moving

docs/audits/2026-07-08-ux-correction-register.md

@@ -0,0 +1,148 @@
+# Waggle OS UX Correction Register
+
+Companion artifacts:
+
+- `docs/audits/2026-07-08-ux-approval-brief.md`
+- `docs/audits/2026-07-08-complete-ux-usage-audit.md`
+- `docs/audits/2026-07-08-ux-route-scenario-manifest.md`
+- `docs/audits/2026-07-08-ux-state-failure-scenario-matrix.md`
+- `docs/audits/2026-07-08-ux-non-main-surface-scope.md`
+- `docs/audits/2026-07-08-five-persona-judge-scorecards.md`
+- `docs/audits/2026-07-08-five-persona-judge-runbook.md`
+- `docs/audits/2026-07-08-ux-post-phase-1-roadmap.md`
+- `docs/audits/2026-07-08-web-guidelines-line-findings.md`
+- `docs/audits/2026-07-08-runtime-a11y-t10-analysis.md`
+- `docs/audits/2026-07-08-visual-t5-classification.md`
+- `docs/audits/2026-07-08-source-inventory-consistency-audit.md`
+- `docs/audits/2026-07-08-browser-companion-t19-analysis.md`
+- `docs/audits/2026-07-08-desktop-wrapper-t14-analysis.md`
+- `docs/audits/2026-07-08-admin-cli-utility-t15-analysis.md`
+- `docs/audits/2026-07-08-ai-tool-hook-t16-analysis.md`
+- `docs/audits/2026-07-08-developer-substrate-t17-analysis.md`
+- `docs/audits/2026-07-08-ops-deploy-ci-judging-t18-analysis.md`
+- `docs/audits/2026-07-08-launch-funnel-t13-analysis.md`
+- `docs/audits/2026-07-08-route-evidence-t11-analysis.md`
+- `docs/audits/2026-07-08-state-failure-t12-analysis.md`
+- `docs/audits/2026-07-08-mobile-executive-t2-t12-analysis.md`
+- `docs/audits/2026-07-08-first-run-onboarding-t1-t2-t12-analysis.md`
+- `docs/audits/2026-07-08-shell-overlays-t10-t12-analysis.md`
+- `docs/superpowers/plans/2026-07-08-ux-phase-1-corrections.md`
+
+Purpose: one tracking register for every UX finding currently blocking or reducing the five-persona 9/10 goal. This file does not replace the audit; it maps audit findings to tickets, phases, likely files, judge impact, and closure evidence.
+
+Final reconciliation (2026-07-13): the row-level entries below preserve the chronology of the audit and may describe an earlier branch state. The current integrated result is authoritative in `docs/audits/2026-07-13-final-goal-verification.md`. In particular, Channels hardening is integrated, the final five-persona run passes 5/5 at 9.1-9.5, full current-head lint/typecheck/build/test/visual/accessibility gates pass, and Tauri now has generated MSI and NSIS packages plus a healthy launch from an extracted MSI payload. T13 public DNS/deployment, production signing/updater delivery, and credential-dependent external-provider smokes remain release gates; they are not represented as completed product work.
+
+Status key:
+
+- `Open`: analyzed, not fixed.
+- `Phase 1 Pending Approval`: included in the first implementation plan, awaiting user approval before coding.
+- `Partially Fixed`: implementation and verification landed for part of the finding, but the ticket still has named remaining scope.
+- `Phase 2 Pending`: important for 9/10, but intentionally after Phase 1.
+- `Phase 3 Pending`: polish/performance work after trust/flow blockers.
+- `Tooling`: not product UX, but affects repeatable audit confidence.
+
+## Register
+
+| Finding | Ticket | Phase | Status | Primary files/surfaces | Judge impact | Closure evidence |
+|---|---|---:|---|---|---|---|
+| P0-1 Accountless Clerk/CSP console health | T1 | 1 | Verified Fixed | `packages/server/src/local/security-middleware.ts`, `packages/server/tests/local/security-middleware.test.ts`, `apps/web/src/lib/clerk.ts`, `apps/web/src/providers/WaggleClerkProvider.tsx`, `tests/e2e/full-product-audit.spec.ts`, `tests/e2e/phase-ab-verification.spec.ts` | Solo founder, Team admin, Engineer | Accountless local lane has no Clerk/CSP errors in current focused checks: `clean first-run onboarding loads without Clerk, CSP, or page errors`, `no console errors on initial load`, and `no critical console errors on load` passed 3/3 on port `34196`. Auth still needs explicit-enabled coverage as a separate state bundle. |
+| P0-2 Mobile Settings structural usability | T2 | 1 | Verified Fixed | `apps/web/src/components/os/apps/SettingsApp.tsx`, `tests/e2e/user-journeys.spec.ts`, Settings visual/mobile screenshots | Mobile executive, Team admin | Current 390 x 844 Settings has no document-level overflow, no clipped critical controls, no squeezed two-pane rail, and no visible element overflow in general/models/billing/profile: `J-mobile: Settings is usable at 390px width` passed 1/1 on port `34195`. |
+| P0-7 Mobile first-run onboarding primary action reachability | T2/T12 | 1 | Verified Fixed | `apps/web/src/components/os/overlays/OnboardingWizard.tsx`, `apps/web/src/components/os/overlays/onboarding/WhoAreYouStep.tsx`, `tests/e2e/user-journeys.spec.ts` | Mobile executive, Solo founder | Current 390 x 844 clean-data onboarding Profile keeps the primary Continue action reachable with no visible overflow: `J-mobile: first-run onboarding keeps primary actions reachable at 390px width` passed 1/1 on port `34194`. |
+| P0-3 Cockpit pricing copy uses Solo/Team/Enterprise | T3 | 1 | Verified Fixed | `MarketplaceApp.tsx`, `AddCustomMcpForm.tsx`, `command-catalog.ts`, `LoginBriefing.tsx`, `SkillRow.tsx`, `SettingsApp.tsx`, `PaymentSuccessApp.tsx` | Solo founder, Team admin, Mobile executive | Active cockpit UI copy uses Solo, Team, and Enterprise. Current source search finds remaining `Pro` references only in explicit legacy billing compatibility (`Legacy Pro`, `Pro (legacy)`), tests/comments, or model names; public legal Pro copy is tracked under launch-funnel T13. |
+| P0-4 Visual regression suite for tracked views | T5 | 1 | Verified Fixed | `tests/visual/views.spec.ts`, `tests/visual/baselines/**`, affected rendered routes, `docs/audits/2026-07-08-visual-t5-classification.md` | All personas | Current visual suite passes 14/14 on port `34199`; canonical ASCII-hyphen baselines are active, volatile Home text is masked in the visual spec, and duplicate historical baseline families are documented. |
+| P0-5 `Ctrl+Shift+N` shortcut route contract | T4 | 1 | Verified Fixed | `apps/web/src/components/os/AppShell.tsx`, `apps/web/src/hooks/useKeyboardShortcuts.ts`, `tests/e2e/phase-ab-verification.spec.ts`, `tests/e2e/power-user-stress.spec.ts` | Engineer, Solo founder | Shortcut opens active or first available workspace chat; both shortcut E2E tests passed 2/2 on port `34197`. |
+| P0-6 Workspace Switcher route traversal | T4 | 1 | Verified Fixed | `AppShell.tsx`, `WorkspaceSwitcher.tsx`, `tests/e2e/full-wiring-audit.spec.ts` | Engineer, Mobile executive | Route-changing navigation closes or supersedes the switcher; `traverse all sidebar views — zero critical JS errors` passed 1/1 on port `34198`, proving traversal is not intercepted by backdrop. |
+| P1-1 Native browser dialogs interrupt branded workflows | T7 | 2 | Current Scan Fixed | `BackupApp.tsx`, `ApprovalsApp.tsx`, `AutomationCenterApp.tsx`, `ArtifactCenterApp.tsx`, `SettingsApp.tsx`, `MemoryCenterTab.tsx`, `WikiTab.tsx`, `CreateWorkspaceDialog.tsx`, `ComplianceTemplateModal.tsx`, `packages/admin-web/src/pages/Members.tsx` | Team admin, Researcher | Current high-confidence production native-dialog scan is clean. Create Workspace custom-template delete, Approvals revoke-all, Artifact permanent delete, Memory Center delete/erase/re-import, Wiki export destinations, Settings telemetry/backup/restore, standalone `BackupApp` restore, Automation delete, compliance template delete, and admin member removal now use in-app confirmations/forms/status with focused component/rendered coverage. Remaining T7 work is broader persona-state, failure-state, and accessibility evidence. |
