Why: A lost proposal response followed by revocation could leave admins with an ambiguous result, and a late response could overwrite a newly selected account.
Evidence: Frontend 272 tests and production build passed; isolated browser replay covered lost response, terminal retry, and account switch.
Impact: Recovery notices reflect current proposal state, and stale account requests cannot update the selected detail.
Refs: IAM U3 account directory and recovery
Why: A successful mutation from a later search page reused an invalid signed cursor and falsely reported a write conflict; a lost recovery-proposal response left a committed proposal hidden and retried with a fresh key.
Evidence: Isolated browser red runs reproduced the stale-page duplicate warning and unknown proposal status; after the fix the combined page-two and lost-response flow passed, as did 272 Frontend tests and a production build.
Impact: Successful writes restart pagination and keep their success status, while uncertain proposal outcomes re-read metadata and reuse the same idempotency key for explicit retry.
Refs: IAM U3 Stage 7; Frontend PR #86
Why: Status words shared with a final reply could suppress a child completion record.
Evidence: 272 frontend unit tests, build, and 15 isolated browser scenarios.
Impact: Tag client-side collaboration replay so partial-delta deduplication preserves agent notes.
Refs: Agent-System-Dev feature/work-companion-visibility UI1
Why: A dropped delta batch can leave a short event prefix next to the complete saved message.
Evidence: 271 frontend unit tests, build, and 14 isolated browser scenarios.
Impact: Suppress overlapping partial replay text and thinking while retaining saved content.
Refs: Agent-System-Dev feature/work-companion-visibility UI1
Why: Event replay could hide saved retry notes and leave completed cards outside the active work filter.
Evidence: 270 frontend unit tests, build, and 14 isolated browser scenarios.
Impact: Merge replay into saved history, retain child progress, and locate cards under the right scope.
Refs: Agent-System-Dev feature/work-companion-visibility UI1 UI2
Why: Fast and slow channel cards duplicate across panes and completed replies hide process output.
Evidence: npm test; npm run build; 12 isolated Playwright scenarios with reload and responsive widths.
Impact: Preserve ordered folded process history, load durable run events, and give work cards one detailed pane.
Refs: Agent-System-Dev feature/work-companion-visibility UI1 UI2 UI3
Why: Users must see truthful first replies when work queues or cannot start.
Evidence: RED and GREEN HTTP browser receipts plus Frontend 269 tests and production build.
Impact: Adds two task-owned Playwright scenarios; production UI is unchanged.
Refs: U3 r0.5 independent review finding
Why: The first reply and task reuse need end-to-end checks across long and small material inputs.
Evidence: Dev evidence receipts for ten Playwright scenarios, Frontend tests, and build.
Impact: Adds browser-only coverage; production UI and API behavior are unchanged.
Refs: U3 r0.5 implementation plan Task 4
Why: RDM duty.get publishes capitalized domain role keys, so a selected document appeared to have no assigned people in the new stable-ID picker.
Evidence: SELF receipts /tmp/iam-u3-rdm-ui-wire-compat.json and /tmp/iam-u3-frontend-wire-compat-test.json; normal pinned-UI build passed.
Impact: The workbench accepts both existing capitalized and lower-camel role fields without changing the RDM public response contract.
Refs: IAM U3 r1 stages 4-5; Dev feature/iam-u3-account-directory-recovery
Why: A lost confirmation or grant-rotation response must not imply that the one-time plaintext can be read again.
Evidence: SELF receipt /tmp/iam-u3-frontend-idempotent-test.json and a normal pinned-UI build after the change.
Impact: The owner view shows current proposal status and offers an explicit new-grant action only when the server returns no plaintext.
Refs: IAM U3 r1 stages 4-5; Dev feature/iam-u3-account-directory-recovery
Why: One system reminder can contain multiple failed child notices, so the browser test must wait for the whole batch rather than one message per child.
Evidence: The first post-merge HTTP/Playwright run failed only at this false one-to-one assumption; all six task-owned browser cases passed after counting notice entries in the persisted reminder.
Impact: Test-only correction; no production UI behavior change.
Refs: U3 r0.4 Task 6 review closure
Why: Keep the approved RDM export controls and the U3 material browser coverage in one component candidate.
Evidence: Changes in store.ts touch separate state fields and behavior; full Frontend tests/build and task-owned browser cases will be rerun after this merge.
