kayg commented

Owner

AREA: Search, Settings, Admin, sign-in and sharing. Search palette and saved searches (restyle-search-fix owns #1190 visuals; file, do not edit those files), every Settings section, Admin pages (users, invites, licence cap, feature flags, plugins on/off), sign-in/sign-out/session expiry, Connected Accounts, Apps, sharing and collaboration links, notifications and toasts, deep links for settings sections and admin pages. Cross-user: create 3 users and confirm none can see or discover another's data or existence (#1199 owns the directory fix; file, do not edit).

Tracking issue for the 2026-10-07 bug bash. Every bug found gets its own issue, linked here.

AREA: Search, Settings, Admin, sign-in and sharing. Search palette and saved searches (restyle-search-fix owns #1190 visuals; file, do not edit those files), every Settings section, Admin pages (users, invites, licence cap, feature flags, plugins on/off), sign-in/sign-out/session expiry, Connected Accounts, Apps, sharing and collaboration links, notifications and toasts, deep links for settings sections and admin pages. Cross-user: create 3 users and confirm none can see or discover another's data or existence (#1199 owns the directory fix; file, do not edit). Tracking issue for the 2026-10-07 bug bash. Every bug found gets its own issue, linked here.

kayg commented

2026-10-06 22:39:15 +00:00

Author

Owner

Starting bash-core bug bash on branch job/bash-core. Base SHA: ff53d7b8b4 (origin/dev). Scope: Search, Settings, Admin, sign-in/session expiry, sharing, notifications/toasts and deep links. I will test a local production build, file each evidence-backed finding separately, and keep fixes within the assigned area.

Starting bash-core bug bash on branch job/bash-core. Base SHA: ff53d7b8b4da5a21f862d57dcc3496f8c019f647 (origin/dev). Scope: Search, Settings, Admin, sign-in/session expiry, sharing, notifications/toasts and deep links. I will test a local production build, file each evidence-backed finding separately, and keep fixes within the assigned area.

kayg commented

2026-10-06 22:56:53 +00:00

Author

Owner

Finding #1242: the Settings section screenshot matrix omitted macOS platform signals. I am updating its real-browser E2E setup to emulate and assert the owner review platform before each route screenshot.

kayg commented

2026-10-06 23:29:31 +00:00

Author

Owner

Found and filed #1249: notification screenshot captures use default Linux Chromium platform signals. Evidence is target/tmp/platform-before.txt and the default screenshot context in apps/web/e2e/notifications.mjs. Severity: minor. I will add macOS emulation and a regression assertion in this branch.

Found and filed #1249: notification screenshot captures use default Linux Chromium platform signals. Evidence is `target/tmp/platform-before.txt` and the default screenshot context in `apps/web/e2e/notifications.mjs`. Severity: minor. I will add macOS emulation and a regression assertion in this branch.

kayg commented

2026-10-06 23:30:30 +00:00

Author

Owner

Found and filed #1250: recovery screenshots in the guest context use default Linux Chromium platform signals. Evidence is target/tmp/platform-before.txt and the context in apps/web/e2e/auth.mjs. Severity: minor. I will add macOS emulation and a screenshot-time assertion in this branch.

Found and filed #1250: recovery screenshots in the `guest` context use default Linux Chromium platform signals. Evidence is `target/tmp/platform-before.txt` and the context in `apps/web/e2e/auth.mjs`. Severity: minor. I will add macOS emulation and a screenshot-time assertion in this branch.

kayg commented

2026-10-06 23:52:05 +00:00

Author

Owner

The first production Settings sweep exposed a stale test fixture and I filed #1259. Evidence: target/tmp/settings-cards-422.txt. The fixture sends a removed location: null field; the current API contract only accepts auto_scheme.mode. The existing 200-status expectation remains unchanged. Severity: minor. I will align the request body with the current contract and rerun the sweep.

The first production Settings sweep exposed a stale test fixture and I filed #1259. Evidence: `target/tmp/settings-cards-422.txt`. The fixture sends a removed `location: null` field; the current API contract only accepts `auto_scheme.mode`. The existing 200-status expectation remains unchanged. Severity: minor. I will align the request body with the current contract and rerun the sweep.

kayg commented

2026-10-06 23:55:06 +00:00

Author

Owner

The next Settings screenshot run exposed a second stale test-fixture assumption; I filed #1261. The script seeds settings through unscoped localStorage, while the current store reads User-scoped userStorage. Evidence: target/tmp/settings-cards-background-timeout.txt. I will use the existing harness seam and preserve the wallpaper readiness assertion. Severity: minor.

The next Settings screenshot run exposed a second stale test-fixture assumption; I filed #1261. The script seeds settings through unscoped `localStorage`, while the current store reads User-scoped `userStorage`. Evidence: `target/tmp/settings-cards-background-timeout.txt`. I will use the existing harness seam and preserve the wallpaper readiness assertion. Severity: minor.

kayg commented

2026-10-07 00:21:47 +00:00

Author

Owner

Found and filed #1270 during the real Notifications E2E. Deleting one share item persists a web_toast “Notification deleted” row with Undo; the current E2E still expects exactly two rows and times out. The persisted toast is intentional per the store test, so I left the existing assertion unchanged for owner review. Evidence: target/tmp/notifications-delete-count.txt. Severity: minor.

Found and filed #1270 during the real Notifications E2E. Deleting one share item persists a `web_toast` “Notification deleted” row with Undo; the current E2E still expects exactly two rows and times out. The persisted toast is intentional per the store test, so I left the existing assertion unchanged for owner review. Evidence: `target/tmp/notifications-delete-count.txt`. Severity: minor.

kayg commented

2026-10-07 00:22:17 +00:00

Author

Owner

Found and filed #1271: the Notifications E2E failure handler printed an unredacted setup URL. The one-time token was consumed during test setup and the local server was removed; I am reporting it under the repository no-secrets rule. Evidence with the value redacted: target/tmp/notifications-log-token-redacted.txt. I will redact setup tokens in that diagnostic path. Severity: minor.

Found and filed #1271: the Notifications E2E failure handler printed an unredacted setup URL. The one-time token was consumed during test setup and the local server was removed; I am reporting it under the repository no-secrets rule. Evidence with the value redacted: `target/tmp/notifications-log-token-redacted.txt`. I will redact setup tokens in that diagnostic path. Severity: minor.

kayg commented

2026-10-07 00:25:28 +00:00

Author

Owner

Found and filed #1274: auth setup, sign-in and recovery screenshots only cover 390 and 1440 px; the Settings-specific captures already include 820 px. I will extend the general auth screenshot matrix to include tablet width. Evidence: the VIEWPORTS array in apps/web/e2e/auth.mjs. Severity: minor.