+| P1-2 Test output is too noisy | T10 | 2 | Phase 2 Pending | Tests emitting repeated `act(...)` warnings; affected component tests | All personas indirectly | Standard verification output is short enough that real failures are visible; expected warning noise is eliminated or isolated. |
+| P1-3 Marketplace and local-first test determinism need tightening | T6 | 2 | Audit Lane Fixed | `packages/server/src/local/routes/marketplace.ts`, `marketplace-background-sync.ts`, E2E marketplace calls | Engineer, Solo founder | Manual `/api/marketplace/sync` now respects `WAGGLE_DISABLE_MARKETPLACE_SYNC=1` and returns a no-network skipped response; focused server tests pass 3/3, server typecheck passes, and the focused Playwright marketplace slice passes 4/4 on port `34203`. Live external-sync UX remains an explicit/non-default lane. |
+| P1-4 Initial app payload is too heavy | T8 | 3 | Focused Fixed; media residual | Route/app composition under `apps/web/src/components/os`, `shape-selection.ts`, persona/logo asset import sites | Mobile executive, Engineer | Startup JS is now below the Vite 500 kB warning threshold: routes, closed shell overlays, ChatHost, and PostHog are lazy-loaded and guarded by `build-warning-hygiene.test.ts`; current production build reports the startup chunk at 423.61 kB minified / 114.63 kB gzip with no large-chunk warning. Remaining media work is persona/logo asset optimization or explicit acceptance in the visual/CLS pass. |
+| P1-5 Form, focus, and icon-button accessibility need a focused pass | T10 | 2 | Partially Fixed | Settings, profile, workspace creation, workspace actions, agent builders/cards, Mission Control, compliance templates, onboarding, Launcher, Approvals, Files, workspace chat, Command Center | Mobile executive, Team admin, Engineer | Settings Prompt Shape/model/trust/team/KVARK fields, Profile identity/preferences/brand fields and Analyze Style action focus, Chat composer metadata/focus, Vault add-secret/actions, Launcher refresh/prompt and prompt focus ring, Approvals refresh/revoke, Cockpit/WaggleDance/ComplianceDashboard/AgentCard sampled actions, Agent/Skill/Automation Builder metadata and Skill Builder reorder focus rings, SkillEditorDrawer markdown-editor metadata, Automation Center template metadata/focus rings, AgentCard and GroupCard separate select/delete controls, full scoped production `transition-all` backlog closed with explicit transition properties, AgentCenterRow media dimensions, ReadyStep media dimensions, BootScreen/StatusBar media dimensions, LoginBriefing/Chat/SpawnAgentDialog media dimensions, Spawn Agent launch task/new-workspace metadata, Artifact Center search/create/detail-editor metadata and detail Kind focus ring, Agent Center search metadata, Agent Center templates search metadata, ExtensionCard inline connector-token metadata, InstallAuditPanel audit-filter metadata, ModelPilotCard budget-threshold slider metadata/focus ring, TelemetryApp daily-budget metadata, Skills Hub search metadata, Files toolbar action names/filter metadata/focus rings, Files new-folder/rename metadata, Files move/properties dialog close names/focus rings and row Properties context-menu behavior, Mission Control refresh/pause/resume/stop action names/focus rings, ConnectorCard setup metadata/action focus rings, Memory Center search/detail metadata and filter/action focus rings, MemoryCard selection checkbox labels/metadata, Memory Trust search/correction metadata and focus rings, TimelineTab search/filter metadata and filter-toggle name, EvolutionTab proposal review-note/New Run modal select/textarea metadata, close action name, and focus rings, Knowledge Graph search/scope metadata and toolbar/legend action names/focus rings, Harvest import/source action metadata and focus rings, Custom MCP form metadata/focus rings, MCP catalog search and scope-select metadata, ModelGate key/pull metadata, inline capability connector-token metadata, Telegram digest credential metadata, first-run onboarding profile/workspace/first-task metadata, EraseDataDialog destructive confirmation metadata/focus ring, Agent template creator/detail metadata/focus rings, All Workspaces search metadata/focus ring, Wiki search, WorkspaceActionsMenu rename/delete confirmations, warm AskBar metadata/focus ring, workspace TasksTab add-task metadata/focus ring, Timeline event-filter metadata/focus ring, Create Workspace visible setup/template/folder-picker metadata and focus rings, Compliance Dashboard report-option metadata and Compliance Template form metadata with token focus rings, Workspace Switcher focus-trap/return evidence, Files storage/browser scroll regions, workspace tab/image semantics, status-bar landmarks, sampled runtime axe, and Command Center description/mobile row fit plus search focus ring now have focused metadata/name/focus fixes and tests. Remaining T10 closeout is any broader unsampled metadata queue outside the covered surfaces, remaining unsampled icon-only controls, and broader modal focus-return evidence. |
+| P1-6 Local model pricing and no-LLM harness are inconsistent | T9 | 3 | Phase 3 Pending | `packages/agent/src/cost-tracker.ts`, `packages/agent/tests/cost-tracker.test.ts`, Usage & Cost UI | Engineer, Team admin | No unknown local-model cost warning in the audit lane; unpriced local models are labeled honestly. |
+| P1-7 Route coverage is uneven relative to the full shell | T11 | 1/2 | Verified Fixed | `tests/e2e/user-journeys.spec.ts`, `tests/visual/views.spec.ts`, `tests/vision/personas.spec.ts`, route/scenario manifest | All personas | Every registered route has an evidence owner in the manifest; prior zero/thin routes now have codified `J-route-coverage` owners, with the focused route coverage tests passing 2/2 on port `34200`. Deeper workflow/state evidence remains tracked in T10/T12/T16. |
+| P1-8 State and failure-mode coverage is not explicit enough for judge scoring | T12 | 2 | Default + Sampled Failure Bundles Captured | `docs/audits/2026-07-08-ux-state-failure-scenario-matrix.md`, `docs/audits/2026-07-08-five-persona-judge-scorecards.md`, `tests/five-persona-state-bundle-contract.test.ts`, `tests/e2e/five-persona-state-bundles.spec.ts`, `output/playwright/five-persona-state-bundles/`, `tests/e2e/failure-injection/network-drop.spec.ts`, `tests/e2e/user-journeys.spec.ts`, `tests/vision/personas.spec.ts` | All personas | Each judge scorecard now cites account mode, billing tier, disclosure tier, model state, data state, offline/error state, viewport, and non-main gate decisions, guarded by `tests/five-persona-state-bundle-contract.test.ts`; rendered accountless/no-LLM persona bundles now pass 5/5 with screenshots, sampled failure/workflow/scale/slow-data probes for chat backend offline, Memory API unavailable, Memory slow-list handling, Memory large-list handling, Timeline/Event large-list handling, Launcher sidecar offline, Cockpit health degraded, Agents slow-list handling, Agents large-list handling, Marketplace unavailable, Marketplace large-catalog handling, Files upload failure, Files upload success, Files large-list handling, billing checkout unavailable, Team active billing state, Team settings unlocked state, billing checkout success return, billing checkout cancel return, backup creation failure, backup restore failure, local model runtime unavailable, and mobile chat backend offline, plus 0 critical console/page/network failures and 0 visible overflow. Remaining closure requires real authenticated Teams server, real deployed/provider checkout success/cancel, packaged desktop/launch, hook lifecycle, broader slow-data/performance states, and approved deferrals where needed. |
