- Root cause confirmed = mechanism (ii): ['me'] staleness, NOT a backend linking gap
(upsertUser claim preserves users.id → credential stays linked → DB needsProviderSetup=false)
- SetupBanner ['me'] query staleTime 5min → 0 so a pre-claim stale cache entry is
refetched on mount; banner hides once needsProviderSetup resolves false
- App.tsx boot ['me'] staleTime also set to 0 (committed with Task 1) for the same reason
- Add SetupBanner.test.tsx regression: absent when false, present (no dismiss) when true,
stale-cache refetch hides banner; success-only dismissal contract preserved (no X button)
- Log pre-existing PWA lint errors (SetupPage.test.tsx, setupClient.contract.test.ts) to deferred-items.md
Drop Step 2 "Generate Secrets" (secrets move to pre-boot helper script per D-05),
rework Step 2 to collect non-secret config via form fields (app URL, OIDC issuer,
client_id, VAPID public key) written to app_config per D-02, and reduce wizard
from 5 steps to 4. All design tokens, surfaces, and a11y contracts unchanged.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Resolve plan-checker warning (mark RESEARCH Open Questions RESOLVED),
fill VALIDATION.md Nyquist map (nyquist_compliant), record planning
complete in STATE, annotate ROADMAP wave dependencies.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Covers pre-auth /api/setup/* route surface, minimal-env-kernel + DB-backed
config model, pre-OIDC local user + first-login-claims schema migration,
defense-in-depth 423 guard, generate-secrets helper script, and explicit
reconciliation of the SETUP-03 and D-09 deviations from the roadmap.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Restored onto phase-12 branch — discuss-phase originally committed the
context (dc41073) on the phase-18 branch by mistake.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Re-review after fixes: status clean (0 Critical/Warning). All 5 findings
from the prior pass resolved across 4 atomic fix commits:
- WR-01: treat empty/blank TZ as unset in the D-06 fallback chain
- WR-02: derive seed `seeded` flag from INSERT IGNORE affectedRows (accurate
under concurrent race; D-03 no-overwrite preserved)
- IN-01/02: reuse fetched row on GET unset path; centralize D-06 fallback
- IN-03: memoize household timezone per outbox drain cycle
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Phase-goal verification: 7/7 decision-contract truths confirmed (D-01..D-07).
Browser round-trip re-confirmed via Playwright e2e against the live stack.
Mark phase 18 complete in STATE.md and ROADMAP.md.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
One deferred human check: live Fastmail VALARM round-trip + push (untestable in dev, backlog 999.19).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Lucas Berger