Why: close the card in the same PR before merging.
Evidence: pr-check PR_CHECK_OK on 080c630.
Impact: task card only.
Refs: Frontend PR #86
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: the branch predates Frontend governance adoption and had no task card, so pr-check refused PR #86.
Evidence: card records the agent-exec units, host verification log, CI and independent review of e4041b3.
Impact: task card only.
Refs: Frontend PR #86
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: PR #86 predates IAM U4 and the account-chain UI on main; the U3 behaviour was ported onto main by agent-exec transports d47c493, 72c941c and afd9e75, so this merge only records the U3 branch history.
Evidence: tree equals afd9e75; host tsc -b, vitest 565 passed, build and knip on 72c941c (SELF); independent review blocking item fixed in afd9e75.
Impact: no tree change versus afd9e75.
Refs: Frontend PR #86, base main 1650b4f
Why: An early filesystem failure could exit before the UI deploy key cleanup trap existed.
Evidence: Parsed workflow confirms the EXIT trap precedes the first secret write.
Impact: Normal checkout failures remove both transient credential files from the runner.
Refs: IAM U3 Frontend PR #86
Why: The CI runner executed a mirror-downloaded toolchain without authenticating its contents.
Evidence: The pinned SHA256 matches the signed Node.js v22.23.3 release manifest and the current mirror archive.
Impact: CI fails before extraction if the Node archive differs from the reviewed release artifact.
Refs: IAM U3 Frontend PR #86
Why: The Gitea job token cannot read the private UI repository and this server lacks HTTPS deploy-token API support.
Evidence: Repository-scoped UI deploy key read was verified; Frontend Actions secret UI_DEPLOY_KEY is listed; prior CI run 3214 confirmed the missing credential gate.
Impact: Exact-pin CI uses a read-only SSH key and pinned host identity, deleting the transient key after checkout.
Refs: IAM U3 Frontend PR #86
Why: Gitea job token can fetch Frontend but receives repository-not-found for private UI.
Evidence: PR CI run 3213 checkout log shows Frontend fetch succeeded and UI fetch failed; Frontend secret listing lacks SUBMODULE_TOKEN.
Impact: CI now requests the dedicated UI read credential and fails clearly until it is provisioned.
Refs: IAM U3 Frontend PR #86
Why: The runner may inject an internal Gitea URL rather than the public browser URL.
Evidence: PR CI run 3212 exited at checkout preflight before any fetch; updated YAML parses locally.
Impact: Checkout validates the injected URL shape and logs nonsecret event context.
Refs: IAM U3 Frontend PR #86
Why: The Frontend repository lacked an exact-HEAD CI gate for U3 delivery.
Evidence: Workflow syntax parsed locally; Frontend and pinned UI tests and build passed locally; platform run pending.
Impact: PR and main checks now fetch fixed Frontend/UI commits and run install, tests, and production build.
Refs: IAM U3 delivery gate
Why: A confirmed proposal should not instruct the owner to confirm it again.
Evidence: Frontend tests and production build passed at the changed source.
Impact: Confirmation notice describes the existing state and keeps credential authority with the owner.
Refs: IAM U3 account recovery
Why: A lost proposal response followed by revocation could leave admins with an ambiguous result, and a late response could overwrite a newly selected account.
Evidence: Frontend 272 tests and production build passed; isolated browser replay covered lost response, terminal retry, and account switch.
Impact: Recovery notices reflect current proposal state, and stale account requests cannot update the selected detail.
Refs: IAM U3 account directory and recovery
Why: A successful mutation from a later search page reused an invalid signed cursor and falsely reported a write conflict; a lost recovery-proposal response left a committed proposal hidden and retried with a fresh key.
Evidence: Isolated browser red runs reproduced the stale-page duplicate warning and unknown proposal status; after the fix the combined page-two and lost-response flow passed, as did 272 Frontend tests and a production build.
Impact: Successful writes restart pagination and keep their success status, while uncertain proposal outcomes re-read metadata and reuse the same idempotency key for explicit retry.
Refs: IAM U3 Stage 7; Frontend PR #86
Why: RDM duty.get publishes capitalized domain role keys, so a selected document appeared to have no assigned people in the new stable-ID picker.
Evidence: SELF receipts /tmp/iam-u3-rdm-ui-wire-compat.json and /tmp/iam-u3-frontend-wire-compat-test.json; normal pinned-UI build passed.
Impact: The workbench accepts both existing capitalized and lower-camel role fields without changing the RDM public response contract.
Refs: IAM U3 r1 stages 4-5; Dev feature/iam-u3-account-directory-recovery
Why: A lost confirmation or grant-rotation response must not imply that the one-time plaintext can be read again.
Evidence: SELF receipt /tmp/iam-u3-frontend-idempotent-test.json and a normal pinned-UI build after the change.
Impact: The owner view shows current proposal status and offers an explicit new-grant action only when the server returns no plaintext.
Refs: IAM U3 r1 stages 4-5; Dev feature/iam-u3-account-directory-recovery