Found and filed #1274: auth setup, sign-in and recovery screenshots only cover 390 and 1440 px; the Settings-specific captures already include 820 px. I will extend the general auth screenshot matrix to include tablet width. Evidence: the `VIEWPORTS` array in `apps/web/e2e/auth.mjs`. Severity: minor.

kayg commented

2026-10-07 00:26:40 +00:00

Author

Owner

Found and filed #1275: unauthenticated setup screenshots tell the theme helper not to persist, but still expect User storage and server Appearance values. The first auth screenshot fails before capture with storedMode and serverMode absent. Evidence: the screenshot run and theme assertion in harness.mjs. I will scope persisted expectations to signed-in Settings routes.

Found and filed #1275: unauthenticated setup screenshots tell the theme helper not to persist, but still expect User storage and server Appearance values. The first auth screenshot fails before capture with `storedMode` and `serverMode` absent. Evidence: the screenshot run and theme assertion in `harness.mjs`. I will scope persisted expectations to signed-in Settings routes.

kayg commented

2026-10-07 00:31:11 +00:00

Author

Owner

Found and filed #1276: Admin → Sign-in calls toast with policy: 'drop', which deliberately suppresses the success text that auth.mjs waits for. The switch updates state without a toast; I left the existing expectation unchanged. Evidence: the timeout at auth.mjs:344 and the policy handler in toasts.svelte.ts. Severity: minor.

Found and filed #1276: Admin → Sign-in calls `toast` with `policy: 'drop'`, which deliberately suppresses the success text that `auth.mjs` waits for. The switch updates state without a toast; I left the existing expectation unchanged. Evidence: the timeout at `auth.mjs:344` and the policy handler in `toasts.svelte.ts`. Severity: minor.

kayg commented

2026-10-07 00:34:21 +00:00

Author

Owner

Found and filed #1278: the Settings review screenshot helper still searches for the old sidebar row label “Plugins,” while the product uses “Features” after #921. The desktop crop fails before its alignment assertions. I will update the fixture selector and rerun the sweep. Severity: minor.

kayg commented

2026-10-07 00:39:04 +00:00

Author

Owner

Found #1282 while running the deep-link flow: seedMoney skipped the app's empty-state “Import a Budget…” action and “Create a new budget” step, so its Budget name locator could not exist. This is stale E2E setup, not a Money product failure. I am correcting the helper to follow the shipped flow, then will rerun the deep-link suite.

Found #1282 while running the deep-link flow: `seedMoney` skipped the app's empty-state “Import a Budget…” action and “Create a new budget” step, so its Budget name locator could not exist. This is stale E2E setup, not a Money product failure. I am correcting the helper to follow the shipped flow, then will rerun the deep-link suite.

kayg commented

2026-10-07 00:40:33 +00:00

Author

Owner

Correction to my #1282 finding: enabling Money with no Budgets automatically opens the import wizard. The empty-state action is behind that overlay. The helper now waits for the wizard's source step and chooses “Create a new budget” before filling the name.

kayg commented

2026-10-07 00:41:14 +00:00

Author

Owner

Found #1283 in the same production deep-link setup: the budget-created toast keeps an “Add account” action visible on the account route, so the test's unscoped button name matches both the form submit and toast action. I will scope the submit to the “Add an account” form, leaving product behavior unchanged.

kayg commented

2026-10-07 00:42:14 +00:00

Author

Owner

Found #1284 during the deep-link rerun. A root-level “More actions” locator also matches the seeded sidebar tag action, so the test stops before checking the Calendar page menu. I am tightening the generic menu queries to exact accessible names.

kayg commented

2026-10-07 00:56:45 +00:00

Author

Owner

Found #1285 in the Share long-name run. The 120-character file exists in the API and Files list; the row's accessible name retains the full filename while its visible text uses an ellipsis. The E2E helper searches visible text for the untruncated name. I will switch it to the row's exact accessible name and add a focused real-server mode for this regression.

kayg commented

2026-10-07 00:56:49 +00:00

Author

Owner

Correction: Forgejo assigned #1290 (not #1285) to the Share long-name locator finding. The evidence file now uses #1290; no code was changed yet.

kayg commented

2026-10-07 01:00:10 +00:00

Author

Owner

Found #1291 after #1290's row locator passed: the Share dialog's accessible name uses the title stem for plain files, so the test's full .txt filename expectation cannot match. This follows the existing ShareDialog contract. I will make openShare accept the expected dialog title and supply the stem for this case.

Found #1291 after #1290's row locator passed: the Share dialog's accessible name uses the title stem for plain files, so the test's full `.txt` filename expectation cannot match. This follows the existing ShareDialog contract. I will make `openShare` accept the expected dialog title and supply the stem for this case.

kayg commented

2026-10-07 01:04:24 +00:00

Author

Owner

Found #1292 in the full Share run. The existing legacy fixture sends PATCH and asserts 200, but the current route metadata and Share client use PUT; the real server returns 405. I left the existing status-code expectation unchanged, as required, and filed this for owner review.

kayg commented

2026-10-07 01:34:04 +00:00

Author

Owner

Found a Connected Accounts review failure (issue number follows) after the provider views passed at 390px/light. The fixture's Connected state and account action button were visible, but .connected-account-list > .settings-row timed out. I am checking the rendered list structure to distinguish a stale selector from a product gap.

Found a Connected Accounts review failure (issue number follows) after the provider views passed at 390px/light. The fixture's `Connected` state and account action button were visible, but `.connected-account-list > .settings-row` timed out. I am checking the rendered list structure to distinguish a stale selector from a product gap.

kayg commented

2026-10-07 01:34:09 +00:00

Author

Owner

Correction: the Connected Accounts review failure is filed as #1296.

kayg commented

2026-10-07 02:13:39 +00:00

Author

Owner

Final report — #1220

Built: E2E coverage and fixture corrections only. No product UI, route, API contract, or Rust code changed.

Files: apps/web/e2e/auth.mjs, deeplinks.mjs, notifications.mjs, settings-cards-402.mjs, settings-review-50.mjs, and share.mjs.

Head: ef514d9f7 (includes the required merge from origin/dev). No push or deploy was made.

