# Continue Here — Phase 02 (ui-performance) close-out

**Written:** 2026-07-31, mid-session (user changing wifi; session may drop)
**Milestone:** v1.8.0 · **Phase 02 status:** executed, gap closure in progress

## Where we are in one paragraph

Phase 02's 8 plans all executed and were signed off by the user on real hardware.
`gsd-verifier` then returned **gaps_found (6/8 must-haves)**, which routed into
`/gsd-plan-phase 2 --gaps` → gap plans **02-09** (Server remount) and **02-10**
(timing verdict). 02-09 is **COMPLETE** — it proved the "Server.vue remounts"
finding was a *probe-measurement artifact*, not a defect (no source change needed;
regression tests now pin instance survival via `vm.$.uid`). 02-10 is still running.
A separate code review found and fixed 1 Critical + 6 Warnings; a follow-up security
task is also in flight. Once 02-10 and the security task land, **re-run the verifier**;
if it passes, mark the phase complete.

## Critical hazards — read before ANY git command

1. **SHARED WORKING TREE.** The user runs a SEPARATE session on **BotFights (phase 9)**
   in this same checkout. Their uncommitted work is interleaved with ours.
   - NEVER `git add -A` / `git add .` / `git commit -a` / `git stash` (stash refs are
     shared — it strands their work) / `git checkout|restore` files you didn't edit /
     `git reset --hard`.
   - Stage ONLY exact paths you personally modified.
   - Known to be THEIRS (do not stage/revert/modify): `releases/app-catalog.json`
     (regenerated catalog, ~5090 lines, BotFights registry work),
     `neode-ui/src/components/LightningChannelsPanel.vue`, `neode-ui/package-lock.json`,
     `.planning/config.json`, `scripts/resilience/.gitignore-reports.tmp`.
   - `neode-ui/src/views/AppDetails.vue` and `Cloud.vue` may hold a MIX of their edits
     and our persist-audit edits — inspect `git diff -- <file>` hunk by hunk; never
     commit a hunk you didn't write.
2. **DO NOT DEPLOY** to archi-dev-box right now. A frontend deploy would ship their
   in-progress BotFights work plus unreviewed security changes to the node together.
3. **Never touch the user's dev servers:** `:8100` (vite), `:5959` (mock backend),
   `:5173` (AIUI dev), `:3141` (claude-api-proxy). Never use broad `pkill` patterns —
   an earlier agent killed the user's `:8100` session that way. Kill only exact PIDs
   you started; use port 8104+ for your own.

## Critical anti-patterns

| Anti-pattern | Severity | Why |
|---|---|---|
| Changing existing visuals/animations during perf or refactor work | blocking | 02-02's KeepAlive restructure broke page margins and the up/down slide transitions; caught only at a human checkpoint, needed a dedicated fix commit. Perf work must be visually invisible. `keepAliveTabs.test.ts` structurally pins the DOM shape — if a change breaks it, the change is wrong. |
| Broad `pkill` / `git add -A` / `git stash` in a shared tree | blocking | Both have already destroyed or risked others' work in this project this session. |
| Parking review/verifier findings as "advisory" | blocking | User's explicit rule: findings get fixed in the same run, not deferred. |
| Trusting a CSS-selector remount probe | major | The generic `.view-container [data-controller-container]` selector cannot disambiguate the foreground tab from other still-connected KeepAlive-cached tabs; it produced a false "Server remounts" verdict that cost a whole gap-closure cycle. Use `vm.$.uid` (see `keepalive-remount-probe.spec.ts`). |

## In-flight background agents (may still be running)

| Agent | Owns | Deliverable |
|---|---|---|
| 02-10 executor | `02-PERF-REMEASURE.json`, `02-FINDINGS.md`, `02-10-SUMMARY.md`, STATE/ROADMAP | Verdict for 6 surfaces: cleared-as-noise / fixed / accepted deviation |
| security follow-up | `stores/resources.ts`, `composables/useCachedResource.ts`, persist call sites, `vite.config.ts`, `PWAUpdatePrompt.vue`, `02-REVIEW.md` | One-time snapshot purge, `persist` required everywhere, PWA auto-update |

If neither has committed and both are gone, their work is recoverable from the plan
files and `02-REVIEW.md`; re-dispatch rather than guessing.

## Next actions, in order

1. Wait for / confirm 02-10 + security follow-up commits.
2. **Re-run `gsd-verifier` on phase 02** against `02-VERIFICATION.md`'s two gaps
   (gap 1 closed by 02-09; gap 2 by 02-10). If passed → `phase.complete`.
3. **VPS2 domain migration** — see `.planning/todos/pending/2026-07-30-migrate-source-references-to-https-domain.md`.
   ~196 refs of `146.59.87.168` → `https://source.archipelago-foundation.org`;
   `companion.archipelago-foundation.org` and `fips.archipelago-foundation.org` are now
   live (DNS verified). Needs a core Rust rebuild + on-node verification. NOTE:
   `core/target` was deleted to reclaim disk, so the first cargo build will be slow.
4. **Phase 1 (federation & mesh hardening)** — 10 existing plans, PLUS a required gap
   plan for the 8 items the user added on 2026-07-30: FED-07 (fedimint gateway ships
   with a pre-set password — security blocker) and UIFIX-01..06 (FIPS/Tor pills on
   mobile, connected-nodes scroll height, onboarding tickbox on short screens, Paid
   Files lightbox, PiP robustness incl. surviving tab switches + buffering, loader
   states). See ROADMAP phase 1 criteria 7-13 and `.planning/todos/pending/`.

## Environment facts

- This machine **IS** archi-dev-box (Tailscale MagicDNS; also `100.69.68.39`). Deploys
  are loopback SSH: `ARCHIPELAGO_TARGET=archipelago@archi-dev-box scripts/deploy-to-target.sh --frontend-only`.
- UI password for archi-dev-box: **ask the user** — pass at runtime as `ARCHY_PASSWORD`
  env var only, never written to any file or commit.
- `archy-x250-dev` (dev pair's 2nd node) is **offline/gone** — dev-pair verification is
  deferred; run single-node and record the gap honestly.
- AIUI source: `https://git.tx1138.com/lfg2025/AIUI`, working branch `development`,
  local clone at `/home/archipelago/Projects/AIUI`. D-14 embed defaults + embed
  round-trip fixes are pushed upstream.
- git remote `gitea-ai` now uses HTTPS via `source.archipelago-foundation.org`.
- Node disk was at 85%; ~118G reclaimed (`core/target`, `image-recipe/build`, caches).
  `image-recipe/results` (~34G of ISOs) was deliberately NOT deleted — needs user OK.

## Known-open, user-accepted items (do not re-litigate)

- Timing regressions on Discover/Web5/Fleet/AppDetails/OpenWrtGateway — 02-10 is
  producing the verdict.
- `/dashboard/settings` deliberately withheld from KeepAlive (unaudited side effects
  in its child sections).
- `PeerFiles.vue` raw-store loading/refreshing conflation; `CloudFolder.vue` TTL gate —
  both flagged, out of phase 02 scope.