stack/docs/scratchpads/ms20-site-stabilization-20260227.md

Mission Scratchpad — MS20 Site Stabilization

Append-only log. NEVER delete entries. NEVER overwrite sections. This is the orchestrator's working memory across sessions.

Original Mission Prompt

User tested every aspect of mosaic.woltje.com and found:

settings/personalities:
- Unable to save new personality
- Dark mode theming on Formality Level dropdown not correct
- Error: Cannot GET /api/personalities?isActive=true

settings/credentials:
- "Loading credentials" displayed, none populated, unable to add
- favicon.ico 404
- useWorkspaceId warning in console

settings/domains:
- Workspace ID is required error

projects:
- Unable to create new project
- Workspace ID is required error

Additional:
- Fix Orchestrator 502
- Fix Orchestrator WebSocket connection
- /users/me/preferences endpoint needs implemented
- #terminal anchor panel toggle needs page route

Planning Decisions

S1 — 2026-02-27

1. Mission scope: Stabilization mission covering runtime bugs and feature gaps from live testing. NOT the originally planned MS20-MultiTenant. Bumped MultiTenant to MS21.

2. Task categorization:

   • P1 (Critical — blocking core functionality): Workspace context for mutations, orchestrator 502
   • P2 (High — important features): Personalities API, preferences endpoint, credentials UI, terminal route
   • P3 (Medium — polish): Dark mode dropdown, favicon, workspace ID warning

3. PRD updated: Added FR-020 (Site Stabilization) with 6 new assumptions. Shifted MS20-MultiTenant to MS21, renumbered subsequent milestones.

4. Prior fixes already merged:

   • PR #531: RLS context SQL, workspace guard crash, projects response unwrapping
   • PR #532: Widget endpoints workspace context + auto-detect workspace ID + credentials pages
   • PR #533: Knowledge entry query DTO — sortBy, sortOrder, search, visibility

Session Log

Session	Date	Milestone	Tasks Done	Outcome
S1	2026-02-27	MS20	Planning	In progress

Open Questions

• Orchestrator 502: Is the orchestrator container actually running? Need to check Docker service status.
• Workspace ID lifecycle: When does the workspace ID first get set in localStorage? Is it during login/auth callback?
• Credentials backend: Do the M7 credential CRUD endpoints still work, or has something changed since?

S2 — 2026-02-27

1. Completed tasks: WS-001 (PR #536), WS-002 (already working), API-001 (PR #537), API-002 (PR #539), UI-003 (PR #538)
2. Session ended: Context exhaustion after dispatching 5 workers across 2 waves
3. Dirty state at exit: SS-UI-002 worker left uncommitted changes (Select dark mode fix, 204 handler, personalities API client fix). SS-API-002 worker completed autonomously (PR #539 merged).
4. Variance: SS-WS-001 estimated 15K used ~37K (146% over). SS-API-001 estimated 30K used ~45K (50% over). Both due to QA remediation cycles.

S3 — 2026-02-27

1. Dirty state recovery: Recovered uncommitted S2 worker changes. Committed SS-API-002 to feat/user-preferences-endpoint (PR #539 already merged by old worker). Committed SS-UI-002 partial to fix/personalities-page (PR #540 open).
2. Dispatched workers: SS-ORCH-001 (orchestrator 502 fix), SS-UI-004 (favicon)
3. Remaining: WS-003, ORCH-001 (dispatched), ORCH-002 (blocked), UI-001, UI-004 (dispatched), VER-001, DOC-001

Corrections

S3 — TASKS.md revert

TASKS.md had reverted to S1 state (only PLAN-001 done) despite S2 completing 5 tasks. Root cause: S2 doc commits were on main but TASKS.md edits were local and lost when worktree workers caused git state issues. Rewrote TASKS.md from scratch in S3.

S4 — 2026-02-27

1. Completed tasks: SS-WS-003 (already in main), SS-UI-001 (PR #545 merged by S3 worker), SS-ORCH-002 (PR #547 merged by worker + PR #548 test fix + PR #549 CORS fix by orchestrator), SS-VER-001 (full site verification + deploy)
2. Key findings during verification:
   • WebSocket test failure: PR #547 added withCredentials: true but test expected old options. Fixed in PR #548.
   • WebSocket CORS: Gateway used process.env.WEB_URL ?? "http://localhost:3000" for CORS origin. WEB_URL not set in prod, causing localhost CORS rejection. Fixed in PR #549 to use getTrustedOrigins() matching main API.
   • SS-WS-003 was already in main from S2 worker that co-committed with favicon fix. PR #546 closed as redundant.
3. Deployment: Portainer stack 121 (mosaic-stack) redeployed twice — first for PR #548 merge, second for PR #549 CORS fix.
4. Smoke test results: All 8 key pages return 200. Chat WebSocket connected (no more "Reconnecting"). Favicon valid RGBA ICO. No CORS errors in console. Only remaining errors are orchestrator 502s (expected — service not active in prod).
5. Variance: SS-ORCH-002 estimated 15K, used ~25K (67% over) due to CORS follow-up fix discovered during verification.
6. Total mission PRs: 13 code PRs + 1 doc PR = 14 merged.

Session Log (Updated)

Session	Date	Milestone	Tasks Done	Outcome
S1	2026-02-27	MS20	Planning	Completed
S2	2026-02-27	MS20	WS-001, WS-002, API-001, API-002, UI-003	Completed
S3	2026-02-27	MS20	UI-002, UI-004, ORCH-001 dispatched	Completed
S4	2026-02-27	MS20	WS-003, UI-001, ORCH-002, VER-001, DOC-001	Completed