E2E findings: 40 fixes across routing, services, MCP, UI

[Vincentwei1021]

Summary

Fixes 40 findings from the 2026-05-10 E2E test pass (docs/testing/2026-05-10-e2e-findings.md). Three commits, organized by round and code domain:

• 9a8b29fa — Round 1: backend correctness (routing, PATCH, synthesis preservation, comment notifications, MCP schemas, compute SSH key leak)
• f83ff195 — Round 2: UI, locale, MCP cleanup, paper-search fallback, E2E-confirmed "already-fixed" verifications
• 0c5d919a — F-025 hotfix found in end-to-end retest (unauth 401 now triggers fallback)

Findings fixed

P0

• F-001 /research-projects/{uuid} now redirects to ./dashboard instead of 404
• F-002 invalid experiment status transitions return 400 with a clear message (was silent 500)
• F-021 refreshProjectSynthesis no longer clobbers agent-written synthesis when completedIdeas is empty — preserves the document and latestSynthesis* summary fields
• F-022 /api/comments now dispatches comment_added notifications for the target assignee and creator (moved out of the activity listener to avoid double-delivery and races)
• F-030 synapse_delete_project_group refuses non-empty groups unless force=true cascade-deletes children

P1

• F-003/F-005 updateResearchProject rejects autonomousLoopAgentUuid pointing at a non-realtime (poll) agent with a typed 400
• F-004 PATCH /api/research-projects/[uuid] returns the full GET-shaped payload (counts, autonomousLoop*, github*, activities)
• F-006 createAgent assigns a deterministic palette color when none is provided; null colors fall back at render time
• F-007/F-029 compute serializer masks sshKeyName/sshKeySource when managedKeyAvailable=true and exposes keyManagedByServer for UI
• F-008 Project Settings gains Autonomous Loop and Auto Search cards (realtime-only agent picker + mode select + 20 new i18n keys)
• F-009 locale-context calls router.refresh() after cookie write so Server Components re-render with the new locale
• F-010 experiments board reacts to ?selected=<uuid> URL changes and strips the param on Sheet close
• F-015 GET /api/compute-nodes returns a flat company-scoped list (was 405)
• F-023/F-024 synapse_propose_experiment now stamps createdBy* and assignedAt/assignedBy on auto-proposed experiments
• F-025 read_paper_brief/read_paper_head fall back to the public arXiv Atom API when DeepXiv cannot answer (not-found, or unauthenticated 401/403 without a token); real auth misconfig still surfaces
• F-031 synapse_create_research_project accepts projectGroupUuid (canonical) in addition to groupUuid (alias)
• F-032 synapse_create_research_question accepts optional parentUuid so agents can build hierarchies
• F-033 baseline metrics accept mixed number / string / nested record
• F-034 synapse_compare_results accepts Record<exp, Record<metric, number>>; returns per-metric deltas
• F-035 RQ status MCP enum unified with platform vocabulary (open/in_progress/to_verify/done/closed) with legacy aliases
• F-037 synapse_verify_reproducibility MCP tool removed (legacy ExperimentRegistry flow; underlying service kept for legacy REST route)

P2

• F-017 SSE contexts guard reconnect race on unmount via isUnmounting; comments clarify that native net::ERR_ABORTED is unsuppressable from JS
• F-020 researchQuestionUuid on experiments POST/PATCH tightened to z.string().uuid()
• F-026 listComments attaches a resolved mentions[] summary per comment; mention-renderer rewrites plain-text @handle tokens into canonical chips so API-written comments match UI-typeahead ones
• F-027 autonomous-loop wake prompt and get_project_full_context hint explicitly enumerate "one independent run per card; split sweeps/ablations/repeated trials/comparisons"
• F-036 synapse_update_experiment_plan accepts plan as an alias for description
• F-038 deep research reports save as document type deep_research (new writes; existing rows keep their prior type)
• F-040 stale synapse_pi_* comment stubs in pi.ts renamed to registered tool names
• F-041 synapse_list_baselines returns {baselines: [...]} wrapper
• F-042 create_project_group returns projects: []; update_project_group re-fetches via getProjectGroup so all three tools return the same shape
• F-044 experiment-designs POST error messages name the missing or invalid field and echo the bad value

Verified already-fixed on branch (no new code)

• F-011 /onboarding?force=1 is honored (commit 862a9999)
• F-018 board loading.tsx already renders DashboardRouteSkeleton
• F-019 agent-activity service already filters experiment counts by researchProjectUuid
• F-039 synapse_search references already cleaned from CLAUDE.md / agent-working-guide
• F-045 project-group.service already selects only minimal project fields

Out of scope (not in this PR)

F-012/F-013/F-014 OpenClaw external machine config, F-016 onboarding RSC abort chain, F-043 hypothesis-formulation MCP surface (large new tool family), F-046 hash-based debounce.

Test plan

• pnpm exec tsc --noEmit — 2 pre-existing errors only (unrelated to this PR)
• pnpm test — 1299 pass / 6 fail; fails are pre-existing mock/select drift in uuid-resolver, research-project.service, agent.service tests (confirmed unchanged vs. main baseline)
• End-to-end retest on synapse-test — docker image rebuilt, 25 findings verified via API / MCP / Playwright browser
• Manual browser check: Project Settings renders Autonomous Loop + Auto Search cards; ?selected= deep link opens detail Sheet; zh locale switch renders Chinese Server Components on first navigation

Artifacts

Retest screenshots under docs/testing/2026-05-10-e2e-screenshots/retest-*.png (Settings Loop card, deep-link detail panel).