Complete canonical frontend deep-link and operator parity

[alexeygrigorev]

Complete canonical deep-link and operator parity

Status: pending — groomed and ready for implementation
Tags: bug, portal, frontend, testing, design, P0
Parent: #148
Depends on: None
Blocks: final deployed acceptance in #155 and closure of #148
Next owner: Software Engineer

Scope

Correct the post-cutover canonical UI in top-level frontend/ at current main 36d446c. Complete the existing hash-route adapter, entity loading/history behavior, mobile Inbox triage, and the small missing operator controls below. Use the existing authenticated work APIs and shared browser-cookie login/logout flow; this is not a new router, shell, data model, or information-architecture project.

Deployment blockers #136/#143 do not block local implementation, review, merge, or source CI. After this source fix is integrated, #155 owns normal deployed verification at the corrected SHA.

Supported route matrix

These are the only supported workspace hash paths. Entity parameters are optional; without one, the route opens its list/surface.

Route	Required behavior
#/	Home
#/inbox?intakeId=<id>	Inbox; exact intake detail
#/tasks?taskId=<id>&date=<YYYY-MM-DD>&bundleId=<id>&contextBundleId=<id>	Task queue; date sets the date, bundleId filters the queue, taskId opens the exact task, and contextBundleId shows the independent return/workflow context; preserve valid combinations
#/bundles?bundleId=<id>&taskId=<id>	Exact workflow; optional exact task within that workflow
#/assistants?assistantJobId=<id>	Assistant list; exact job detail
#/templates?templateId=<id>	Runtime-template list; exact template detail/editor
#/recurring	Templates surface focused on recurring operations
#/artifacts	Artifacts surface
#/notifications	Home with Notifications panel open
#/bookkeeping	Bookkeeping
#/sponsors?bookingId=<id>	Sponsors; exact booking detail
#/newsletter	Newsletter
#/calendar	Calendar
#/mailing-exports	Mailing exports
#/processes	Process Docs
#/admin	Admin
#/users	Users

Use URLSearchParams/encoded values and safe text rendering. A single trailing slash may normalize to the table form. Unsupported query keys are discarded. Empty hash, unknown paths, malformed path/query encoding, invalid dates, and structurally invalid parameter combinations normalize with replaceState to /#/ without adding a history entry, losing the authenticated session, or rendering route input as HTML.

Acceptance Criteria

Routes, entities, and browser history

• Fresh navigation, refresh, hashchange, Back, and Forward resolve every row and valid parameter combination in the matrix inside the one canonical shell; UI state and URL never diverge or create navigation loops.
• Operator-initiated list selection, close/back, notification launch, search result, and task/workflow/intake/assistant/template/sponsor relationship navigation write the canonical URL with pushState; normalization alone uses replaceState.
• Entity context is applied only after its required data resolves. A requested intake outside the active filter still opens that exact item.
• A stale or 404 intakeId, taskId, bundleId, assistantJobId, templateId, or bookingId shows an entity-specific, focusable not-found state with the requested ID as text plus Retry and Return-to-list actions. It never selects the first row, opens another record, leaves a generic loading panel, or reports a non-404 API failure as “not found.”
• Combined task/workflow links preserve date, queue bundleId, and independent contextBundleId; #/bundles?...&taskId=... reports a task/workflow mismatch instead of silently substituting context.
• Signed-out page navigation and visible Sign out use the shared browser-cookie /login and /logout flow. /api/* and /work/api/* continue to return JSON 401, never SPA HTML or a browser bearer-token path.

Mobile Inbox and readable history

• Inbox has one visible page heading. At 390x844 it shows item status/context and one state-appropriate primary action before secondary controls; choosing an action reveals only its required fields, while secondary and destructive actions live in labelled keyboard-operable disclosures.
• State behavior is explicit: new/triaged items prioritize Convert or Attach; blocked items prioritize due Follow-up sent or Response received; attached/converted/assistant-ready items prioritize their linked task/workflow/assistant continuation; duplicate/ignored/archived items are a read-only resolution summary. Invalid backend transitions are not presented as available actions.
• Mutation controls prevent double submission, keep inline validation/API/conflict errors with the selected item, move focus to the error/status, and retain entered values for retry.
• History uses operator language instead of raw action codes, renders parseable absolute Europe/Berlin date/time in a <time datetime> (relative copy may supplement it), and includes useful actor/reason/waiting/follow-up/relationship context without dumping raw metadata. Order is labelled and deterministic.
• At 1440x900 and 390x844, Inbox queue/detail, disclosures, history, route not-found states, panels/dialogs, and close/back controls have no horizontal overflow, overlap, clipping, or unreachable keyboard action.

