waggle-os/docs/ux-refactor/p1b-plan-review-record.md

P1b Plan — Adversarial Review Record (2026-06-11)

Two workflow rounds over p1b-auth-gate-plan.md v1 (6 lenses; round 1's contract lane completed, 5 lanes re-ran in round 2 after a session-limit failure). 24 confirmed / 0 refuted / 16 LOW. Every confirmed finding was independently verified by a skeptic agent against the live tree before acceptance. All are folded into plan v2; this file records them so they are not re-found, plus the LOW-grade confirmations of plan claims.

Confirmed (folded into plan v2)

#	Sev	Lens	Finding → v2 disposition
1	CRITICAL	contract	installMcp is a typed JSON getter whose error body carries the ApprovalModal security envelope ({requiresApproval, blocked, severity} on 403/422); throw would kill the flow and the phase4b tests (method-level mocks) are blind → body-envelope migration class + adapter-level pins as hard Stage-A exit criterion
2	CRITICAL	sse-ws-auth	All five EventSource SSE channels 401-dead in EVERY default run since D1 (bearer-gated /api GETs; EventSource can't send headers; no ?token= on those routes; only /ws has the pattern and connectWebSocket is dead code) → plan §1.4, founder ruling requested, P1b scope unchanged
3	HIGH	deadlock	Gate-never-released hang: fetchWithTimeout bounds headers only; connect's res.json() reads unbounded → connect watchdog (~15s end-to-end deadline)
4	HIGH	deadlock	Gate disarms after failed early connect (default Tauri cold-sidecar path) re-opening the ungated burst with no recovery (NetworkError never triggers the 401 leg; focus never fires on an already-focused window) → settled-failure re-arm + ServiceProvider backoff + waggle:connect-settled bus consumed by all Stage-B surfaces
5	HIGH	deadlock	SSE half of the boot race unfixed and v1's "if and only if they attach the token" conditional matched zero methods (noop-guards = session-long dead subscriptions) → §1.4 honest de-scope; subscribe* untouched; acceptance check 1 scoped to fetch layer
6	HIGH	test-blast	adapter.eraseData.test.ts/adapter.startTrial.test.ts pin method-level Erase failed (400): <detail> messages with message-first detail; v1's error-first precedence inverted it → message-first pin + legacy-prefix wrappers in both methods
7	HIGH	sse-ws-auth	Chat sendMessage silent-empty-bubble on stale/missing token; plan's (b)+(c) verified the correct fix; useChat catch defects confirmed → no design change; Stage B useChat rework retained
8	HIGH	tier-ui	Definitive gate-vs-nag table (nav = pure capability gate, do NOT wire tierResolved; TrialExpiredModal + StatusBar badges already safe; UpgradeModal event-driven safe) → §1.2(d) classification
9	HIGH	tier-ui	useBilling failure renders FREE-as-fact + upgrade CTAs in Settings→Billing with zero error indication; post-Stage-A every failure funnels there → mandatory reshape
10	HIGH	tier-ui	SECOND tier-as-fact surface missed by v1: SettingsApp General-tab '{tier} plan' badge fed by getSettings (:54/157/239-241) → single-source from resolved billing state
11	HIGH	d3-fidelity	LoginBriefing got no revalidation wiring while v1's own UI copy promised "retrying" (plus-clause violation on a ruling-named surface) → wired to useRevalidateOnError, acceptance asserts recovery
12	MEDIUM	deadlock	setServerUrl mid-flight: stale connect continuations clobber baseUrl/localStorage/token (fallback can persist DEFAULT_SERVER over the user's new URL) → epoch guard
13	MEDIUM	deadlock	Straggler 401s chain sequential refreshes past single-flight; refresh failure semantics unpinned (silent token-less retry) → token-versioned retry + throwing refreshSessionToken
14	MEDIUM	deadlock	healthProbe not single-flighted; races useOfflineStatus's exempt /health probes on shared this.baseUrl mutation → single-flight + local-var fallback + epoch commit
15	MEDIUM	deadlock	uploadFile/ingestFile bypass the chokepoint entirely (raw fetchWithTimeout, hand-attached token, unconditional res.json()) → routed through the shared core
16	MEDIUM	test-blast	"~30 adapter test files" wrong by ~4× (actual 7; 2 not behavior-identical) → corrected, eraseData/startTrial carved out
17	MEDIUM	test-blast	Stage C's expected-fallout class is empty (no silent-empty-on-!ok pins exist); real risk was a mechanical rewrite erasing the startTrial message-surfacing guard → Stage C expectation rewritten
18	MEDIUM	test-blast	Call-count tripwire: kickoff must stay OUT of adapter module scope/constructor (5 files index mock.calls[0]) → zero-network-at-import/construction pin
19	MEDIUM→LOW	test-blast	9 component test files render real ServiceProvider over hand-rolled mocks → ServiceProvider existing-members-only constraint
20	MEDIUM	sse-ws-auth	SSE has zero restart/error recovery even where it could work (es.close() in onerror; once-only subscribes) → part of the §1.4 "SSE auth + reconnect" single follow-up
21	MEDIUM	tier-ui	refreshTier failure path also clobbers trialInfo (StatusBar trial countdown transiently wiped); tierResolved semantics for unrecognized-tier unpinned → both pinned in (d)
22	MEDIUM→LOW	tier-ui	Nav getDockForTier confirmed pure capability gate → do-not-touch advisory + comment
23	MEDIUM	d3-fidelity	P7 deferral defense factually wrong for its own exemplar (MCPHubApp already connect-gated; gate adds nothing) and plus-clause narrowing was self-granted → two cheap wirings in §1.2(h) + decision-log note §3
24	HIGH	contract (r1)	(v1 round) installMcp misattribution — superseded by #1's fuller statement; plus addCustomMcp/updateMcpPermissions/revokeMcp/startMcp/stopMcp/testMcp body-envelope class, useChat consumer correction, AdapterHttpError.message pin, BackupApp-only among direct sites, uninstall false-success fix

LOW (verified clean / advisory — no plan change beyond what v2 already carries)

• ensureReady 3-state ambiguity + sync memo assignment + settled-success memo retention → pinned in v2 §1.1(a).
• "Pass-through stays armed by accident of the import graph" → boot-connect.ts first-import + zero-network pin close it structurally.
• Setup files clean; no test imports main.tsx/App.tsx; Stage B existing-suite fallout ≈ zero (all coverage net-new).
• No adapter-level raw/envelope pins exist anywhere (confirms blindness diagnosis) → hard exit criterion.
• subscribeHarvestProgress degrades silently under 401 (import works, no progress UI) — noted in §1.4.
• connectWebSocket dead code, builds ?token=null pre-token → P7 ledger.
• Trial-expired modal verified already-safe; UpgradeModal verified safe; KvarkNudge doesn't exist (resolves to SettingsApp Enterprise CTAs — covered by the Billing-tab fix).
• useFeatureGate / settings-tier-filter / persona-tier / dock-nudge / onboarding-tier-filter all local-state driven — excluded; stale comment + orphaned file → P7.
• ComplianceDashboard.tsx:274 verified as THE live-confirmed CockpitApp crash; its refreshTemplates valid-empty cache added to §1.2(h).
• Ruling coverage sweep: all four D3 sub-items + five live-confirmed targets covered; six named getters stay on throwing path; deviation-class note → §3.
• Scope-creep audit: nothing cut-worthy; useBilling tagged as D3-4 extension.