+| P0-L1 Public launch funnel has release-blocking smoke and recovery gaps | T13 | 1/Launch | Partially Fixed Locally | `apps/www`, `apps/www/app/_components/Pricing.tsx`, `apps/www/app/_components/DownloadCTA.tsx`, `apps/www/app/download/page.tsx`, `apps/www/app/_lib/os-detection.ts`, `apps/www/app/api/stripe/checkout/route.ts`, `apps/www/app/(legal)/**`, `.github/workflows/deploy-www.yml`, DNS/deploy target | Solo founder, Team admin, Mobile executive | Local checkout/legal/download/deploy-workflow UX is improved: Pricing uses the canonical GET checkout route, cancelled checkout returns to `/?checkout=cancelled#pricing` with an inline retry notice, the public-site hydration issue badge is suppressed intentionally, legal placeholder/stale-tier copy is guarded, Download now routes to a controlled `/download` status page instead of an empty GitHub Releases target, mobile/tablet OS detection keeps the CTA generic instead of labeling iOS/Android as desktop installers, the public-site workflow now targets Vercel prebuilt deployment instead of GitHub Pages/static `apps/www/dist`, `apps/www` tests pass 19/19, typecheck passes, `npm run build:www` passes, rendered Browser recovery smoke has no warnings/errors, and built local smoke returns 200 for `/`, `/?checkout=cancelled`, and `/download`. Remaining launch blockers: canonical DNS/deployed Vercel proof, real signed installer/release artifact publication, real deployed Clerk/Stripe success/cancel evidence, and formal legal sign-off. |
+| P1-10 Desktop wrapper, installer, tray, update, and sidecar-startup UX lack installed-app evidence | T14 | 2/Launch | Partially Fixed; Packaged Startup Proven | `app/src-tauri/**`, `app/tests/**`, `app/scripts/**`, `.github/workflows/release.yml`, `packages/server/src/local/service.ts`, `scripts/build-sidecar.mjs`, `scripts/bundle-node.mjs`, `scripts/check-sidecar-resources.mjs`, `apps/web/src/lib/tauri-bindings.ts`, `apps/web/src/App.tsx` | All personas, especially Solo founder and Team admin | Release workflow now builds workspace packages before Windows/macOS sidecar packaging and is guarded by `tauri-config.test.ts` 25/25. Tray source now exposes only Open, Settings, and Quit; Settings is bridged to `/settings`, Quit uses native `app.exit(0)`, and unsupported Pause/About actions are hidden. Packaged debug startup now builds without installer, launches `target/debug/waggle.exe`, starts bundled `resources/service.js`, reaches `/health`, and has no CORS/module/ABI errors. Service/update events are consumed by the web bridge; native update emission remains disabled until signed updater artifacts exist. Remaining closure still requires MSI/installer packaging, real tray smoke, close-to-tray, global shortcut, forced watchdog-service UI, installer/signing trust, and signed-update proof or explicit deferral. |
+| P1-11 Admin web, CLI launcher, marketplace CLI, and memory MCP utility UX have broken built-entry and rendered/admin evidence blockers | T15 | 2/Launch | Phase 2 Pending; Utility CLI/MCP/Admin Rendered Fixes Landing | `packages/admin-web/**`, `packages/cli/**`, `packages/launcher/**`, `packages/marketplace/**`, `packages/memory-mcp/**`, `packages/hive-mind-mcp-server/**`, `packages/hive-mind-cli/**`, `vitest.config.ts` | Team admin, Engineer, Solo founder setup path | Marketplace CLI built help/invalid-command behavior, package manifest/packed-file alignment, and clean installed packed-CLI `npx` help/invalid recovery; `@waggle/cli` built/packed/local package-closure installed `npx` help plus installed local REPL startup/slash-command/exit and streamed chat/provider plumbing against a mock LiteLLM-compatible endpoint; launcher built help/invalid-port/occupied-port recovery plus packed first-command, clean installed occupied-port startup recovery, and clean installed long-running `/health` startup; sampled hive-mind CLI subcommand help/test discovery plus local package-closure installed `npx` help; legacy memory MCP read/write startup plus local package-closure installed read-only startup; hive-mind MCP write-scope roundtrip plus local package-closure installed read-only startup; and admin-web unit plus rendered package coverage are locally fixed and guarded. The rendered admin gate now includes browser back/forward traversal, page-level keyboard traversal, desktop/mobile visual snapshots, malformed analytics response recovery, all-page initial API-failure recovery, mutation/destructive-failure recovery for capability policy save, capability override create/remove, capability request decision, member invite, member role change, member removal, and team settings save, plus local bearer-auth wrong-token/valid-token behavior through protected Fastify routes. Remaining T15 closure still requires registry-only proof after internal package publication, or an explicit deferral. |
+| P1-12 AI-tool hook install/verify/uninstall UX lacks packaged desktop hook-status proof and fully quiet release output | T16 | 2/Launch | Phase 2 Pending; Rendered Lifecycle Fixed; Warning Hygiene Partially Fixed | `apps/web/src/components/os/apps/LauncherApp.tsx`, `apps/web/src/components/os/apps/launcher/ToolOutputPane.tsx`, `apps/web/src/lib/adapter.ts`, `packages/shared/src/tool-detection.ts`, `packages/agent/src/tool-detection.ts`, `packages/agent/src/tool-launcher.ts`, `packages/agent/src/tool-command.ts`, `packages/agent/src/tool-process-tracker.ts`, `packages/agent/src/tool-output-buffer.ts`, `packages/hive-mind-hooks-*/**`, `tests/e2e/launcher-rendered-states.spec.ts`, `tests/e2e/launcher-real-tool-lifecycle.spec.ts`, `tests/e2e/launcher-real-hook-lifecycle.spec.ts` | Engineer, Solo founder, Team admin | Packed-package `npx` command install/verify/uninstall now passes for the six hook-capable tools, hook/shim package-local scripts now pass, observed live output no longer reconnects/replays after exit in focused tests, Launcher component tests preserve hook stdout/stderr details, show Backup/Recovery labels for covered install output, summarize Verify `[FAIL]` output as Check-failed/manual-approval rows, label uninstall restore/cleanup rows without implying install state, cap long hook output behind `More output`, and prove launchable third-party adapters get a Launch action and prompt routing; adapter/route tests preserve structured hook failures and launch registered adapters through the runtime registry; live Verify now renders `verify failed (exit 1)` with retry/uninstall/reinstall guidance instead of `HTTP 400`; Browser mocks prove Codex Verify manual approval and Codex Uninstall cleanup panels; Playwright rendered coverage proves standard install changed-file/pointer/backup/recovery labels, sidecar-offline Retry, long stderr summarization, all six hook-capable rendered install/verify/uninstall transitions, non-built-in adapter launch-only/prompt behavior, and one real OpenClaw observed launch/output/exit/process-clear lifecycle; a broadened real route smoke proves `/api/tools/hooks` install/verify/uninstall for all six hook-capable tools in an isolated profile; Windows npm shims now resolve to Node module targets when possible and use a quoted fallback otherwise; Windows hook commands now resolve the Node-installed `npx.cmd`; Codex detected only through the restricted WindowsApps alias is now installed-but-not-launchable with recovery copy; Claude Desktop is explicitly launch-only with no hook actions; Tailwind motion-token ambiguity warnings are removed and guarded; and the `shape-selection.ts` dynamic/static import warning is removed and guarded. Remaining closure requires packaged desktop hook-status evidence and remaining warning hygiene; or T16 is explicitly deferred. |