Findings

Issue	Severity	Result
#1242 — Settings screenshot contexts used Linux platform signals	Cosmetic	Fixed in `f46a0e364`
#1249 — Notifications screenshots used Linux platform signals	Cosmetic	Fixed in `2b0d45d8d`
#1250 — Auth screenshot matrix missed macOS signals	Cosmetic	Fixed in `fa07d5be9`
#1259 — Settings screenshot fixture sent removed appearance field	Minor	Fixed in `f46a0e364`
#1261 — Settings screenshot fixture bypassed User-scoped storage	Minor	Fixed in `f46a0e364`
#1270 — Notification Undo toast is counted as an inbox row	Minor	Filed only; existing expectation retained
#1271 — Notification diagnostics could print a setup token	Major	Fixed in `d2e307e39`
#1274 — Auth screenshots omitted tablet width	Cosmetic	Fixed in `fa07d5be9`
#1275 — Unauthenticated auth screenshot expected persisted User theme	Minor	Fixed in `fa07d5be9`
#1276 — Open-signup test expects a toast that `policy: 'drop'` suppresses	Minor	Filed only; existing expectation retained
#1278 — Settings review crop looked for renamed Plugins row	Cosmetic	Fixed in `ed5d2f9a2`
#1282 — Money deep-link fixture skipped budget creation step	Minor	Fixed in `29bf69bf5`
#1283 — Money fixture clicked the toast's duplicate Add account action	Minor	Fixed in `7553b0a38`
#1284 — Deep-link menu locator matched a sidebar tag action	Minor	Fixed in `bef2daefc`
#1290 — Long Share row locator ignored its full accessible name	Minor	Fixed in `39f70d9ca`
#1291 — Share dialog title expectation includes the file extension	Minor	Filed only; the existing expectation was restored in `ef514d9f7` per the owner rule
#1292 — Legacy Share fixture sends PATCH to a PUT endpoint	Minor	Filed only; existing status assertion retained
#1296 — Connected Accounts row selector timed out on a loaded host	Minor / SLOW	Filed only; not reproduced in focused review

E2E findings and evidence

Settings screenshot matrix: 516 captures at 390, 820, and 1440 px in light and dark themes. Settings review: 56 screenshots and 26 legacy URL redirects.
Search palette and saved-search flows passed their interaction, deep-link, and screenshot checks. The performance assertion for first-result p95 failed under high shared-host load; measurements are below.
Connected Accounts passed a focused 390 px light/dark production-SPA review: 22 screenshots. The expected three rows rendered, and icon/name center offset was 0.0078125px in both themes.
Apps password grants, MCP setup and tools, device setup, copy actions, and QR contrast passed without the optional screenshot-cropping path.
Real-server checks passed for passkey setup/recovery, sign-out in one tab with another tab redirected, expired-session redirect, Admin feature toggle, the six-User cap in documented free-policy mode, and three-User data isolation.
The Share collaboration flow passed with 66 macOS screenshots. The legacy Share update fixture still expects PATCH to return 200; the real route and client use PUT and return 405 for PATCH.

Screenshots remain uncommitted under artifacts/bash-core/, artifacts/connected-accounts/, and artifacts/merge29/licence/. I prepared artifacts/bash-core/review-screenshots.tar.gz (46,657,451 bytes). scripts/fj issue comment accepts text only, and the direct issue-asset upload attempt failed authentication, so the archive is not attached to this issue. No credentials were displayed or added to the report.

Performance

Local production-server search run; the host load average was about 32.38 during the burst. This is not a perf-VM measurement.

60-query server round trip: p50 27.9ms, p95 188.9ms.
Burst server load: mean CPU 63.54%, mean RSS 507.3 MiB, peak RSS 509.0 MiB.
Keystroke to first-result frame: p50 144.2ms, p95 744.9ms; the E2E's 50 ms p95 assertion failed.
Keystroke to server-result DOM: p50 86.5ms, p95 1523.5ms.
Keystroke to next frame with server results: p50 328.5ms, p95 1701.4ms.
Main-thread long tasks: 53 over 50 ms; maximum 1082ms.
docs/perf/baseline.json records the 1m palette first-result frame at p50 53.8ms, p95 116ms; server frame p50 108.1ms, p95 208.9ms; 2 long tasks, maximum 75ms. The local shared-host run is substantially slower and not comparable under its measured load. No product performance change was made.

UX gaps

Closed in test coverage: macOS screenshot signals and tablet auth captures; User-scoped Settings screenshot storage; current appearance API payload; Money budget wizard flow; exact page-menu selection; full accessible filename row lookup; and redaction of setup/session tokens in notification failure diagnostics.

Left: the notification Undo toast row behavior (#1270), open-signup toast expectation (#1276), Share title expectation (#1291), and PATCH/PUT fixture mismatch (#1292) need owner review. The full Connected Accounts screenshot matrix did not finish beyond phone width. The auth and Apps screenshot matrices could not complete because the host lacks libstdc++.so.6 required by sharp; focused auth smoke and the no-cropping Apps flow passed. The signed-key licence fixture was not exercised because the prebuilt server uses the official key; the documented free-policy cap test passed. The Settings account-group wait and moved-Journal deep-link run timed out under shared-host I/O. A five-minute memory soak and the full offline/slow-network/two-tab matrix across every Settings and Admin flow were not completed.

Gates

cargo fmt --check completed with no output.

Captured output excerpts, verbatim:

perf-lint: PASS; 0 violations; 22548 scoped exceptions
User browser caches use userStorage; only documented device/public-link exceptions remain.
Glass alpha, blur and backdrop-filter roles use packages/ui/src/tokens.css.
Text sizes and UI shape values use shared role tokens.
Keyboard focus rings use the shared focus tokens.
UI transitions and animation options use shared motion tokens or documented exceptions.
Warn: Do not use empty rulesets (css)
svelte-check found 0 errors and 1 warning in 1 file

The one warning is the existing empty CSS ruleset in packages/ui/src/components/calendar/AttachmentDeck.svelte:1055.

 Test Files  287 passed (287)
      Tests  2035 passed (2035)
   Start at  03:48:53
   Duration  583.60s (transform 29%, environment 26%, import 22%, tests 17%, setup 5%)

No Rust source changed, so no crate-specific clippy or test gate applied. cargo clean completed: Removed 9259 files, 3.4GiB total. Web build output and target/tmp were removed.

Decisions

The Money fixture follows the visible budget-creation wizard so it seeds valid data through the current flow.
The Share row uses its full accessible option name. The existing dialog-title expectation remains unchanged until the owner decides whether the filename extension belongs in the title.
No DESIGN decision changed and no new product behavior was introduced.