Small operator parity controls

• Sign out is visible and keyboard accessible in desktop and mobile Settings, identifies the current action clearly, and invokes /logout without exposing session material.
• Each notification has a labelled Dismiss action using the existing authenticated API. Success removes only that item and updates both bell counts; failure remains visible/retryable; activating Dismiss never also opens the linked task.
• Recurring rows clearly distinguish Pause/Resume from Delete. Delete requires a labelled confirmation explaining that it removes only the schedule, not generated tasks; a successful unreferenced delete refreshes the list, while the existing 409 generated-history response tells the operator to Pause instead and preserves the row.
• Changed states have correct heading order, names/roles, aria-current/expanded/live semantics, modal focus trap/restore, visible focus, and keyboard operation, with zero critical/serious WCAG A/AA violations in the automated affected-state scan.

Test Scenarios

Scenario: Complete route and history matrix

Given: deterministic real-API fixtures for every entity parameter
When: each route/combination is opened fresh and the operator follows relationships, closes detail, and uses Back/Forward/hash changes
Then: the exact entity, visible context, URL, focus, and history entry are synchronized

Scenario: Invalid route and stale entities

Given: unknown/malformed routes plus stale, filtered-out, mismatched, and non-404-failing entity requests
When: routing/data loading finishes
Then: malformed routes replace-normalize to Home, the filtered-out item opens exactly, and stale/mismatch/failure states stay honest and recoverable without fallback selection

Scenario: State-based mobile Inbox

Given: new, triaged, blocked-due, blocked-future, attached, converted, assistant-ready, and resolved fixtures at 390x844
When: the operator performs each available next action by keyboard and touch-sized controls
Then: only valid state-based actions/fields are exposed, mutations use the real API once, and humanized history/state remain readable without overflow

Scenario: Operator controls

Given: an authenticated session, task-linked notifications, and referenced/unreferenced recurring configs
When: the operator signs out, dismisses a notification, and attempts both recurring deletions
Then: shared logout is used, dismissal/counts are correct, unreferenced deletion succeeds, and referenced deletion explains Pause without data loss

Required Verification

Use the normal test server/in-memory DynamoDB path; request interception, mocked route payloads, source-string markers, and screenshots without behavior assertions do not count.

• Focused route-normalization/entity/history tests plus Playwright assertions for every matrix row and valid combination.
• Real API/browser coverage for stale 404 versus other failures, filtered Inbox selection, notification dismissal, recurring DELETE 204/409, and shared logout/auth JSON semantics.
• Automated accessibility scan plus keyboard/focus assertions for route not-found, Inbox disclosures/actions/history, Settings, Notifications, and recurring confirmation/error.
• npm --prefix backend test
• npm --prefix backend run typecheck
• npm --prefix backend run build
• npm --prefix backend run test:e2e
• uv run --project lambda-functions --extra search --with pytest python -m pytest tests/docs_app

Tester captures and reads these exact sanitized viewport screenshots under .tmp/screenshots/issue-156/:

• desktop-task-combined-context-1440x900.png
• desktop-entity-not-found-1440x900.png
• desktop-inbox-blocked-actions-history-1440x900.png
• desktop-settings-sign-out-1440x900.png
• desktop-notification-dismiss-1440x900.png
• desktop-recurring-delete-guidance-1440x900.png
• mobile-task-combined-context-390x844.png
• mobile-entity-not-found-390x844.png
• mobile-inbox-new-primary-390x844.png
• mobile-inbox-blocked-follow-up-history-390x844.png
• mobile-settings-sign-out-390x844.png
• mobile-notification-dismiss-390x844.png
• mobile-recurring-delete-guidance-390x844.png

Architect reviews route/auth/history boundaries; Designer reviews both viewport sets and progressive disclosure; then Tester and PM gates run.