+| P1-13 Developer API, background worker, and substrate package verification UX has command-shape and suite-stability gaps | T17 | 2/Tooling | Phase 2 Pending; Playwright Startup Fixed | `packages/sdk/**`, `packages/server/**`, `packages/worker/**`, `packages/waggle-dance/**`, `packages/hive-mind-core/**`, `packages/hive-mind-shim-core/**`, `packages/wiki-compiler/**`, `packages/*/package.json`, `vitest.config.ts`, `vitest.perf.config.ts`, Playwright `webServer` startup | Engineer, Team admin, release confidence | Root and package verification commands are documented and deterministic; package-local scripts either pass or point to the correct root/project-reference lane; Playwright `webServer` now starts with pinned `tsx@4.21.0` and matching `esbuild@0.27.7` evidence; the named server lane passes 185/2128 with one worker and the isolated perf lane passes 13/13; or T17 is explicitly deferred from the final score. |
+| P1-14 Ops, deployment, CI, benchmark, and judging evidence is incomplete for a complete-system claim | T18 | 2/Launch/Tooling | Phase 2 Pending | `.github/workflows/**`, `Dockerfile`, `docker-compose*.yml`, `render.yaml`, `litellm-config.yaml`, `ops/**`, `benchmarks/**`, `judging/**`, `vitest.infra*.ts` | Release confidence, Engineer, Team admin | YAML/Compose/benchmark evidence is attached; secret-safe validation commands are documented; Render/Docker/CI infra targets are coherent; current judge artifacts are generated from the current source; or T18 is explicitly deferred. |
+| P1-15 Browser Companion extension UX is a real capture surface with incomplete native-toolbar/context evidence | T19 | 2/Launch | Partially Fixed; Native Toolbar/Context Evidence Pending | `apps/browser-ext/**`, `packages/server/src/local/routes/browser-ext.ts`, `packages/server/src/local/cors-config.ts`, `packages/server/src/local/security-middleware.ts`, `packages/server/src/local/routes/memory.ts`, `apps/web/src/components/os/settings/CoverageCompassCard.tsx` | Researcher, Solo founder, Mobile executive | Secure token bootstrap, concrete extension-origin CORS matching, MV3 service-worker no-Origin handling, background save auth, sticky accessible popup recovery, restricted-page explanation, disabled-state styling, honest memory-destination copy, secure-default loaded-extension extraction/save/frame confirmation, popup keyboard/focus/Enter save proof, direct popup Save page click smoke, rendered Memory UI confirmation, context-menu handler coverage, stable packaged-ID pairing smoke, `/api/memory/search` imported provenance, and existing chat `auto_recall`/catch-up imported provenance are fixed and verified. Remaining closure requires native toolbar-bubble evidence or manual release proof, native context-menu click proof or deferral, signed Web Store/installer-distributed extension proof if release packaging is scored, and separate proof for any future recall result shape if scored; or T19 is explicitly deferred from the five-persona score. |
+| P1-16 Command Center mobile close and label fit needed proof | T10/T12 | 2 | Focused Fixed | `apps/web/src/components/os/overlays/CommandCenter.tsx`, `tests/e2e/user-journeys.spec.ts`, `tests/e2e/five-persona-state-bundles.spec.ts`, mobile overlay screenshots | Engineer, Mobile executive | Command Center now has a dialog description, mobile catalog subtitles truncate on their own line, `J-mobile: Command Center is described and fits at 390px` proves Control+K open/fit/Escape close, and the five-persona bundle now records Mobile Executive Command Center screenshot evidence with 0 visible overlay overflow. |
+| P1-17 High-volume first-run import is too easy to trigger | T7/T12 | 2 | Focused Fixed | `apps/web/src/components/os/overlays/onboarding/ImportStep.tsx`, `apps/web/src/test/onboarding-import-step.test.tsx`, Memory Harvest | Solo founder, Researcher, Team admin | Large detected histories now use deliberate review/secondary action copy: `Review after setup` is primary, immediate import is explicit as `Import 5,514 now`, and small histories keep the simple import CTA. Focused component coverage passes 2/2 and web typecheck passes; broader Harvest review/recovery states remain in T12. |
+| P1-18 First-run model/first-task handoff polish is inconsistent | T10/T12 | 2 | Focused Fixed | `ModelGateStep.tsx`, `ChatApp.tsx`, `ModelGateStep.test.tsx`, `lane-c-input-power.test.tsx` | Solo founder, Engineer | Model-ready onboarding now shows `Model ready` instead of the setup/checking gate while Continue is enabled, and first-task auto-send clears the untouched composer seed before the send promise resolves. Focused tests pass 5/5 and 12/12; the onboarding focused bundle passes 22/22; web typecheck passes. |
+| P1-19 Shell overlays do not share a consistent accessibility/close contract | T10/T12 | 2 | Partially Fixed | `NotificationInbox.tsx`, `CreateWorkspaceDialog.tsx`, `WorkspaceSwitcher.tsx`, `ContextRail.tsx`, `OnboardingTooltips.tsx`, `UpgradeModal.tsx`, `TrialExpiredModal.tsx`, focused overlay smoke | Mobile executive, Engineer, Solo founder | Notification Inbox, Create Workspace primary/subdialog/template-field contracts, Workspace Switcher focus-trap/return behavior, Context Rail, Onboarding Tooltips, and tier modal close labels now have focused contract coverage. Notification Inbox no longer uses horizontal entrance motion that can overflow mobile, and the five-persona bundle records Notification Inbox plus Command Center mobile overlay screenshots with 0 visible overflow; route-specific rendered evidence for less common overlay states remains. |
+| P1-20 Create Workspace is too dense and template-first on mobile | T10/T12/T7 | 2 | Partially Fixed; mobile disclosure verified | `CreateWorkspaceDialog.tsx`, workspace switcher/create flow, `shell-overlay-contracts.test.tsx`, `user-journeys.spec.ts` | Mobile executive, Solo founder, Team admin | Template delete now uses an in-app confirmation; optional templates and agent assignment use progressive disclosure; the agent section is collapsed by default at 390 x 844 and expands on demand. Focused shell-overlay contracts pass 15/15 and rendered `J-mobile` passes 1/1 on port `34380`. Broader screenshot/state coverage and modal focus-return evidence remain. |