# Final report — #1220 **Built:** E2E coverage and fixture corrections only. No product UI, route, API contract, or Rust code changed. **Files:** `apps/web/e2e/auth.mjs`, `deeplinks.mjs`, `notifications.mjs`, `settings-cards-402.mjs`, `settings-review-50.mjs`, and `share.mjs`. **Head:** `ef514d9f7` (includes the required merge from `origin/dev`). No push or deploy was made. ## Findings | Issue | Severity | Result | |---|---|---| | #1242 — Settings screenshot contexts used Linux platform signals | Cosmetic | Fixed in `f46a0e364` | | #1249 — Notifications screenshots used Linux platform signals | Cosmetic | Fixed in `2b0d45d8d` | | #1250 — Auth screenshot matrix missed macOS signals | Cosmetic | Fixed in `fa07d5be9` | | #1259 — Settings screenshot fixture sent removed appearance field | Minor | Fixed in `f46a0e364` | | #1261 — Settings screenshot fixture bypassed User-scoped storage | Minor | Fixed in `f46a0e364` | | #1270 — Notification Undo toast is counted as an inbox row | Minor | Filed only; existing expectation retained | | #1271 — Notification diagnostics could print a setup token | Major | Fixed in `d2e307e39` | | #1274 — Auth screenshots omitted tablet width | Cosmetic | Fixed in `fa07d5be9` | | #1275 — Unauthenticated auth screenshot expected persisted User theme | Minor | Fixed in `fa07d5be9` | | #1276 — Open-signup test expects a toast that `policy: 'drop'` suppresses | Minor | Filed only; existing expectation retained | | #1278 — Settings review crop looked for renamed Plugins row | Cosmetic | Fixed in `ed5d2f9a2` | | #1282 — Money deep-link fixture skipped budget creation step | Minor | Fixed in `29bf69bf5` | | #1283 — Money fixture clicked the toast's duplicate Add account action | Minor | Fixed in `7553b0a38` | | #1284 — Deep-link menu locator matched a sidebar tag action | Minor | Fixed in `bef2daefc` | | #1290 — Long Share row locator ignored its full accessible name | Minor | Fixed in `39f70d9ca` | | #1291 — Share dialog title expectation includes the file extension | Minor | Filed only; the existing expectation was restored in `ef514d9f7` per the owner rule | | #1292 — Legacy Share fixture sends PATCH to a PUT endpoint | Minor | Filed only; existing status assertion retained | | #1296 — Connected Accounts row selector timed out on a loaded host | Minor / SLOW | Filed only; not reproduced in focused review | ## E2E findings and evidence - Settings screenshot matrix: 516 captures at 390, 820, and 1440 px in light and dark themes. Settings review: 56 screenshots and 26 legacy URL redirects. - Search palette and saved-search flows passed their interaction, deep-link, and screenshot checks. The performance assertion for first-result p95 failed under high shared-host load; measurements are below. - Connected Accounts passed a focused 390 px light/dark production-SPA review: 22 screenshots. The expected three rows rendered, and icon/name center offset was `0.0078125px` in both themes. - Apps password grants, MCP setup and tools, device setup, copy actions, and QR contrast passed without the optional screenshot-cropping path. - Real-server checks passed for passkey setup/recovery, sign-out in one tab with another tab redirected, expired-session redirect, Admin feature toggle, the six-User cap in documented free-policy mode, and three-User data isolation. - The Share collaboration flow passed with 66 macOS screenshots. The legacy Share update fixture still expects PATCH to return 200; the real route and client use PUT and return 405 for PATCH. Screenshots remain uncommitted under `artifacts/bash-core/`, `artifacts/connected-accounts/`, and `artifacts/merge29/licence/`. I prepared `artifacts/bash-core/review-screenshots.tar.gz` (46,657,451 bytes). `scripts/fj issue comment` accepts text only, and the direct issue-asset upload attempt failed authentication, so the archive is not attached to this issue. No credentials were displayed or added to the report. ## Performance Local production-server search run; the host load average was about `32.38` during the burst. This is not a perf-VM measurement. - 60-query server round trip: p50 `27.9ms`, p95 `188.9ms`. - Burst server load: mean CPU `63.54%`, mean RSS `507.3 MiB`, peak RSS `509.0 MiB`. - Keystroke to first-result frame: p50 `144.2ms`, p95 `744.9ms`; the E2E's 50 ms p95 assertion failed. - Keystroke to server-result DOM: p50 `86.5ms`, p95 `1523.5ms`. - Keystroke to next frame with server results: p50 `328.5ms`, p95 `1701.4ms`. - Main-thread long tasks: 53 over 50 ms; maximum `1082ms`. - `docs/perf/baseline.json` records the 1m palette first-result frame at p50 `53.8ms`, p95 `116ms`; server frame p50 `108.1ms`, p95 `208.9ms`; 2 long tasks, maximum `75ms`. The local shared-host run is substantially slower and not comparable under its measured load. No product performance change was made. ## UX gaps **Closed in test coverage:** macOS screenshot signals and tablet auth captures; User-scoped Settings screenshot storage; current appearance API payload; Money budget wizard flow; exact page-menu selection; full accessible filename row lookup; and redaction of setup/session tokens in notification failure diagnostics. **Left:** the notification Undo toast row behavior (#1270), open-signup toast expectation (#1276), Share title expectation (#1291), and PATCH/PUT fixture mismatch (#1292) need owner review. The full Connected Accounts screenshot matrix did not finish beyond phone width. The auth and Apps screenshot matrices could not complete because the host lacks `libstdc++.so.6` required by `sharp`; focused auth smoke and the no-cropping Apps flow passed. The signed-key licence fixture was not exercised because the prebuilt server uses the official key; the documented free-policy cap test passed. The Settings account-group wait and moved-Journal deep-link run timed out under shared-host I/O. A five-minute memory soak and the full offline/slow-network/two-tab matrix across every Settings and Admin flow were not completed. ## Gates `cargo fmt --check` completed with no output. Captured output excerpts, verbatim: ```text perf-lint: PASS; 0 violations; 22548 scoped exceptions User browser caches use userStorage; only documented device/public-link exceptions remain. Glass alpha, blur and backdrop-filter roles use packages/ui/src/tokens.css. Text sizes and UI shape values use shared role tokens. Keyboard focus rings use the shared focus tokens. UI transitions and animation options use shared motion tokens or documented exceptions. Warn: Do not use empty rulesets (css) svelte-check found 0 errors and 1 warning in 1 file ``` The one warning is the existing empty CSS ruleset in `packages/ui/src/components/calendar/AttachmentDeck.svelte:1055`. ```text Test Files 287 passed (287) Tests 2035 passed (2035) Start at 03:48:53 Duration 583.60s (transform 29%, environment 26%, import 22%, tests 17%, setup 5%) ``` No Rust source changed, so no crate-specific clippy or test gate applied. `cargo clean` completed: `Removed 9259 files, 3.4GiB total`. Web build output and `target/tmp` were removed. ## Decisions - The Money fixture follows the visible budget-creation wizard so it seeds valid data through the current flow. - The Share row uses its full accessible option name. The existing dialog-title expectation remains unchanged until the owner decides whether the filename extension belongs in the title. - No DESIGN decision changed and no new product behavior was introduced.

kayg commented

2026-10-07 02:14:48 +00:00

Author

Owner

Correction to the screenshot-upload note: no credential values are included in the report. Earlier in this job, a disposable auth setup token appeared in a diagnostic; I reported it at the time under #1271 for rotation. The diagnostic now redacts tokens. I am not repeating the value here.

kayg commented

2026-10-07 18:58:13 +00:00

Author

Owner

Started round 2 on branch job/bash-core. The round began at ef514d9f7bd4b94958a7ff51025652bb4ecddc72; I merged origin/dev once at 0419170fe456b58614befcb12d9c9d255118f1c0. Current head: 088d7241791221e7d6c97d74f89efabb05f3f406. I am following the requested product flow order and will file cross-owner/shared findings without editing their code.