Lifecycle Gates

• Software Engineer implementation, uncommitted
• Architecture PASS
• Designer PASS with screenshot findings
• Tester PASS with commands, exit codes, counts, accessibility results, and screenshots
• PM ACCEPTED
• Software Engineer commit with Closes #156
• Orchestrator local merge and push
• On-Call source CI/CD PASS
• Verify the canonical frontend through normal DataOps deployment #155 normal deployed acceptance rerun at the integrated SHA

Out of Scope

• Restoring the retired backend SPA/assets/router or reopening Preserve canonical frontend routes and deep links #150/Port Inbox and intake lifecycle to the canonical frontend #151.
• A new framework, third frontend, broad navigation/IA redesign, or general visual redesign.
• New API/data-model behavior beyond consuming the existing auth, entity, notification, and recurring contracts; any discovered contract defect requires a PM amendment.
• Manual deploy, workflow dispatch, AWS action, or bypass of Migrate Sponsor CRM GSIs in a protected stage-only workflow #136/Reconcile Sponsor CRM table ownership with CloudFormation #143; those and deployed evidence remain Verify the canonical frontend through normal DataOps deployment #155/On-Call work.
• Edits to ../dtc-operations, ../datatasks, ../podcast-assistant, or operational/private knowledge.

[alexeygrigorev]

PM GROOMING PASS

#156 is self-contained and ready for implementation on current main 36d446c. The exact supported route/parameter matrix, replace-versus-push history rules, honest stale/mismatch/failure states, state-based mobile Inbox actions and humanized history, sign-out/notification/recurring parity, real API/browser/accessibility coverage, and exact desktop/mobile evidence are now explicit.

No implementation, repository edit, deploy, workflow dispatch, or AWS action was performed.

Dependencies: none for source work. #136/#143 continue to gate normal deployment only; #156 blocks final #155 acceptance and #148 closure.
Next owner: Software Engineer, followed by Architect and Designer review, Tester, and PM acceptance.

[alexeygrigorev]

Software Engineer implementation complete — READY FOR ARCHITECT, DESIGNER, AND TESTER REVIEW.

Implemented in the dedicated uncommitted issue worktree at main 36d446c:

• strict canonical handling for all 17 supported hash routes, safe replace-normalization, push history, exact entity loading, honest 404/error/mismatch states, and combined task/workflow/return context
• progressive state-valid Inbox actions, exact continuation controls, retained inline mutation errors, humanized deterministic Europe/Berlin <time> history, and mobile accessibility/overflow behavior
• shared /logout, notification-only dismissal with count refresh, recurring Pause/Resume plus confirmed DELETE 204/409 handling, focus/inert behavior, and contrast/semantic fixes
• real-API Playwright coverage for the full matrix, stale entities, Back/Forward, filtered intake, Inbox state variants, notification dismissal, recurring 204/409, logout navigation, affected-state axe scans, and exact screenshot generation

Verification:

• npm --prefix backend test — PASS: 1,221 passed, 1 skipped, 0 failed
• npm --prefix backend run typecheck — PASS
• npm --prefix backend run build — PASS; canonical frontend artifact verified
• npm --prefix backend run test:e2e — PASS: 185/185
• focused issue-156 evidence test on an isolated test server — PASS; zero critical/serious issues in targeted task/not-found/Inbox/Settings/Notifications/recurring axe scans
• node --check frontend/src/app.js and git diff --check — PASS
• required legacy uv run --project lambda-functions --extra search --with pytest python -m pytest tests/docs_app — NOT RUN because current main contains neither lambda-functions/ nor tests/docs_app/; command exits 2 before collection. Current replacement planning-doc suite uv run --with pytest python -m pytest tests/planning_docs passes 7/7.

Screenshot evidence was regenerated from a fresh isolated real-API server and visually read: all 13 exact issue filenames exist under .tmp/screenshots/issue-156/; desktop files are exactly 1440x900 and mobile files exactly 390x844. Fixtures are synthetic/sanitized.

Changed files:

• frontend/index.html
• frontend/src/app.js
• frontend/src/styles.css
• backend/e2e/canonical-frontend.spec.js
• backend/e2e/canonical-route-parity.spec.js
• backend/package.json
• package-lock.json

Exact tracked + untracked patch fingerprint: f5fb4e4c66f44195d9daeb3f773b81737f8501ac945dbd7f4bd53f38c6b6a2b8. No commit, push, PR, deploy, dispatch, or AWS action was performed.