+| P1-21 Provider model inventory was hardcoded and could hide newly released API models | T10/T12/T17/T18 | 2 | Hermetic routing fixed; external credential smoke pending | `packages/server/src/local/provider-model-catalog.ts`, `packages/server/src/local/litellm-runtime-config.ts`, `packages/server/src/local/provider-env.ts`, `packages/server/src/local/model-availability.ts`, `packages/server/src/local/routes/{providers,litellm,settings,agent,fleet}.ts`, `apps/web/src/{hooks/useProviders.ts,components/os/apps/ChatWindowInstance.tsx,components/os/model-gate/ModelGate.tsx}`, provider/router/completion tests | All personas, especially Engineer and Solo founder | Configured provider APIs supply every returned model id, including all Claude cursor pages and Gemini page tokens; Gemini discovery keeps the key in `x-goog-api-key`, not the URL. Startup migrates/hydrates credentials before the router snapshots env; a secret-free runtime config routes stable `provider/model` ids; key saves and manual retry rebuild/restart that catalog. If a provider releases a model while Waggle remains open, Settings/onboarding/Agent Builder and Chat re-pull catalogs on app focus; selecting or saving that model checks the running config, rebuilds and restarts the managed router only when the exact id is missing, and the shared resolver covers Chat, model switching, default-model saves, and fleet workers. Model-management requests now allow the router's real startup window instead of falsely timing out at 10 seconds. The latest focused hot-model lane passes 27/27 backend tests and 3/3 web tests; ModelGate/onboarding remains 28/28, both web typecheck and scoped diff checks pass, and rendered desktop plus 390 px recovery checks show one honest verdict with no horizontal overflow. A paid external-provider smoke remains a release-environment evidence item, not an implementation gap; the aggregate server typecheck is presently blocked only by unrelated parallel-session dependency/type changes recorded in current verification output. |
+| P1-22 Merged Channels had protected-route, loopback-auth, ordering, mobile, and WhatsApp secret-at-rest gaps | T10/T12/T14/T17/T18 | 2/Launch | Isolated hardening complete; integration and live-provider evidence pending | `apps/web/src/components/os/{apps/SettingsApp.tsx,settings/ChannelsSettings.tsx}`, `apps/web/src/lib/adapter.ts`, `packages/server/src/local/channels/**`, channel/chat/event routes, lockfile, focused tests, `docs/audits/2026-07-11-channels-ux-hardening.md` on `codex/channels-ux-hardening` | All personas, especially Engineer, Mobile executive, and Team admin | On the isolated branch, browser and channel loopback calls authenticate through the sidecar session token; configs validate atomically and audit without secret values; held tools enter durable app approval; duplicate deliveries are suppressed and same-chat turns serialize; workspace names resolve to stable IDs; errors/drafts/prerequisites are honest; Settings and channel controls fit at 390 px with the selected tab visible; and Baileys credentials/signal keys live in encrypted Vault state with one-time plaintext migration, fail-closed corruption behavior, logout wipe, and silent upstream logs. Normal clean install passes; backend Channels pass 89/89, focused web passes 12/12, server typecheck/package/web builds and diff checks pass, fresh sidecar/browser flows pass, and a real unpaired Baileys connection returns a QR without creating a plaintext auth directory. This is not yet merged into the dirty UX worktree. Remaining evidence: real Telegram/Discord/Slack credentials, WhatsApp secondary-device scan/restart/unlink, one real held-tool approval, and deliberate branch integration. |
+| P2-1 Stale comments and legacy terminology can mislead future work | Cleanup | 2/3 | Phase 2 Pending | Touched files only; especially tier/billing and route comments such as the stale `/workspaces` redirect note in `apps/web/src/routes/index.ts` | Indirect | Comments in touched files describe current Solo/Teams/Enterprise and route behavior; retired/embedded surfaces are classified before judge scoring. |
+| P2-2 Browser plugin DOM snapshot failed | Tooling | n/a | Tooling | Browser plugin path; Playwright CLI fallback | Audit process | Continue Playwright fallback until plugin mismatch is fixed; do not block product fixes on Browser DOM snapshot failure. |
+
+## Current Non-Main Evidence Update
+
+- Web Guidelines supplement added: `docs/audits/2026-07-08-web-guidelines-line-findings.md` records the native-dialog backlog (20 historical high-confidence hits, 0 current high-confidence hits after focused fixes), 0 current production `transition-all` hits after the focused transition-scoping sweep, 0 current high-confidence weak/missing focus replacements in the reviewed list after focused fixes, 0 remaining image-dimension findings after the SuggestedAgentCards, AgentCenterRow, ReadyStep, BootScreen, StatusBar, LoginBriefing, ChatApp, and SpawnAgentDialog fixes, and a broad form metadata queue. Phase 1 remains unchanged; the supplement strengthens T7/T8/T10/T12 closure evidence.
+- Current T10 follow-up evidence: Settings Prompt Shape and TimelineApp event-type selects now set `autocomplete="off"`, WikiTab search has an input-level token focus ring, and WikiTab Obsidian/Notion export targets expose target-specific `name`, `autocomplete="off"`, and token focus rings. Focused coverage: `settings-trust.test.tsx`, `timeline-app.test.tsx`, and `wiki-export-trust.test.tsx`.
+- Runtime accessibility T10 analysis updated: `docs/audits/2026-07-08-runtime-a11y-t10-analysis.md` records the original built-app axe/DOM smoke plus the codified gate, `tests/e2e/runtime-a11y.spec.ts`. The gate passes 2/2 on port `34193` for desktop and mobile Home, Settings, Profile, Vault, Mission Control, Memory, workspace chat, Agents, Waggle Dance, Launcher, MCP Hub, Files, and Approvals with zero axe violations. The first implementation slices fix named-control/form-metadata/focus issues for Settings, Profile identity/preferences/brand and Analyze Style action focus, Chat composer, Vault add-secret/actions, Launcher, Approvals, Cockpit/WaggleDance/ComplianceDashboard/AgentCard sampled actions, Agent/Skill/Automation Builder controls, Automation Center template controls, AgentCard and GroupCard select/delete controls, SuggestedAgentCards media/transition stability, AgentCenterRow media stability, ReadyStep media stability, BootScreen/StatusBar media stability, LoginBriefing/Chat/SpawnAgentDialog media stability, Spawn Agent launch controls, Agent template creator/detail controls, Artifact Center search/create/detail controls, Agent Center search, Skills Hub search, Files toolbar and inline rename/create-folder controls, Mission Control source action names/focus rings, ConnectorCard setup controls, Memory Center search/detail controls, MemoryCard selection checkbox labels/metadata, Memory Trust search/correction controls, TimelineTab search/filter controls, EvolutionTab proposal review-note and New Run modal controls, Knowledge Graph toolbar/search/scope controls, Harvest import/source controls, Custom MCP form controls, MCP catalog search and scope-select metadata, ModelGate key/pull controls, inline capability connector-token entry, Telegram digest credentials, first-run onboarding profile/workspace/first-task metadata, EraseDataDialog destructive confirmation metadata/focus ring, All Workspaces search, Wiki search, WorkspaceActionsMenu rename/delete confirmations, warm AskBar metadata/focus ring, workspace TasksTab add-task metadata/focus ring, Timeline event-filter metadata/focus ring, Create Workspace visible setup/template/folder-picker metadata and focus rings, Workspace Switcher focus-trap/return evidence, Files storage/browser scroll regions, workspace tab/image semantics, shell landmarks, and Command Center dialog/mobile row fit plus search focus ring with focused tests. T10 remains open for broader unsampled form metadata outside the covered surfaces, unsampled icon-only controls, and modal focus-return evidence.
+- 2026-07-10 T10 label follow-up: opacity-diluted uppercase labels in the principal Home, Agents, Marketplace, Artifact, Launcher, Login Briefing, Persona Switcher, WaggleDance, and MCP surfaces now use guaranteed semantic contrast tokens. `npm run ux:color-guard` reports 96 offenses, all frozen baseline entries, with no new violations.