Started round 2 on branch `job/bash-core`. The round began at `ef514d9f7bd4b94958a7ff51025652bb4ecddc72`; I merged `origin/dev` once at `0419170fe456b58614befcb12d9c9d255118f1c0`. Current head: `088d7241791221e7d6c97d74f89efabb05f3f406`. I am following the requested product flow order and will file cross-owner/shared findings without editing their code.

kayg commented

2026-10-07 20:13:25 +00:00

Author

Owner

Round 2 progress (2026-10-07): the real-server cross-User matrix completed for three Users and an Admin. It replayed 203 of 429 classified operations and made 938 A-ID versus missing-ID comparisons across B, C, D and anonymous; no non-SLOW privacy leak was observed. Settings review passed at 390/820/1440 in light and dark, and all 26 legacy Settings URLs resolved to canonical routes. The Search and Settings review scripts had stale timing/resize assumptions; I updated only their e2e helpers and reran the focused production flows. The Update available toast in earlier screenshots came from mismatched test build IDs; I rebuilt the web bundle with the shared server's ID, and the fresh captures are clean. No production bug is confirmed yet. Continuing with persisted Settings effects and the Admin flows.

kayg commented

2026-10-07 21:34:21 +00:00

Author

Owner

Round 2 finding: filed #1404, Admin: Users page has no delete action (major). The Users row exposes Copy link, Role, Passkey link and Disable, but no Delete action. The real Admin API accepts an Archive deletion, returns 202, removes the User from the active list and creates an archive. Evidence: artifacts/bash-core2/admin-users-before-delete.png (real production UI, macOS emulation, 1440 × 900 at 1×). I did not add a UI flow because the bug-bash rules prohibit new features and the Admin deletion interaction is not specified beyond the Archive, Transfer and Purge policies in DESIGN.md §27.

Round 2 finding: filed #1404, **Admin: Users page has no delete action** (major). The Users row exposes Copy link, Role, Passkey link and Disable, but no Delete action. The real Admin API accepts an Archive deletion, returns 202, removes the User from the active list and creates an archive. Evidence: `artifacts/bash-core2/admin-users-before-delete.png` (real production UI, macOS emulation, 1440 × 900 at 1×). I did not add a UI flow because the bug-bash rules prohibit new features and the Admin deletion interaction is not specified beyond the Archive, Transfer and Purge policies in DESIGN.md §27.

kayg commented

2026-10-07 21:52:13 +00:00

Author

Owner

Found and filed #1405: when the owner changes an open recipient's share from viewer to editor, the server reports editor but the recipient remains read-only after five seconds. Production evidence: artifacts/bash-core2/share-collaborate-access-stale.png. This crosses the shared collaboration/editor boundary, so it is filed only and not changed in this job.

Found and filed [#1405](https://git.kayg.org/kayg/calternal/issues/1405): when the owner changes an open recipient's share from viewer to editor, the server reports editor but the recipient remains read-only after five seconds. Production evidence: `artifacts/bash-core2/share-collaborate-access-stale.png`. This crosses the shared collaboration/editor boundary, so it is filed only and not changed in this job.

kayg commented

2026-10-07 22:48:15 +00:00

Author

Owner

Found and filed #1416: on /settings/connected-accounts at 1440 px, the bottom sidebar Copy link is covered by .content.scroll-fade-end. A real pointer click leaves the clipboard empty; the Account row above copies its stable URL. Evidence: artifacts/bash-core2/settings-copy-connected-hit.png. This touches the shared UI sidebar, so it is filed only.

Found and filed #1416: on `/settings/connected-accounts` at 1440 px, the bottom sidebar Copy link is covered by `.content.scroll-fade-end`. A real pointer click leaves the clipboard empty; the Account row above copies its stable URL. Evidence: `artifacts/bash-core2/settings-copy-connected-hit.png`. This touches the shared UI sidebar, so it is filed only.

kayg commented

2026-10-07 22:54:02 +00:00

Author

Owner

Correction after a realistic retest: the initial Copy link failure was a harness race. The sidebar had not finished expanding after route load, and scrollIntoViewIfNeeded() moved the row below the scrollport. After waiting for layout and scrolling the sidebar with pointer-wheel input, Apps & Devices copies /settings/apps-devices correctly. The reported Connected Accounts failure also used the premature scroll. #1416 is not confirmed as a product bug; please treat it as withdrawn pending owner cleanup. I am rerunning all section Copy links with the corrected flow.

Correction after a realistic retest: the initial Copy link failure was a harness race. The sidebar had not finished expanding after route load, and `scrollIntoViewIfNeeded()` moved the row below the scrollport. After waiting for layout and scrolling the sidebar with pointer-wheel input, Apps & Devices copies `/settings/apps-devices` correctly. The reported Connected Accounts failure also used the premature scroll. #1416 is not confirmed as a product bug; please treat it as withdrawn pending owner cleanup. I am rerunning all section Copy links with the corrected flow.

kayg commented

2026-10-07 23:02:58 +00:00

Author

Owner

Retest update, superseding my previous correction: #1416 is confirmed for Connected Accounts only. I waited for the route heading and sidebar layout, used pointer-wheel scrolling to place the row in the middle of the sidebar, then moved and clicked on the real Copy link control. The control stayed opacity: 0 / pointer-events: none; the hit target was .content.scroll-fade-end; the clipboard stayed empty. A corrected 26-section sweep passed 25 Copy links and all 26 deep links; only /settings/connected-accounts failed. Evidence: /home/kayg/Developer/calternal-wt/bash-core/artifacts/bash-core2/settings-copy-connected-natural.png. The earlier extra failures were from the test's premature scrolling and are not product findings. Please use this update in place of the prior withdrawal note.

Retest update, superseding my previous correction: #1416 is confirmed for Connected Accounts only. I waited for the route heading and sidebar layout, used pointer-wheel scrolling to place the row in the middle of the sidebar, then moved and clicked on the real Copy link control. The control stayed `opacity: 0` / `pointer-events: none`; the hit target was `.content.scroll-fade-end`; the clipboard stayed empty. A corrected 26-section sweep passed 25 Copy links and all 26 deep links; only `/settings/connected-accounts` failed. Evidence: `/home/kayg/Developer/calternal-wt/bash-core/artifacts/bash-core2/settings-copy-connected-natural.png`. The earlier extra failures were from the test's premature scrolling and are not product findings. Please use this update in place of the prior withdrawal note.

kayg commented

2026-10-07 23:04:42 +00:00

Author

Owner

Found and filed #1419: a signed-out view-only public link for a real .txt file opens Quick Look but shows “No preview for this kind of file.” The page contract allows text previews; singleItem() drops the public MIME and Quick Look classifies it as other. Evidence: artifacts/bash-core2/public-text-preview-round2.png. I am fixing this in the public link page and will rerun the focused regression.