[alexeygrigorev]

ARCHITECTURE PASS

Reviewer identity: Architect role agent, posting through GitHub account alexeygrigorev.

I re-reviewed the exact final uncommitted candidate in .tmp/worktrees/issue-156 against base/HEAD 36d446cb98b5f6b9f758b6fbe8e6723943ed965d. The required tracked-plus-untracked binary-patch fingerprint independently recomputed as:

eef748e04f3ae82d3820e42c27a06cbdf16cdbbe487ae5518dbffcdd943a8440

All prior architecture blockers are closed:

• frontend/src/app.js now has one canonical parse/commit/hydrate path. Normalization alone uses replaceState; operator transitions use pushState; coalesced popstate/hashchange application cannot loop or leave the surface behind the URL.
• Every async route hydration owns the current activeWorkspaceRouteToken. Task, workflow, intake, template, assistant, sponsor, notification, and delayed entity results either prove current ownership (or a still-connected current detail container) before rendering. The task route keeps date, filter-workflow, and return-workflow loads independent via Promise.allSettled, with source-specific 404 versus non-404 states.
• Task/workflow dialogs have stable initial focus on their Close control. The single entity-dialog key handler traps Tab and Shift+Tab in the topmost visible layer and lets one Escape close only that layer. When a task is above a workflow, the workflow root is both inert and aria-hidden; closing/resetting the task removes both before the workflow receives focus again.
• Close is a canonical route transition, not an imperative stale-node restore. After hydration/re-render, route-token-guarded restoration targets the recreated task/workflow row when it remains visible, otherwise the deterministic Tasks - Work Queue or Tasks - Workflows heading. Back, Forward, direct hash changes, stale entities, mismatch, and route failure paths preserve this ownership model.
• Exact entity failures remain honest: 404 produces focusable entity-specific not-found UI, non-404 stays unavailable/error, and task/workflow mismatch never substitutes another record.
• The shared browser-cookie boundary is preserved. The visible Sign out action navigates to /logout; no bearer-token frontend path, second router, API proxy, data-store change, infrastructure change, or operational-knowledge boundary change was introduced.

The retained backend/scripts/test-server.ts __e2e__/route-faults seam is acceptable evidence for read-only outages. It exists only in the local test-server executable, applies deterministic delay or real HTTP error status at the server boundary, lets delayed reads fall through to the real handler/in-memory DynamoDB, returns no mocked entity payload, and is absent from the deployed handler/frontend artifact.

Independent verification on this fingerprint:

• npm --prefix backend run test:e2e -- canonical-route-parity.spec.js — PASS, 7/7 in 20.4s. This exercised all 17 routes, valid combined task context, malformed normalization, Back/Forward, filtered-out intake, stale/404/non-404/mismatch states, source-independent failures, relationship navigation, task-over-workflow focus containment/restoration, delayed stale response rejection, mobile overflow, and affected-state axe scans.
• git diff --check — PASS.
• node --check frontend/src/app.js — PASS.
• All 13 required sanitized screenshots were regenerated by the focused run at the exact required 1440x900 and 390x844 dimensions.
• Fingerprint rechecked after verification and remained exactly eef748e04f3ae82d3820e42c27a06cbdf16cdbbe487ae5518dbffcdd943a8440.

No architecture blocker remains. Designer, Tester, and PM acceptance remain separate required gates. No file edit, commit, push, PR, deploy, workflow dispatch, or AWS action was performed by this review.

[alexeygrigorev]

DESIGN PASS

Reviewer identity: Designer role agent, posting through GitHub account alexeygrigorev.