+- 2026-07-10 Pillar 2 return-path follow-up: Connectors, MCP Hub, Artifact Center, Approvals, and Launcher preserve resolved session data during route remount/revalidation; Artifact keys include workspace/search/kind/status. The combined cache lane passes 8 files / 71 tests. Non-main packaged and deployed gates remain open.
+- 2026-07-10 onboarding affordance follow-up: inactive Who Are You chips now use a visible `--line-affordance` border, `--text-tertiary`, and hover/focus affordances instead of relying on color alone; the focused onboarding lane passes 14/14.
+- 2026-07-11 model setup recovery follow-up: the shared onboarding/Settings `ModelGate` now exposes provider-catalog failures with service-aware copy and a Retry action. Focused ModelGate + onboarding coverage passes 27/27 and web typecheck passes; the desktop service/update event bridge was re-audited and is already wired with binding coverage.
+- 2026-07-11 API-key setup follow-up: fresh-port Playwright coverage passes 2/2 for onboarding and Settings provider-key entry, including provider selection, key-field focus, validation, canonical `/api/settings` payload capture, saved feedback, and onboarding Continue enablement. Live provider acceptance still requires a real credential and network.
+- 2026-07-11 provider model catalog follow-up: built-in provider model inventories were removed from the server and web registries. Configured provider APIs now supply the full returned model list, normalized as stable `provider/model` ids and merged into Chat/Spawn; outage responses retain a visibly stale last-known catalog. Claude/Gemini pagination, hot-session focus refresh, exact-id router regeneration, default/model/fleet routing, and completion are now deterministic regression gates. A paid live credential request remains external release evidence only.
+- 2026-07-11 Create Workspace disclosure follow-up: optional agent assignment is collapsed by default on the 390 x 844 primary flow, expands through a named control, preserves selected template/persona context in its summary, and resets after a cancelled attempt. Focused shell-overlay contracts pass 15/15 and the rendered `J-mobile` journey passes 1/1 on fresh port `34380`; broader modal-state and focus-return evidence remains open.
+- T5 visual classification refreshed: `docs/audits/2026-07-08-visual-t5-classification.md` retains the original port 3463 failure classification, then records the current port `34199` verification where `tests/visual/views.spec.ts` passes 14/14. Canonical ASCII-hyphen baselines are active, volatile Home text is masked in the visual spec, and duplicate baseline families are documented for later test-readiness cleanup.
+- First-run onboarding T1/T2/T12 analysis added and refreshed: `docs/audits/2026-07-08-first-run-onboarding-t1-t2-t12-analysis.md` records a clean-data built-app smoke on port 3431 without skip flags. Desktop onboarding completed through first-task auto-send into workspace chat; the original lane reproduced T1 Clerk/CSP console errors, found the 390 x 844 Profile Continue action below the viewport, found high-volume Claude Code import too prominent for day-zero setup, and noted model/auto-send handoff polish issues. Current focused verification closes T1 console health for the sampled accountless paths (3/3 on port `34196`) and mobile Profile reachability (1/1 on port `34194`).
+- Source inventory supplement added: `docs/audits/2026-07-08-source-inventory-consistency-audit.md` confirms production shell routes are represented, identifies command-query evidence for `/launcher?watch=1` and `/settings?tab=billing`, records current `apps/` and 28-package inventory, and adds T19 for the Browser Companion extension.
+- Browser Companion T19 analysis added and refreshed: `docs/audits/2026-07-08-browser-companion-t19-analysis.md` records passing extension syntax/manifest/server checks, disconnected and connected-tab popup screenshots, direct sidecar save success, content-script extraction from a normal page, legacy-trust extracted save success, Memory UI confirmation, pre-fix unallowlisted-extension CORS and `401 MISSING_TOKEN` failures, plus a 2026-07-09 fix for secure token bootstrap, concrete extension-origin CORS matching, MV3 service-worker no-Origin handling, background save auth, sticky accessible popup recovery, restricted-page recovery copy, disabled-state styling, honest memory-destination copy, secure-default loaded-extension save/frame confirmation, popup keyboard/focus/Enter save proof, direct popup Save page click evidence, rendered Memory UI confirmation after the secure default path, context-menu handler coverage, stable packaged-ID pairing proof, Memory search provenance consistency for imported captures, and existing chat `auto_recall`/catch-up imported provenance. T19 remains open for native toolbar-bubble proof or manual release evidence, native context-menu click proof or deferral, signed Web Store/installer-distributed extension proof if release packaging is scored, and separate proof for any future recall result shape if scored.
+- Desktop wrapper T14 analysis added and refreshed: `docs/audits/2026-07-08-desktop-wrapper-t14-analysis.md` records passing app TypeScript, Rust `cargo check`, sidecar resource preflight, app service E2E, app helper/static tests, web-side Tauri binding tests, release workflow hardening, and tray source hardening. T14 remains open for packaged tray/close/shortcut evidence, packaged watchdog/update presentation, installer/signing proof, root command-shape gap for `apps/web` Tauri tests, and absent packaged interaction evidence.
+
+- T11 focused analysis refreshed: `docs/audits/2026-07-08-route-evidence-t11-analysis.md` records the AppShell route registry, app-local route table tests 29/29, Benchmark/Platform/Payment component tests 17/17, all-route built-preview smoke on port 3457, and codified `J-route-coverage` tests passing 2/2 on port `34200`. T11 is now closed for route-existence ownership; remaining route-adjacent issues are tracked under T9/T10/T12/T16.
+- T6 marketplace determinism fix verified: `POST /api/marketplace/sync` now shares the marketplace-sync disable gate used by the background scheduler, so `WAGGLE_DISABLE_MARKETPLACE_SYNC=1` returns `skipped: true` without touching external sources. Focused Vitest passed 3/3 across manual-sync and background-sync contracts; `packages/server` typecheck passed; focused Playwright marketplace verification passed 4/4 on port `34203` after the T17 `tsx`/esbuild startup fix.
+- P1-17 high-volume import fix verified: first-run Claude Code detections above 1,000 items now default to `Review after setup`, format the count, and make immediate import explicit; `onboarding-import-step.test.tsx` passed 2/2 and `npm run typecheck:web` passed.
+- P1-18 first-run handoff fix verified: ready model state hides the stale setup/checking gate, and auto-sent first-task seeds clear immediately while pending; `ModelGateStep.test.tsx` passed 5/5, `lane-c-input-power.test.tsx` passed 12/12, the onboarding focused bundle passed 22/22, and `npm run typecheck:web` passed.