Found and filed #1419: a signed-out view-only public link for a real `.txt` file opens Quick Look but shows “No preview for this kind of file.” The page contract allows text previews; `singleItem()` drops the public MIME and Quick Look classifies it as `other`. Evidence: `artifacts/bash-core2/public-text-preview-round2.png`. I am fixing this in the public link page and will rerun the focused regression.

kayg commented

2026-10-07 23:22:02 +00:00

Author

Owner

The public text regression #1419 is fixed on branch. A follow-up paint check found Quick Look's title pill covers a one-line TextView at the top of the viewer; I added this evidence to existing shared-primitive issue #1408 instead of filing a duplicate. Screenshot: artifacts/bash-core2/public-preview-pixels.png. The shared viewer defect means the one-line text capture is not clean visual proof; text rendering is verified in DOM, and #1408 owns the paint clearance fix.

The public text regression #1419 is fixed on branch. A follow-up paint check found Quick Look's title pill covers a one-line TextView at the top of the viewer; I added this evidence to existing shared-primitive issue #1408 instead of filing a duplicate. Screenshot: `artifacts/bash-core2/public-preview-pixels.png`. The shared viewer defect means the one-line text capture is not clean visual proof; text rendering is verified in DOM, and #1408 owns the paint clearance fix.

kayg commented

2026-10-08 00:32:31 +00:00

Author

Owner

bash-core2 Round 2 — finished

Branch: job/bash-core. The required merge was 088d7241791221e7d6c97d74f89efabb05f3f406, based on origin/dev at 0419170fe456b58614befcb12d9c9d255118f1c0.

Head: 19e1e19f7e4b0afdb8c34ce5fb52ded2f26bcf95 (clean worktree).

Commits for the Public text preview fix and its exact performance pins:

f5f1da53f — preserve the server MIME in the Public preview item so view-only text files select the existing text viewer.
ff30ed57b — refresh the affected exact performance hashes; all recorded limits stayed unchanged.
19e1e19f7 — clarify the Public link module contract and refresh its matching exact hashes.

Findings

Issue	Symptom	Severity	Disposition
#1404	Admin Users has no Delete action.	Major	Filed only.
#1405	A recipient remains Read only after the owner grants editor access.	Major	Filed only; the shared collaboration/editor code is owned by #1197.
#1408	The floating Quick Look title covers the first lines of text; a short file can look blank.	Major	Filed only; the shared viewer is outside this area.
#1416	The Connected Accounts Copy link button is covered by the scroll-fade layer and does not write to the clipboard.	Minor	Filed only. The corrected sweep isolated this to 1 of 26 links.
#1419	A view-only `.txt` Public link had no preview because the item lost its MIME type.	Major	Fixed in `f5f1da53f`; real-server signed-out checks passed.

Coverage

Flow	Status	Evidence, matrix and remaining coverage
Cross-User discovery	Tested; no non-SLOW leak found	Three Users plus an Admin. The XUser matrix covered Search, recipients, mentions, notifications, Calendar invites, Files Shared, deep links, DAV discovery and errors. It recorded 203 replays and 938 ID-versus-missing comparisons. One 5.9 s byte-range sample was SLOW. API/protocol coverage; viewport/theme matrix does not apply. Directory code was left to #1199.
Settings sections and effects	Partial	26 Settings/Admin routes restored the selected section. Appearance, font/size, location, Photos/backgrounds, App Passwords and Connected Accounts flows were exercised. The broader Settings captures use 390/820/1440 px, light/dark and macOS platform signals. Missing: changing, reloading, validating and resetting every individual setting; all dynamic Tab Settings routes; all touch/offline/reload combinations.
Settings and Admin deep links / Copy link	Partial	All 26 static routes restored the exact section. 25/26 Copy link actions copied the expected URL; Connected Accounts is #1416. Profile Passkeys Copy link was also exercised. `artifacts/bash-core2/settings-copy-connected-natural.png` and `settings-copy-connected-hit.png` show the remaining obstruction.
Connected Accounts and Apps	Partial	Provider chooser/setup and App Password creation were exercised. Integrations evidence covers 390/820/1440 px in light/dark with macOS platform signals. Every provider setting was not changed and reloaded; the Copy link failure is #1416.
Admin users, invites, licence and Plugins	Partial	Invite/create/revoke, disable/re-enable, delete/archive, and a seventh User rejected at the free six-User cap (409). Seven optional Plugins were toggled off/on; Tabs disappeared/reappeared and disabled Plugin API middleware returned 404. The live instance had `feature_flags: []`, so no flags could be tested without fake data. SPA route 404/403 behavior after disable was not verified. Licence evidence covers 390/820/1440 px in light/dark.
Sign-in, sign-out and session expiry	Partial	Passkey and recovery-key flows, invite registration/revocation, User disable/re-enable, and cross-tab sign-out/deep-link returns were exercised. A repeated late session-expiry/file passkey start returned the server's 429 rate limit, then timed out waiting for Quick Look; that exact late path remains incomplete. Completed cases showed no lost edit.
Sharing, Collaborate and public links	Partial	View-only revocation while the recipient kept the Note open passed: the Note disappeared in place and the next read returned 404. Public-link expiry passed without revealing the filename. Editor grant still showed Read only (#1405). Public `.txt` preview passed signed-out checks at 390/820/1440 px, light/dark, reduced motion, with Enter/Escape. Mac platform signals were emulated. The multiline 1440 screenshot shows #1408's title overlap.
Notifications and toasts	Partial	100 real notifications were created with concurrency 12; all returned 200 in 3.297 s. API latency was p50 268.9 ms / p95 823.7 ms. After 6.6 s the Undo toast was gone and the removed item stayed removed. This was a desktop/light run; touch, themes, offline and the full viewport matrix remain untested. No new #1238 defect was observed.
Search palette, filters and saved searches	Partial	Seeded 10,000 Logs through the real API. Six filter expressions parsed; 12 palette typing loops reached a visible matching result; a saved search opened its deep link. Typing-to-visible latency under 4× CPU throttle was p50 843 ms / p95 1,229 ms. Search screenshots cover 390/820/1440 px, light/dark and macOS platform signals. Every filter combination and all network/input modes were not tested.