I reviewed the exact frozen, uncommitted candidate in .tmp/worktrees/issue-156 against base/HEAD 36d446cb98b5f6b9f758b6fbe8e6723943ed965d. The tracked-plus-sorted-untracked binary patch fingerprint independently recomputed before review, after browser verification, and immediately before this comment as:

eef748e04f3ae82d3820e42c27a06cbdf16cdbbe487ae5518dbffcdd943a8440

Architecture gate reviewed: #156 (comment)

Design review

• Reviewed all supported canonical workspace routes and entity combinations in the issue at desktop 1440x900 and mobile 390x844, including fresh/deep-link hydration, normalization, Back/Forward, close/return transitions, relationship launches, loading, entity-specific not-found, non-404 unavailable, and task/workflow mismatch states. The shell, URL, selected surface, honest state, and focus remain synchronized; no fallback entity, route-input HTML, navigation loop, clipping, or misleading substitution appeared.
• Task combined context clearly distinguishes queue date, filter workflow, and independent return workflow. Task and workflow dialogs initially focus their Close control and show a visible keyboard focus ring. Tab/Shift+Tab remain in the topmost dialog. With a task layered over a workflow, the workflow is inert and aria-hidden; one Escape closes only the task, re-enables the workflow, and restores focus to the recreated workflow task row. A second Escape closes the workflow and restores its recreated card (or the deterministic Tasks heading when the row/card is absent).
• Inbox presents one visible page heading and state-appropriate progressive disclosure. New/triaged, blocked-due, blocked-future, attached, converted, assistant-ready, and resolved fixtures expose only valid next actions. Primary actions precede secondary/destructive disclosures; selected-item validation/error state retains entered values and moves focus to inline status/error. Humanized newest-first history uses parseable <time datetime> values formatted for Europe/Berlin and includes actor/reason/waiting/follow-up/relationship context without raw metadata dumping.
• Settings exposes a clear desktop/mobile Sign out action and uses /logout. Notifications provide separately labelled Open task and Dismiss controls; dismissal removes only the selected item and refreshes both indicators, while failure remains retryable. Recurring rows distinguish Pause/Resume from Delete schedule; confirmation explains schedule-only deletion, successful 204 deletion refreshes the row, and 409 guidance preserves the row and directs the operator to Pause.
• The desktop and mobile layouts retain readable hierarchy, touch-sized mobile controls, visible close/back actions, safe wrapping, and no horizontal overflow, overlap, clipping, or unreachable keyboard controls in the reviewed states. Affected-state axe scans reported zero critical/serious WCAG A/AA violations.

Browser evidence

• npm --prefix backend run test:e2e -- canonical-route-parity.spec.js — PASS, 7/7 in 20.3s on the worktree-local real-API/in-memory-DynamoDB test server. This covered all 17 route rows, valid combined task context, malformed normalization, Back/Forward, filtered-out intake, stale/404/non-404/mismatch states, relationship navigation, notification dismissal, recurring 204/409, sign-out, state-based Inbox variants/history, mobile overflow, focus assertions, and affected-state axe scans.
• Additional read-only nested-dialog probe used an isolated server on port 31456: PASS for initial Close focus, computed visible focus ring, top-layer Tab containment, workflow inert/aria-hidden, single-Escape task close, and deterministic task/workflow focus restoration. The server was stopped afterward.

Screenshot evidence inspected

Desktop 1440x900:

• .tmp/screenshots/issue-156/desktop-task-combined-context-1440x900.png
• .tmp/screenshots/issue-156/desktop-entity-not-found-1440x900.png
• .tmp/screenshots/issue-156/desktop-inbox-blocked-actions-history-1440x900.png
• .tmp/screenshots/issue-156/desktop-settings-sign-out-1440x900.png
• .tmp/screenshots/issue-156/desktop-notification-dismiss-1440x900.png
• .tmp/screenshots/issue-156/desktop-recurring-delete-guidance-1440x900.png

Mobile 390x844:

• .tmp/screenshots/issue-156/mobile-task-combined-context-390x844.png
• .tmp/screenshots/issue-156/mobile-entity-not-found-390x844.png
• .tmp/screenshots/issue-156/mobile-inbox-new-primary-390x844.png
• .tmp/screenshots/issue-156/mobile-inbox-blocked-follow-up-history-390x844.png
• .tmp/screenshots/issue-156/mobile-settings-sign-out-390x844.png
• .tmp/screenshots/issue-156/mobile-notification-dismiss-390x844.png
• .tmp/screenshots/issue-156/mobile-recurring-delete-guidance-390x844.png

Blocking findings: none.
Non-blocking findings: none.

Designer PASS does not replace Tester or PM acceptance. No source edit, commit, push, PR, deploy, workflow dispatch, or AWS action was performed by this review.