Impact: Includes upstream RDM export UI without changing U3 source or notice contracts.
Refs: Dev U3 r0.4 Task 6 final review synchronization
Why: A failed task card can appear before its notification turn, and the second finding must be observed while work is still running.
Evidence: The strengthened browser checks first exposed missing fixture notice text and a zero-width second-stage window; after fixture correction all six task-owned HTTP/Playwright scenarios passed. Frontend 265 unit tests and build passed.
Impact: Test coverage only; no production UI change.
Refs: U3 r0.4 independent review Important 5
Why: The r0.4 acceptance must show running findings, zero and partial failure, and a source-bound choice in the real UI.
Evidence: Six task-owned HTTP/Playwright cases passed; npm test (265 tests) and npm run build passed.
Impact: Browser test coverage only; no production UI change.
Refs: U3 r0.4 Task 6
Why: Complete the authorized export entry while preserving current main project and session behavior.
Evidence: SELF full frontend tests and build, 263 unit tests; deferred browser races reproduced then all 6 passed. Raw records stay outside source until Dev task closure.
Impact: Export callbacks are invalidated on project, identity and unmount changes. Command readiness and current main security paths remain intact.
Refs: Dev PR #488; Frontend PR #73; user takeover authorization on 2026-10-14
Why: The U3 browser gate must show a host-generated pending question for underdetermined source counts.
Evidence: The new assertion failed against the old mechanism fixture while existing source-navigation and focus-flow tests remained observable; Backend fixture now emits structured premises.
Impact: Browser test inputs and assertion only; no production UI change.
Refs: Backend 756679d; Dev task feature/fast-slow-u2-u3-plan
Why: The Core mirror must satisfy the Frontend unused-export guard without changing the candidate shape.
Evidence: Dev make contracts regenerated the file; Frontend knip 51 <= 52 and build passed.
Impact: Type-only export visibility change.
Refs: Core b474394; Dev task feature/fast-slow-u2-u3-plan
Why: Frontend generated types must follow the single Core checkpoint contract.
Evidence: Dev make contracts generated the mirror; npm test and npm run build passed.
Impact: Type-only mirror update; persisted task cards and reading behavior stay unchanged.
Refs: Core c722c16; Dev task feature/fast-slow-u2-u3-plan
Why: Current main carries the same corrected lowercase command ID as this member candidate.
Evidence: Preserve the canonical wrapper and set-role ID; compare the final tree against the independently tested 2ba275b object.
Impact: Update ancestry only; no intended product behavior change.
Refs: Frontend PR83; project-member-access
Why:
Fresh documents had no first-submit action, reading active duties opened
confirmation dialogs, and delayed detail or status queries could overwrite
another selection and send its document ID with the wrong duty draft.
Evidence:
SELF real-browser regressions observed the missing action, render-time
dialogs, detail/status races, and a follow-up query after panel unmount.
Five focused Playwright scenarios passed after the fix, together with the
full npm test, npm run build, and git diff --check commands. Receipts:
/tmp/project-member-duties-browser-green-20261013.json and
/tmp/project-member-duties-full-build-green-20261013.json.
Impact:
Offer first submission independently of an existing review round. Ask for
invalidation only on a dirty save click. Guard queries and continuations
with project lifetime, selection, and request sequences; keep the existing
Picker, canonical project routing, controls, and UI tokens.
Refs:
Dev project-member-access Task 4; independent synchronized Frontend P2 review
Why: Current main supplies member pickers and duty catalogs that must keep verified project identity.
Evidence: Frontend 259 tests and build pass after resolving panel conflicts; final canonical set-role dispatch and fixed combo checks follow.
Impact: Preserve upstream panels with canonical project commands and read-versus-work state guards.
Refs: feature/project-member-access; origin/main c294835
Why:
Project readiness is a write gate. Applying it to member, permission, and
document status queries hides history that the backend intentionally keeps
readable after archival or closure.
Evidence:
SELF archived and closed read regressions failed before the fix. Full npm
test, npm run build, and git diff --check passed with the amended code.
Receipts: /tmp/project-member-frontend-archived-read-red-20261013.json and
/tmp/project-member-frontend-archived-read-green-20261013.json.
Impact:
Resolve canonical project IDs separately from command readiness. Preserve
known read commands and existing settings tabs for historical projects;
keep mutations and new work blocked with existing disabled controls.