Performance

Measurements were local on the shared build host, not the perf VM. For the 10k Search run, client first-frame p95 was 535.2 ms; there were 59 long tasks over 50 ms (maximum 305 ms). The server's mean RSS was 612.3 MB (617.5 MB peak), mean CPU 182.46% (449.99% peak), and CPU time 28.59 s. The corpus was written in 45.265 s. The baseline search_palette_layout_499 is p95 248.3 ms at about 499 items, so it is not a like-for-like comparison. The 100-notification burst numbers are above. No separate benchmark profile was added because this bug fix uses the existing Public /preview route and does not add an operation.

UX gaps closed

Public text previews keep server MIME metadata through the existing viewer selection path.
Open shared Notes lose access in place after revoke; the next API read is 404.
The static Settings/Admin route sweep restored all tested sections and identified the single obstructed Copy link.
Cross-User probes found no non-SLOW data or existence leak.

UX gaps left

#1404, #1405, #1408 and #1416 remain filed-only findings.
The exhaustive per-setting persistence/invalid/reset matrix, every Search filter combination, full Admin feature-flag and post-disable SPA route checks, and every touch/offline/reload combination remain incomplete.
The last repeated expiry-file auth flow hit the server's passkey rate limit.
Screenshot files remain in the ignored worktree under artifacts/bash-core2/ and were not committed. scripts/fj issue comment exposes --body-file but no binary attachment option, so this comment lists the evidence paths rather than uploading the PNGs.

Gates (verbatim output excerpts)

cargo fmt --check passed with no output. No Rust source changed, so cargo clippy and cargo test were not run.

bun run check exited 0. Exact output lines:

NOTE Bun skipped 1 lock package(s) not installed in this production environment
PASS production dependency licences: 759 locked package releases across apps/web, apps/docs and packages
perf-lint: PASS; 0 violations; 22544 scoped exceptions
User browser caches use userStorage; only documented device/public-link exceptions remain.
Glass alpha, blur and backdrop-filter roles use packages/ui/src/tokens.css.
Text sizes and UI shape values use shared role tokens.
Keyboard focus rings use the shared focus tokens.
UI transitions and animation options use shared motion tokens or documented exceptions.
Loading svelte-check in workspace: /home/kayg/Developer/calternal-wt/bash-core/apps/web
Getting Svelte diagnostics...
svelte-check found 0 errors and 1 warning in 1 file

The one warning is the existing empty CSS ruleset at packages/ui/src/components/calendar/AttachmentDeck.svelte:1055.

The full bun run test run used the merge-time design baseline (CALTERNAL_DESIGN_RULE_BASE=0419170fe456b58614befcb12d9c9d255118f1c0). origin/dev had advanced to d395b6e25 after the required one-time merge. Exact result:

FAIL  |component| src/routes/settings/account/AppPasswordsGroup.svelte.test.ts > grants Calendar, Notes and Mail through the ordinary device choice
Error: Test timed out in 5000ms.
 Test Files  1 failed | 286 passed (287)
      Tests  1 failed | 2035 passed (2036)
   Duration  678.53s (transform 36%, environment 22%, import 19%, tests 18%, setup 5%)
error: script "test" exited with code 1

The failed App Password test passed when run alone with two workers:

 Test Files  1 passed (1)
      Tests  3 passed (3)
   Duration  14.37s (transform 78%, environment 7%, import 7%, tests 6%, setup 2%)

The final standalone perf guard also passed:

perf-lint: PASS; 0 violations; 22544 scoped exceptions

Cleanup: cargo clean removed 2482 files (1.3 GiB); apps/web/build and apps/web/.svelte-kit were removed. The environment supplied CARGO_TARGET_DIR=/home/kayg/build/targets/bash-core2; it was not overridden.

Decisions

No test feature flags were invented because the live Admin API returned an empty flag list.
The design-rule baseline was pinned to the origin/dev SHA actually merged (0419170fe) because the shared origin/dev ref advanced during this job. No second fetch/merge was performed.
Public preview continues to use the existing /preview capability and the server-provided MIME. The fix changes viewer selection only.