[alexeygrigorev]

SOFTWARE ENGINEER HANDOFF — post-#157 reconciliation candidate

Role identity: Software Engineer role agent, posting through GitHub account alexeygrigorev.

I reconciled the previously accepted #156 candidate onto the exact post-#157 main without modifying the old candidate worktree.

Candidate binding

• Worktree: .tmp/worktrees/issue-156-v2
• Branch: worktree-agent-156-v2
• Base/HEAD: 56a1e2abd3f803172ea78bc9cd511bacc3733c31
• origin/main: 56a1e2abd3f803172ea78bc9cd511bacc3733c31
• Candidate: exactly 8 status/path/blob records
• Tracked-plus-sorted-untracked binary-patch fingerprint: 1696ce2f246966613b0171b11e9a4658b304c71c4bcb1b731951acfdd45cc81c
• Status/path/blob-record fingerprint: e5e1c18059778e20f4cfe998f75279cde6bd24446062bf6df39d1c407df1075f

Candidate records:

 M  backend/e2e/canonical-frontend.spec.js  02856bc5d1ec3999d20ad2a62320d65c69ad4054
 M  backend/package.json                    989c6fa4d55b8ac878a11ba1fefb691ab540bf57
 M  backend/scripts/test-server.ts          3d46332cb81041aa4320e1da92d1bd0bd6936175
 M  frontend/index.html                     e1d40697bc4bcc2f73a18aae389d416372b45082
 M  frontend/src/app.js                     68c18f1daeee0836e5745880f72e4cb81ba3dc6a
 M  frontend/src/styles.css                 823cccb3a3bc54d778a6771d29333676e2833a7d
 M  package-lock.json                       a79984c40702e2780bd2609d16e6ac7856499c9b
??  backend/e2e/canonical-route-parity.spec.js 68ae08da651b86540bec9f38fff8f1f2608a8cd9

The original .tmp/worktrees/issue-156 remains at the previously accepted 8-path binary-patch fingerprint eef748e04f3ae82d3820e42c27a06cbdf16cdbbe487ae5518dbffcdd943a8440. The primary main worktree remains clean.

Reconciliation result

The four shared paths were merged semantically rather than selecting one side wholesale:

• frontend/src/app.js retains Complete canonical frontend deep-link and operator parity #156's single strict canonical parse/commit/hydrate route path, route tokens, entity failure handling, focus containment/restoration, and real history behavior while preserving Secure and structure runtime-template administration #157's server-role-derived admin gating, structured draft state, dirty confirmation, optimistic expectedVersion PUT/DELETE, template_in_use handling, conflict/error preservation, and confirmation focus restoration.
• Dirty runtime-template drafts now also guard Back/direct-hash navigation; cancellation restores the prior canonical URL and leaves the selected Templates surface and draft intact.
• Successful structured saves commit the canonical #/templates?templateId=... route from the authoritative save response without a redundant immediate re-fetch/render. This closed the only integration defect found during the port (a transient detached status node during saved-state evidence) while retaining the next reload's real API round trip.
• backend/scripts/test-server.ts retains both Complete canonical frontend deep-link and operator parity #156's deterministic read-fault/delay seam and Secure and structure runtime-template administration #157's production-auth browser-session role seam. The fault seam still returns no mocked entity payload and is absent from the deployed handler.
• frontend/src/styles.css contains both Complete canonical frontend deep-link and operator parity #156's route/entity/Inbox/dialog/mobile behavior and Secure and structure runtime-template administration #157's structured runtime-template desktop/mobile, focus, list/detail, and sticky-action behavior.
• backend/e2e/canonical-frontend.spec.js exercises the versioned Secure and structure runtime-template administration #157 create/delete behavior through the reconciled canonical route.

The other #157 backend, persistence, export, router, SAM/IAM, infrastructure, unit, and runtime-template E2E files are unchanged from 56a1e2a.

Verification evidence

All commands ran in .tmp/worktrees/issue-156-v2 unless stated otherwise.

