous account's already completed work.
Refs:
Dev feature-project-member-access implementation plan Task 4
Why:
Project members need RDM commands to address the registered domain project.
Failed project states and responses from a previous account must not create
work, report a rejected mutation as successful, or restore private content.
Evidence:
SELF npm test: 32 files and 251 tests passed, including project command,
mutation rejection, archived history, and delayed account response coverage.
SELF npm run build and git diff --check passed. Original regressions were
observed before implementation; root owns composition and independent replay.
Impact:
Keep host IDs for conversation and base settings APIs; send the decorated
domain ID to RDM project commands. Reuse existing sidebar, settings and toast
states. Reset identity projections and invalidate old asynchronous responses.
No deployment, database change, push, merge, or workspace cleanup.
Refs:
Dev feature-project-member-access task card and implementation plan Task 4
Why: The login recovery contract requires a real-browser acceptance
spec covering admin issue -> key-only redeem -> forced set-password ->
relogin, and the changepw spec needed the same deterministic gate
synchronization.
Evidence: Both specs pass against an isolated auth-on instance
(serve --auth on, binary backend=467718a+frontend=9fc7da2); receipts
be7ae9a2/b3a9e691 bound to Dev HEAD 268ef29 (SELF). changepw-form also
passes (5.9s) alongside login-key (12.2s) on a reused instance,
proving idempotency.
Impact: New e2e/login-key.playwright.ts (skip-guarded like existing
suites); changepw login() waits for the gate heading and success page
before returning to login, fixing a stale-fill race that submitted
empty gate fields.
Refs: Dev docs/svc-deploy/2026-10-13-login-recovery-contract.md; Dev PR #504.
Why: The 2026-10-13 login contract makes username/password the default
login, replaces the browser ask_ tab with a one-time recovery key
entry, requires the forced set-password gate to drop the current
password field, and routes admin password recovery through admin-issued
login keys instead of direct password resets.
Evidence: vitest 218 passed, npm run build OK, check-knip 43<=43,
design-guard green (SELF, local run in task worktree).
Impact: LoginPage gains a redeem-only key tab (no key persistence);
ChangePasswordGate shows server-confirmed owner plus new/confirm only
and returns to the login page after success (reloginRequired); App
gates on sessionScope=set_password_only; UsersPanel replaces reset
password with issue/revoke login key UI showing plaintext once.
Refs: Dev task feature/svc-login-recovery-flow; backend companion
commit 467718a.
Why: when rdm.role.list is rejected (e.g. the operator lost the RDM
domain-admin ledger to an acceptance bootstrap), the roles table spun on
'加载中…' forever and the banner dumped the raw 400 receipt JSON.
Evidence: vitest test/rdmroles-reject.test.ts (SELF, run below); manual
repro on 8788 dev 2026-10-13 before the ledger fix.
Impact: placeholder row comes from rolesListPlaceholder (failure row when
a fetch rejected), domain-admin denials map via describeRoleListError to
a readable message naming the rdm.perm.transfer channel; other errors
pass through. No style tokens touched (design-guard clean).
Refs: Dev task feature/rdm-admin-lockout-recovery (R3)
Why: Upload inventory alone did not prove that the attachment-only user message included and persisted all three materials.
Evidence: Real upload IDs match the empty-text POST and the same user artifact_ref parts before and after reload; both live cases pass.
Impact: Stronger acceptance evidence only; retain mock-runner model-quality limits.
Refs: ce-code-review 20261012-165912-cb241b46 #4, UI01/UI04/U5
Why: Ordinary explanations were folded with tool activity and the oldest result was selected as current work.
Evidence: Findings #5/#6 red-to-green actual-component and live-projection checks are retained; current full Frontend suite passes 210 cases.
Impact: Preserve business text, errors and file references in reading order; retain active/pinned priorities and newest-first host ordering.
Refs: ce-code-review 20261012-165912-cb241b46 #5/#6, UI03/UI05
Why: Background frames blocked terminal reconciliation, stale failures left confirmations busy, and delayed page hydration changed mobile navigation.
Evidence: Review findings #1/#2/#3 have recorded red-to-green checks; all 210 Frontend tests, tsc and knip pass, plus six real navigation browser checks.
Impact: Keep sequence high-water and operation ownership, merge observations by object, and use an explicit preview-opening intent.
Refs: ce-code-review 20261012-165912-cb241b46 #1/#2/#3, UI04/UI09/UI10/UI11
Why: Retained React nodes alone did not prove actual browser scrolling was preserved.
Evidence: The settled Chromium case failed on the previous bundle, then all 11 browser cases passed with exact material, scroll and focus assertions.
Impact: Browser regression coverage only; fixture transport stays outside the production bundle.
Refs: UI10, ce-code-review UI finding #3, work-companion-ui
Why: Opening the auxiliary work pane should keep the conversation compact.
Evidence: Existing Playwright browser suite passed all 10 cases, including finished Collapsible transition.
Impact: Test and screenshot timing only; product behavior is unchanged.
Refs: Dev feature/work-companion-ui, UI03
Why: make material, background work, confirmations and files accessible to nontechnical users across desktop and mobile.
Evidence: Dev SELF receipts for Frontend tsc, 190 tests, knip baseline, build, nine fixture browser cases and two real HTTP/browser smoke cases using MockRunner.
Impact: existing API and permissions remain authoritative; stale events/queries and duplicate effects are guarded, while one file preview and reading state are preserved.
Refs: work-companion-ui design r0.2 and plan r1 U2-U5; UI01-UI13.
Why: Existing event and helper tests missed the SurfaceMeta to snapshot
reload path that blanked the app after the integration pointer regressed.
Evidence: New restore regressions fail on 1edd872 and pass on compatible
main; independent reviewer replays and real browser contract replay are
recorded in the Dev surface-black-screen-recovery task card.
Impact: Tests only; protects reload, partial failure, newer live revisions,
conversation switching, and two-page browser preview.
Refs: Frontend #68; Dev #454 and #452; Dev surface-black-screen-recovery
Why: GET .../surfaces returns SurfaceMeta without identity; writing it into
surfaces let PreviewPane crash on x.identity.surfaceId after refresh.
Evidence: npx vitest run (118 passed), including surfaceKey.test.ts
Impact: openConversation fetches SurfaceSnapshot via surfaceGet; find paths
use surfaceKey; Meta no longer enters the surfaces projection
Refs: fix/surface-list-hydrate
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: When a slow-lane progress card is active, hide the plan/todos
CurrentTaskCard so the work column has one authoritative task object.
Evidence: npx vitest run (workbench-progress + full suite)
Impact: Workbench work tab; tidyCards skips done+danger failures.
Refs: fast-slow-channel-display-u1-plan W4
Co-authored-by: Cursor <cursoragent@cursor.com>
weichen
weichen