## bash-core2 Round 2 — finished Branch: `job/bash-core`. The required merge was `088d7241791221e7d6c97d74f89efabb05f3f406`, based on `origin/dev` at `0419170fe456b58614befcb12d9c9d255118f1c0`. Head: `19e1e19f7e4b0afdb8c34ce5fb52ded2f26bcf95` (clean worktree). Commits for the Public text preview fix and its exact performance pins: - `f5f1da53f` — preserve the server MIME in the Public preview item so view-only text files select the existing text viewer. - `ff30ed57b` — refresh the affected exact performance hashes; all recorded limits stayed unchanged. - `19e1e19f7` — clarify the Public link module contract and refresh its matching exact hashes. ### Findings | Issue | Symptom | Severity | Disposition | |---|---|---|---| | #1404 | Admin Users has no Delete action. | Major | Filed only. | | #1405 | A recipient remains Read only after the owner grants editor access. | Major | Filed only; the shared collaboration/editor code is owned by #1197. | | #1408 | The floating Quick Look title covers the first lines of text; a short file can look blank. | Major | Filed only; the shared viewer is outside this area. | | #1416 | The Connected Accounts Copy link button is covered by the scroll-fade layer and does not write to the clipboard. | Minor | Filed only. The corrected sweep isolated this to 1 of 26 links. | | #1419 | A view-only `.txt` Public link had no preview because the item lost its MIME type. | Major | Fixed in `f5f1da53f`; real-server signed-out checks passed. | ### Coverage | Flow | Status | Evidence, matrix and remaining coverage | |---|---|---| | Cross-User discovery | Tested; no non-SLOW leak found | Three Users plus an Admin. The XUser matrix covered Search, recipients, mentions, notifications, Calendar invites, Files Shared, deep links, DAV discovery and errors. It recorded 203 replays and 938 ID-versus-missing comparisons. One 5.9 s byte-range sample was SLOW. API/protocol coverage; viewport/theme matrix does not apply. Directory code was left to #1199. | | Settings sections and effects | Partial | 26 Settings/Admin routes restored the selected section. Appearance, font/size, location, Photos/backgrounds, App Passwords and Connected Accounts flows were exercised. The broader Settings captures use 390/820/1440 px, light/dark and macOS platform signals. Missing: changing, reloading, validating and resetting every individual setting; all dynamic Tab Settings routes; all touch/offline/reload combinations. | | Settings and Admin deep links / Copy link | Partial | All 26 static routes restored the exact section. 25/26 Copy link actions copied the expected URL; Connected Accounts is #1416. Profile Passkeys Copy link was also exercised. `artifacts/bash-core2/settings-copy-connected-natural.png` and `settings-copy-connected-hit.png` show the remaining obstruction. | | Connected Accounts and Apps | Partial | Provider chooser/setup and App Password creation were exercised. Integrations evidence covers 390/820/1440 px in light/dark with macOS platform signals. Every provider setting was not changed and reloaded; the Copy link failure is #1416. | | Admin users, invites, licence and Plugins | Partial | Invite/create/revoke, disable/re-enable, delete/archive, and a seventh User rejected at the free six-User cap (409). Seven optional Plugins were toggled off/on; Tabs disappeared/reappeared and disabled Plugin API middleware returned 404. The live instance had `feature_flags: []`, so no flags could be tested without fake data. SPA route 404/403 behavior after disable was not verified. Licence evidence covers 390/820/1440 px in light/dark. | | Sign-in, sign-out and session expiry | Partial | Passkey and recovery-key flows, invite registration/revocation, User disable/re-enable, and cross-tab sign-out/deep-link returns were exercised. A repeated late session-expiry/file passkey start returned the server's 429 rate limit, then timed out waiting for Quick Look; that exact late path remains incomplete. Completed cases showed no lost edit. | | Sharing, Collaborate and public links | Partial | View-only revocation while the recipient kept the Note open passed: the Note disappeared in place and the next read returned 404. Public-link expiry passed without revealing the filename. Editor grant still showed Read only (#1405). Public `.txt` preview passed signed-out checks at 390/820/1440 px, light/dark, reduced motion, with Enter/Escape. Mac platform signals were emulated. The multiline 1440 screenshot shows #1408's title overlap. | | Notifications and toasts | Partial | 100 real notifications were created with concurrency 12; all returned 200 in 3.297 s. API latency was p50 268.9 ms / p95 823.7 ms. After 6.6 s the Undo toast was gone and the removed item stayed removed. This was a desktop/light run; touch, themes, offline and the full viewport matrix remain untested. No new #1238 defect was observed. | | Search palette, filters and saved searches | Partial | Seeded 10,000 Logs through the real API. Six filter expressions parsed; 12 palette typing loops reached a visible matching result; a saved search opened its deep link. Typing-to-visible latency under 4× CPU throttle was p50 843 ms / p95 1,229 ms. Search screenshots cover 390/820/1440 px, light/dark and macOS platform signals. Every filter combination and all network/input modes were not tested. | ### Performance Measurements were local on the shared build host, not the perf VM. For the 10k Search run, client first-frame p95 was 535.2 ms; there were 59 long tasks over 50 ms (maximum 305 ms). The server's mean RSS was 612.3 MB (617.5 MB peak), mean CPU 182.46% (449.99% peak), and CPU time 28.59 s. The corpus was written in 45.265 s. The baseline `search_palette_layout_499` is p95 248.3 ms at about 499 items, so it is not a like-for-like comparison. The 100-notification burst numbers are above. No separate benchmark profile was added because this bug fix uses the existing Public `/preview` route and does not add an operation. ### UX gaps closed - Public text previews keep server MIME metadata through the existing viewer selection path. - Open shared Notes lose access in place after revoke; the next API read is 404. - The static Settings/Admin route sweep restored all tested sections and identified the single obstructed Copy link. - Cross-User probes found no non-SLOW data or existence leak. ### UX gaps left - #1404, #1405, #1408 and #1416 remain filed-only findings. - The exhaustive per-setting persistence/invalid/reset matrix, every Search filter combination, full Admin feature-flag and post-disable SPA route checks, and every touch/offline/reload combination remain incomplete. - The last repeated expiry-file auth flow hit the server's passkey rate limit. - Screenshot files remain in the ignored worktree under `artifacts/bash-core2/` and were not committed. `scripts/fj issue comment` exposes `--body-file` but no binary attachment option, so this comment lists the evidence paths rather than uploading the PNGs. ### Gates (verbatim output excerpts) `cargo fmt --check` passed with no output. No Rust source changed, so `cargo clippy` and `cargo test` were not run. `bun run check` exited 0. Exact output lines: ```text NOTE Bun skipped 1 lock package(s) not installed in this production environment PASS production dependency licences: 759 locked package releases across apps/web, apps/docs and packages perf-lint: PASS; 0 violations; 22544 scoped exceptions User browser caches use userStorage; only documented device/public-link exceptions remain. Glass alpha, blur and backdrop-filter roles use packages/ui/src/tokens.css. Text sizes and UI shape values use shared role tokens. Keyboard focus rings use the shared focus tokens. UI transitions and animation options use shared motion tokens or documented exceptions. Loading svelte-check in workspace: /home/kayg/Developer/calternal-wt/bash-core/apps/web Getting Svelte diagnostics... svelte-check found 0 errors and 1 warning in 1 file ``` The one warning is the existing empty CSS ruleset at `packages/ui/src/components/calendar/AttachmentDeck.svelte:1055`. The full `bun run test` run used the merge-time design baseline (`CALTERNAL_DESIGN_RULE_BASE=0419170fe456b58614befcb12d9c9d255118f1c0`). `origin/dev` had advanced to `d395b6e25` after the required one-time merge. Exact result: ```text FAIL |component| src/routes/settings/account/AppPasswordsGroup.svelte.test.ts > grants Calendar, Notes and Mail through the ordinary device choice Error: Test timed out in 5000ms. Test Files 1 failed | 286 passed (287) Tests 1 failed | 2035 passed (2036) Duration 678.53s (transform 36%, environment 22%, import 19%, tests 18%, setup 5%) error: script "test" exited with code 1 ``` The failed App Password test passed when run alone with two workers: ```text Test Files 1 passed (1) Tests 3 passed (3) Duration 14.37s (transform 78%, environment 7%, import 7%, tests 6%, setup 2%) ``` The final standalone perf guard also passed: ```text perf-lint: PASS; 0 violations; 22544 scoped exceptions ``` Cleanup: `cargo clean` removed 2482 files (1.3 GiB); `apps/web/build` and `apps/web/.svelte-kit` were removed. The environment supplied `CARGO_TARGET_DIR=/home/kayg/build/targets/bash-core2`; it was not overridden. ### Decisions - No test feature flags were invented because the live Admin API returned an empty flag list. - The design-rule baseline was pinned to the `origin/dev` SHA actually merged (`0419170fe`) because the shared `origin/dev` ref advanced during this job. No second fetch/merge was performed. - Public preview continues to use the existing `/preview` capability and the server-provided MIME. The fix changes viewer selection only.

kayg referenced this issue

2026-10-08 00:34:02 +00:00

Search: typing p95 1.2 s at 10k Logs #1425

Rows
Columns

Bug bash: core #1220

Final report — #1220

Findings

E2E findings and evidence

Performance

UX gaps

Gates

Decisions

bash-core2 Round 2 — finished

Findings

Coverage

Performance

UX gaps closed

UX gaps left

Gates (verbatim output excerpts)

Decisions