• node --check frontend/src/app.js → PASS.
• git diff --check 56a1e2abd3f803172ea78bc9cd511bacc3733c31 → PASS.
• Focused Secure and structure runtime-template administration #157 backend suite, node --import tsx --test tests/runtime-template-admin.test.ts with the repository test environment → 6 passed.
• Focused Secure and structure runtime-template administration #157 browser suite, npx playwright test e2e/runtime-template-admin.spec.js --reporter=line from backend/ → 2 passed.
• Canonical frontend plus Complete canonical frontend deep-link and operator parity #156 route-parity, npx playwright test e2e/canonical-frontend.spec.js e2e/canonical-route-parity.spec.js --reporter=line from backend/ → 12 passed (5 canonical frontend + 7 route-parity).
• Full backend, npm --prefix backend test → 1229 tests: 1228 passed, 1 skipped, 0 failed across 178 suites.
• npm --prefix backend run typecheck → PASS.
• npm --prefix backend run build → PASS; canonical frontend artifact verified.
• uv run --with pytest python -m pytest tests/infra → 41 passed.
• make sam-validate → PASS; infra/template.full.yaml is a valid SAM template.
• sam build --config-env full-sandbox → PASS; Build Succeeded locally.
• make validate-planning-docs → 7 passed. The legacy docs_app suite is absent, as already recorded for Complete canonical frontend deep-link and operator parity #156.
• Full real-backend canonical browser suite, npm --prefix backend run test:e2e -- --reporter=line → 191 passed with one worker.
• .tmp/screenshots/issue-156/ → exactly 13 PNGs, each exactly 1440×900 or 390×844 as named.
• .tmp/screenshots/issue-157/ → exactly 21 PNGs, each exactly 1440×900 or 390×844 as named; the accepted admin/operator and mobile sticky-action evidence was regenerated by the full run.
• Candidate identity was recomputed after all verification and remained exactly the two fingerprints above.

One preliminary combined browser invocation stopped before test collection because the fresh v2 worktree did not yet contain the lockfile-declared @axe-core/playwright module. npm ci --ignore-scripts installed the exact lockfile graph inside v2; all focused and full reruns above then passed. This was an isolated dependency-preparation failure, not an application assertion failure.

Logs are retained under .tmp/issue-156-v2-{backend-test,typecheck,build,infra,planning,sam-validate,sam-build,e2e}.log in the v2 worktree.

Prior review applicability and required delta review

Prior #156 Architecture conclusions that remain applicable, with current automated evidence: the strict canonical route matrix and normalization policy; one parse/commit/hydrate ownership model; route-token stale-response rejection; independent task-context sources; honest entity 404/non-404/mismatch states; nested task/workflow focus containment and deterministic recreated-target restoration; the /logout browser-cookie boundary; and the test-only real-handler route-fault seam. Prior Architecture PASS: #156 (comment) .

The Architecture pass is not formally transferable to this new base/fingerprint. Delta re-review must bind the current candidate and inspect the shared frontend/src/app.js route/runtime-template integration—especially dirty Back/hash cancellation, canonical template selection after save, the intentional authoritative-cache hydrate: false save transition, and preservation of #157's role/version/delete contracts—and the combined backend/scripts/test-server.ts seams. #157's backend authorization, conditional-write/versionless compatibility, reference scan/tombstone, audit consistency, export, and narrowly scoped IAM conclusions remain applicable because those implementation files are unchanged from accepted post-#157 main.

Prior #156 Design conclusions that remain applicable, with regenerated evidence: synchronized route/surface/entity states; task/workflow dialog hierarchy and focus; honest loading/not-found/error/mismatch presentation; Inbox action progression/history; notification dismissal; recurring 204/409 guidance; visible Sign out; responsive hierarchy; mobile reachability; and zero critical/serious affected-state axe findings. Prior Designer PASS: #156 (comment) .

The Designer pass likewise needs delta binding because frontend/src/app.js and frontend/src/styles.css are shared surfaces. Delta re-review should inspect the regenerated #156 13-image set together with the #157 21-image set, focusing on Templates admin/operator selection, dirty-navigation confirmation and restored focus, desktop editor hierarchy, mobile list/detail behavior, and the sticky Save/Cancel actions below the shared topbar. The previously accepted #157 structured-editor state copy and geometry remain exercised by the unchanged #157 browser suite, but visual approval must be rebound to this fingerprint.

Next owners: Architect and Designer for fingerprint-bound delta review, then Tester and PM acceptance if both pass.

No commit, push, PR, deployment, workflow dispatch, manual AWS action, or source-repository modification was performed.