Server authorization remains authoritative.
Refs:
Dev project-member-access Task 4; independent Frontend review P2
Why:
An identity can change after an operation has passed its first response guard.
Later project loads, cleanup calls, and attachment refreshes must not reopen
private context or return the previous account's result to the new session.
Evidence:
SELF regressions failed before the guards: delayed project opening, task
creation success, completed-card cleanup, and upload artifact-ID return.
SELF npm test, npm run build, and git diff --check passed; full command
receipt: /tmp/project-member-frontend-final-checks-20261013.json.
Impact:
Guard post-await continuations with the same identity epoch. Preserve the
original server-side result and ignore stale client projections; do not undo
the previous account's already completed work.
Refs:
Dev feature-project-member-access implementation plan Task 4
Why:
Project members need RDM commands to address the registered domain project.
Failed project states and responses from a previous account must not create
work, report a rejected mutation as successful, or restore private content.
Evidence:
SELF npm test: 32 files and 251 tests passed, including project command,
mutation rejection, archived history, and delayed account response coverage.
SELF npm run build and git diff --check passed. Original regressions were
observed before implementation; root owns composition and independent replay.
Impact:
Keep host IDs for conversation and base settings APIs; send the decorated
domain ID to RDM project commands. Reuse existing sidebar, settings and toast
states. Reset identity projections and invalidate old asynchronous responses.
No deployment, database change, push, merge, or workspace cleanup.
Refs:
Dev feature-project-member-access task card and implementation plan Task 4
Why: Preserve current main before publishing the U2/U3 candidate.
Evidence: Exact main object fetched; browser-only upstream changes.
Impact: Retain both sets of browser coverage.
Refs: Agent-System-Dev U2/U3 delivery
Why: The login recovery contract requires a real-browser acceptance
spec covering admin issue -> key-only redeem -> forced set-password ->
relogin, and the changepw spec needed the same deterministic gate
synchronization.
Evidence: Both specs pass against an isolated auth-on instance
(serve --auth on, binary backend=467718a+frontend=9fc7da2); receipts
be7ae9a2/b3a9e691 bound to Dev HEAD 268ef29 (SELF). changepw-form also
passes (5.9s) alongside login-key (12.2s) on a reused instance,
proving idempotency.
Impact: New e2e/login-key.playwright.ts (skip-guarded like existing
suites); changepw login() waits for the gate heading and success page
before returning to login, fixing a stale-fill race that submitted
empty gate fields.
Refs: Dev docs/svc-deploy/2026-10-13-login-recovery-contract.md; Dev PR #504.
Why: Material records now display validated source quotations rather than unverified model paraphrases.
Evidence: Existing browser coverage retains refresh, changed-version, preview and focus checks; the updated assertions target actual source text.
Impact: Browser-only expectations change; product bundle remains the independently reviewed version.
Refs: Approved R05 and host material-record guard
Why: Late source requests must not replace a newer preview or survive conversation navigation.
Evidence: Frontend typecheck, 221 unit tests, knip ratchet and build passed; delayed-response regressions reproduced the old failure.
Impact: The existing store owns source requests and invalidates stale responses on preview and context changes.
Refs: Agent-System-Dev feature-fast-slow-u2-u3-plan; independent review finding 4
Why: The 2026-10-13 login contract makes username/password the default
login, replaces the browser ask_ tab with a one-time recovery key
entry, requires the forced set-password gate to drop the current
password field, and routes admin password recovery through admin-issued
login keys instead of direct password resets.
Evidence: vitest 218 passed, npm run build OK, check-knip 43<=43,
design-guard green (SELF, local run in task worktree).
Impact: LoginPage gains a redeem-only key tab (no key persistence);
ChangePasswordGate shows server-confirmed owner plus new/confirm only
and returns to the login page after success (reloginRequired); App
gates on sessionScope=set_password_only; UsersPanel replaces reset
password with issue/revoke login key UI showing plaintext once.
Refs: Dev task feature/svc-login-recovery-flow; backend companion
commit 467718a.
Why: Unrelated browser suites should skip this opt-in runtime acceptance instead of importing an absent manifest.
Evidence: Playwright discovers the two tests without an instance; explicit owned-instance replay passed previously.
Impact: Preserves strict manifest verification when invoked.
Refs: fast-slow-u2-u3 Task 7
weichen
weichen