+- T12 focused analysis added and refreshed: `docs/audits/2026-07-08-state-failure-t12-analysis.md` records a passing focused state slice (9 files / 79 tests), existing chat SSE failure-injection source coverage, browser-native dialog line evidence, warning-noise risks, five-persona state-bundle fields, and T12-A through T12-G correction candidates. The current five-persona bundle passes 5/5 with retries disabled on port `34301`, with route, sampled failure/workflow/scale/slow-data, and overlay evidence plus Mobile Executive Notification Inbox, Command Center, and local model runtime-unavailable screenshots, Researcher Memory unavailable, Memory slow-list, Memory large-list, and Timeline/Event large-list evidence, Engineer Agents slow-list, Agents large-list, Marketplace unavailable, Marketplace large-catalog, Cockpit health-degraded, Files upload-failure, Files upload-success, and Files large-list evidence, and Team Admin billing checkout-unavailable, Team active billing state, Team settings unlocked state, billing checkout success return, billing checkout cancel return, backup creation failure, and backup restore-failure evidence. Failed uploads show branded recovery copy and do not render the failed filename as a successful row; successful uploads return `/successful-upload.md` and render the uploaded file in the Files UI; the files large-list probe renders 240 mocked files with `240 items`; the Marketplace large-catalog probe renders a 240-entry mocked catalog with grouped `Skills 120`, `Connectors 60`, and `MCPs 60`; the Memory slow-list probe delays `/api/memory` by 2 seconds, proves the aria-busy `Loading memories` status, and then renders 40 mocked memories with `40 memories` and `Bulk Memory 000`; the Memory large-list probe renders 200 mocked memories with `200 memories` and `Bulk Memory 000`; the Agents slow-list probe delays `/api/agents` by 2 seconds, proves the aria-busy `Loading agents` status, and then renders 40 mocked agents with `40 agents` and `Bulk Agent 000`; the Agents large-list probe renders 180 mocked agents with `180 agents` and `Bulk Agent 000`; the Team Admin active billing state mocks `/api/tier` to `TEAMS` and renders `Waggle Team`, `$49/mo per seat`, and `Manage subscription`; the Team settings unlocked state renders `Team Server URL`, `Auth Token`, and the team-server trust warning; the Team Admin checkout success return mocks `/api/stripe/sync` to `TEAMS` and renders the Team confirmation; the checkout cancel return redirects to Billing with `Checkout was cancelled` and `No charge was made`; the Timeline/Event large-list probe renders 360 mocked events with `360 events` and `Used bulk_tool_000`. The run reports 0 critical console/page/network failures and 0 visible overflow.
+- Mobile Executive T2/T12 analysis added and refreshed: `docs/audits/2026-07-08-mobile-executive-t2-t12-analysis.md` records the original 390 x 844 built-app smoke on port 3419 with screenshots for Home, Settings general/models/billing/profile, Memory, workspace chat, Command Center, and Workspace Switcher. The original pass kept T2 open because Settings controls visibly clipped despite clean document scroll width. Current focused verification closes P0-2: `J-mobile: Settings is usable at 390px width` passed 1/1 on port `34195`.
+- T13 focused analysis added and refreshed: `docs/audits/2026-07-08-launch-funnel-t13-analysis.md` records passing www test/typecheck/build evidence, localhost route/API smoke, rendered Browser evidence under `output/playwright/www-t13-3491/`, a current external refresh, and local checkout/legal/download/deploy-workflow fixes. T13 remains a launch P0 because the canonical `waggle-os.ai` and `www.waggle-os.ai` domains do not resolve from the audit environment, real signed installers are not published, Vercel production deploy/DNS smoke is not proved, real deployed Clerk/Stripe checkout success/cancel evidence is still missing, and legal sign-off is not proved. Locally fixed: signed-out Team CTA now uses GET auth continuation, cancelled checkout returns to `/?checkout=cancelled#pricing` with a retry notice, the intentional `html.js` hydration mismatch no longer raises the Next dev issue badge, legal Day-0/stale Pro placeholder copy is guarded, public Download uses `/download` instead of an empty release target, mobile/tablet visitors keep a generic Download label, and `deploy-www.yml` targets Vercel prebuilt deployment instead of GitHub Pages/static `apps/www/dist`.
+- Shell Overlay T10/T12 analysis added and partially updated: `docs/audits/2026-07-08-shell-overlays-t10-t12-analysis.md` records the original built-app overlay smoke on port 3437 plus the Phase 2 partial fixes. Notification Inbox and Create Workspace primary/subdialog contracts now have codified dialog/close evidence, custom-template delete no longer uses native `confirm()`, Context Rail has a labelled complementary contract, Onboarding Tooltips has an explicit non-modal dialog/Escape contract, tier modal close labels are named, and the sampled 390 x 844 Create Workspace hierarchy passes on port `34157`; the expanded user-journey suite passed 19/19 on port `34158`. The five-persona bundle now refreshes Mobile Executive Notification Inbox and Command Center overlay screenshots, and `NotificationInbox` avoids horizontal opening motion that caused transient mobile overflow. Route-specific overlay state evidence for less common overlay states remains open.
+- T7 trust-dialog update: Approvals revoke-all now uses the shared in-app `ApprovalModal`; `p7-b1-approvals-error.test.tsx` covers the no-native-confirm contract, rendered `J3d` passes on port `34159`, and the expanded user-journey suite passed 20/20 on port `34160` before the Artifact `J3e` addition.
+- T7 trust-dialog update: Artifact permanent delete now uses the shared in-app `ApprovalModal`; `artifact-center-trust.test.tsx` covers the no-native-confirm contract, rendered `J3e` passes on port `34161`, and the expanded user-journey suite passes 21/21 on port `34162`.
+- T7 trust-dialog update: Memory Center permanent delete, GDPR erase, and allow re-import now use the shared in-app `ApprovalModal`; `memory-center-trust.test.tsx` covers all three no-native-confirm contracts, rendered `J3f` passes on port `34164`, and the expanded user-journey suite passes 22/22 on port `34165`.
+- T7/T10 trust-dialog and accessibility update: Wiki Obsidian and Notion exports now use in-app form dialogs; `wiki-export-trust.test.tsx` covers both no-native-prompt contracts; rendered `J3g` passes on port `34167`; and the path remains included in the latest 24/24 user-journey suite on port `34177`.
+- T14 is narrowed, not closed: `app` TypeScript, static updater/installer/signing/runtime tests, static Tauri config/update/tray tests, sidecar resource preflight, web typecheck, Rust `cargo check`, service-level startup/chat/workspace E2E, the release package-before-sidecar guard, focused web desktop-navigation/shell-event binding tests, updater-disabled static contracts, Rust sidecar path unit tests, and Tauri webview-origin CORS tests pass. Native source directly handles tray Open/focus, close-to-tray, `Ctrl+Shift+W`, and Quit; Settings routes through a tested `/settings` desktop bridge; Pause and About are hidden. Packaged debug Tauri startup now launches, starts bundled `resources/service.js`, and reaches `/health` without CORS/module/ABI errors. MSI/installer packaging, packaged tray interactions, close-to-tray, global shortcut, forced watchdog UI, installer trust, and signed-update proof still need installed-app evidence.
+- T15 deep-dive updated: `docs/audits/2026-07-08-admin-cli-utility-t15-analysis.md` records passing admin-web, launcher package-local tests, `@waggle/cli` package-local tests, memory MCP package-local tests, hive-mind MCP package-local tests, marketplace targeted tests, hive-mind CLI package-local tests, no-emit TypeScript, package build scripts, and admin-web rendered package evidence. It also records focused marketplace, launcher, `@waggle/cli`, memory MCP, hive-mind MCP, hive-mind CLI, and admin-web fixes: marketplace NodeNext emitted imports, built help, source/built/installed invalid-command smokes pass without clean-home DB side effects; marketplace publish manifest/packed-file alignment and installed-bin help are guarded; launcher source/built help and invalid-port paths pass without service banners or `.waggle` side effects; built and installed launcher occupied-port recovery prints a concrete `npx waggle --port <next-port>` command; launcher packed tarball first-command help runs without service setup; clean installed launcher startup serves `/health`, prints manual-open copy, and creates the configured data dir; `@waggle/cli` built, bin-wrapper, packed-bin, local package-closure installed `npx` help, local package-closure installed REPL startup/slash-command/exit, and local package-closure installed streamed chat/provider plumbing against a mock LiteLLM-compatible endpoint pass, with `@waggle/agent`/`@waggle/weaver` package metadata corrected to built `dist` entries and `@waggle/agent` runtime dependency declarations fixed; legacy memory MCP and hive-mind MCP built write-scope roundtrips save and recall unique memories; legacy memory MCP and hive-mind MCP local package-closure installed read-only startup lists tools; hive-mind CLI source/built/local package-closure installed sampled subcommand help prints focused help without creating `personal.mind`; the installed hive-mind CLI proof found and fixed the missing `@waggle/shared` dependency in `@waggle/hive-mind-core`; the installed memory MCP proof found and fixed the missing `glob` dependency in `@waggle/core`; admin-web package-local tests pass without React `act(...)` warnings; and built-preview Playwright evidence proves all seven admin pages at desktop and mobile widths, hash deep links, browser back/forward traversal, `aria-current`, labelled table scroll regions, labelled rendered controls, clean app console/pageerror collection, mobile shell keyboard reachability, page-level keyboard traversal from connection fields into the covered admin pages, desktop/mobile visual snapshots, capability governance forms, malformed analytics response recovery without blanking the shell, all-page initial API-failure recovery with accessible alerts, mutation/destructive-failure recovery for capability policy save, capability override create/remove, capability request decision, member invite, member role change, member removal, and team settings save, plus local bearer-auth wrong-token/valid-token behavior through protected Fastify routes. T15 remains open because registry-only proof after internal package publication remains open. The Members native-confirm blocker is fixed in focused component coverage.
