stack/docs/scratchpads/ms20-site-stabilization-20260227.md

# Mission Scratchpad — MS20 Site Stabilization

> Append-only log. NEVER delete entries. NEVER overwrite sections.
> This is the orchestrator's working memory across sessions.

## Original Mission Prompt

```
User tested every aspect of mosaic.woltje.com and found:

settings/personalities:
- Unable to save new personality
- Dark mode theming on Formality Level dropdown not correct
- Error: Cannot GET /api/personalities?isActive=true

settings/credentials:
- "Loading credentials" displayed, none populated, unable to add
- favicon.ico 404
- useWorkspaceId warning in console

settings/domains:
- Workspace ID is required error

projects:
- Unable to create new project
- Workspace ID is required error

Additional:
- Fix Orchestrator 502
- Fix Orchestrator WebSocket connection
- /users/me/preferences endpoint needs implemented
- #terminal anchor panel toggle needs page route
```

## Planning Decisions

### S1 — 2026-02-27

1. **Mission scope**: Stabilization mission covering runtime bugs and feature gaps from live testing. NOT the originally planned MS20-MultiTenant. Bumped MultiTenant to MS21.

2. **Task categorization**:
   - P1 (Critical — blocking core functionality): Workspace context for mutations, orchestrator 502
   - P2 (High — important features): Personalities API, preferences endpoint, credentials UI, terminal route
   - P3 (Medium — polish): Dark mode dropdown, favicon, workspace ID warning

3. **PRD updated**: Added FR-020 (Site Stabilization) with 6 new assumptions. Shifted MS20-MultiTenant to MS21, renumbered subsequent milestones.

4. **Prior fixes already merged**:
   - PR #531: RLS context SQL, workspace guard crash, projects response unwrapping
   - PR #532: Widget endpoints workspace context + auto-detect workspace ID + credentials pages
   - PR #533: Knowledge entry query DTO — sortBy, sortOrder, search, visibility

## Session Log

| Session | Date       | Milestone | Tasks Done | Outcome     |
| ------- | ---------- | --------- | ---------- | ----------- |
| S1      | 2026-02-27 | MS20      | Planning   | In progress |

## Open Questions

- Orchestrator 502: Is the orchestrator container actually running? Need to check Docker service status.
- Workspace ID lifecycle: When does the workspace ID first get set in localStorage? Is it during login/auth callback?
- Credentials backend: Do the M7 credential CRUD endpoints still work, or has something changed since?

### S2 — 2026-02-27

1. **Completed tasks**: WS-001 (PR #536), WS-002 (already working), API-001 (PR #537), API-002 (PR #539), UI-003 (PR #538)
2. **Session ended**: Context exhaustion after dispatching 5 workers across 2 waves
3. **Dirty state at exit**: SS-UI-002 worker left uncommitted changes (Select dark mode fix, 204 handler, personalities API client fix). SS-API-002 worker completed autonomously (PR #539 merged).
4. **Variance**: SS-WS-001 estimated 15K used ~37K (146% over). SS-API-001 estimated 30K used ~45K (50% over). Both due to QA remediation cycles.

### S3 — 2026-02-27

1. **Dirty state recovery**: Recovered uncommitted S2 worker changes. Committed SS-API-002 to feat/user-preferences-endpoint (PR #539 already merged by old worker). Committed SS-UI-002 partial to fix/personalities-page (PR #540 open).
2. **Dispatched workers**: SS-ORCH-001 (orchestrator 502 fix), SS-UI-004 (favicon)
3. **Remaining**: WS-003, ORCH-001 (dispatched), ORCH-002 (blocked), UI-001, UI-004 (dispatched), VER-001, DOC-001

## Corrections

### S3 — TASKS.md revert

TASKS.md had reverted to S1 state (only PLAN-001 done) despite S2 completing 5 tasks. Root cause: S2 doc commits were on main but TASKS.md edits were local and lost when worktree workers caused git state issues. Rewrote TASKS.md from scratch in S3.

### S4 — 2026-02-27

1. **Completed tasks**: SS-WS-003 (already in main), SS-UI-001 (PR #545 merged by S3 worker), SS-ORCH-002 (PR #547 merged by worker + PR #548 test fix + PR #549 CORS fix by orchestrator), SS-VER-001 (full site verification + deploy)
2. **Key findings during verification**:
   - WebSocket test failure: PR #547 added `withCredentials: true` but test expected old options. Fixed in PR #548.
   - WebSocket CORS: Gateway used `process.env.WEB_URL ?? "http://localhost:3000"` for CORS origin. WEB_URL not set in prod, causing localhost CORS rejection. Fixed in PR #549 to use `getTrustedOrigins()` matching main API.
   - SS-WS-003 was already in main from S2 worker that co-committed with favicon fix. PR #546 closed as redundant.
3. **Deployment**: Portainer stack 121 (mosaic-stack) redeployed twice — first for PR #548 merge, second for PR #549 CORS fix.
4. **Smoke test results**: All 8 key pages return 200. Chat WebSocket connected (no more "Reconnecting"). Favicon valid RGBA ICO. No CORS errors in console. Only remaining errors are orchestrator 502s (expected — service not active in prod).
5. **Variance**: SS-ORCH-002 estimated 15K, used ~25K (67% over) due to CORS follow-up fix discovered during verification.
6. **Total mission PRs**: 13 code PRs + 1 doc PR = 14 merged.

## Session Log (Updated)

| Session | Date       | Milestone | Tasks Done                                 | Outcome   |
| ------- | ---------- | --------- | ------------------------------------------ | --------- |
| S1      | 2026-02-27 | MS20      | Planning                                   | Completed |
| S2      | 2026-02-27 | MS20      | WS-001, WS-002, API-001, API-002, UI-003   | Completed |
| S3      | 2026-02-27 | MS20      | UI-002, UI-004, ORCH-001 dispatched        | Completed |
| S4      | 2026-02-27 | MS20      | WS-003, UI-001, ORCH-002, VER-001, DOC-001 | Completed |