+- T16 deep-dive updated: `docs/audits/2026-07-08-ai-tool-hook-t16-analysis.md` records passing shared/agent/server route tests, Launcher/prompt/adapter tests, root-run hook package tests, hook/shim package-local scripts, official package typechecks, Claude Desktop stub build, compiled hook-bin help smokes, packed-package `npx` install/verify/uninstall lifecycle for all six hook-capable packages, focused no-reconnect observed-output regression coverage, hook stdout/stderr/Backup-Recovery/Check-failed/uninstall-cleanup/More-output/structured-failure/empty-output recovery/Claude Desktop launch-only coverage, focused registry-aware third-party adapter launch coverage, partial rendered Launcher Browser evidence under `output/playwright/launcher-t16-54147/`, a fresh real Browser `/launcher` smoke where Verify now renders `verify failed (exit 1)` with retry/uninstall/reinstall guidance instead of `HTTP 400`, Browser-rendered mocked Claude Desktop, Codex Verify manual-approval, and Codex Uninstall cleanup states, codified Playwright rendered standard install changed-file/pointer/backup/recovery labels, sidecar-offline Retry, long-stderr summarization, all six hook-capable install/verify/uninstall transitions, and non-built-in adapter launch-only/prompt behavior, gated real-tool Playwright evidence where OpenClaw renders as a real detected CLI and launches through the sidecar with observed output, exit 0, and process cleanup, gated route-level evidence where all six hook-capable tools install/verify/uninstall through `/api/tools/hooks` against an isolated profile and clean up, Codex WindowsApps recovery evidence where the restricted app alias is installed-but-not-launchable with no Launch button, Tailwind motion-token warning cleanup evidence, and `shape-selection.ts` dynamic/static import warning cleanup evidence. It keeps T16 open for packaged desktop hook-status evidence and remaining noisy test output.
+- T17 deep-dive updated: `docs/audits/2026-07-08-developer-substrate-t17-analysis.md` records 13/13 direct no-emit typechecks, passing agent/core/optimizer/weaver package tests, passing root-run substrate/SDK/shared/WaggleDance/worker/compiler tests, a dedicated server performance lane passing 13/13, a named server release lane passing 185 files / 2128 tests with one worker, hermetic marketplace-sync tests, and package-local test commands now passing for hive-mind-core (59/745), wiki-compiler (2/25), sdk (5/89), worker (4/46), WaggleDance (3/42), shared (5/40), and hive-mind-wiki-compiler (3/26). It keeps T17 open for warning hygiene and incomplete developer recovery-journey evidence.
+- T18 deep-dive added and partially refreshed: `docs/audits/2026-07-08-ops-deploy-ci-judging-t18-analysis.md` records passing YAML parse, safe Compose scans, ignored env-file tracking checks, benchmark harness TypeScript and package-local tests (29/325), production Compose fail-closed credential guards, explicit Render sidecar-mode guards, root-run benchmark tests, and a focused public-site workflow fix from GitHub Pages/static artifact upload to Vercel prebuilt deployment. It keeps T18 open for missing deployed Vercel/DNS smoke, non-blocking CI E2E, no CI infra lane, unavailable local Docker engine, LiteLLM live-routing gap, and stale historical judging artifacts.
+
+## Phase Approval Boundaries
+
+Phase 1 approval includes only:
+
+- T1 local auth, Clerk, and CSP console health.
+- T2 follow-through for mobile Settings and first-run onboarding is now verified fixed in focused 390px journeys; keep broader mobile polish evidence for Memory/chat tabs and selected overlays.
+- T3 Solo/Teams/Enterprise copy cleanup.
+- T4 `Ctrl+Shift+N` and Workspace Switcher route contract are verified fixed in focused runs; keep them in regression.
+- T5 visual snapshot lane is verified fixed for the seven tracked desktop views; keep broader visual scope in the route/scenario manifest and T12 evidence.
+- T11 route evidence for thin judge paths is verified fixed; keep deeper state/action coverage in T12 and launcher/runtime proof in T16.
+
+T12 state/failure bundle evidence is not part of Phase 1 implementation unless Phase 1 verification directly needs it. It becomes a Phase 2 judge-readiness gate.
+
+T13 launch-funnel evidence, T14 desktop-wrapper evidence, T15 utility evidence, T16 hook lifecycle evidence, T17 developer API/background/substrate verification evidence, T18 ops/deployment/CI/benchmark/judging evidence, and T19 Browser Companion evidence are not part of Phase 1 implementation unless Phase 1 verification directly needs a minimal supporting fix. They become final-product gates after the in-app P0 blockers are cleared.
+
+Phase 1 approval does not include broad redesign, new surfaces, native dialog replacement across the whole app, performance chunk splitting, launch-site deployment/checkout/legal work, desktop wrapper/install/update work, admin/CLI/MCP utility work, AI-tool hook lifecycle work, developer API/background/substrate tooling work, ops/deployment/CI/benchmark/judging work, Browser Companion extension work, or local model pricing semantics unless a Phase 1 verification command directly requires a minimal supporting fix.
+
+Post-Phase-1 sequencing lives in `docs/audits/2026-07-08-ux-post-phase-1-roadmap.md`.
+
+## Judge Blocking Rules
+
+- Any open P0, including launch-scoped P0s unless explicitly deferred from the final score, blocks the final five-persona 9/10 claim.
+- Any open P1 that touches a persona's primary journey must be fixed or explicitly deferred before scoring that persona.
+- Any missing T12 state bundle blocks the scorecard for the persona whose primary journey depends on that state.
+- Missing T13/T14/T15/T16/T17/T18/T19 evidence blocks a full "complete UX" claim unless the user explicitly scopes those gates out of the five-persona score.
+- P2 items do not block scoring by themselves, but must not contradict the implementation or reintroduce wrong copy in touched files.
+- A green test is not enough unless it covers the route, viewport, and user state named in the finding.
+
+## Current Recommendation
+
+Phase 1 is implemented and verified. Continue Phase 2 in focused slices; the overlay-contract slices now include Create Workspace mobile hierarchy/subdialogs, while screenshot refresh plus the broader trust/accessibility/native-dialog backlog stay open.
+
+Decision brief: `docs/audits/2026-07-08-ux-approval-brief.md`.