development.md

Development Log

Purpose

Track OpenClog implementation decisions, verification passes, refactors, and closeout evidence.

2026-06-08 Final Refactor, Coverage, And All-Gates Closeout

• Refactored OpenClaw startup backfill error handling by centralizing throwable-to-message normalization in apps/api/src/openclaw-session-backfill.ts, keeping scheduled startup failures and bulk-write failures fail-closed without duplicated branches.
• Added targeted backfill resilience coverage for disabled scheduling, scheduled real-scanner no-op runs, startup exception containment, empty configured session windows, bulk-write Error failures, and bulk-write string throwables.
• Repaired the repo-wide 100 percent coverage gate after the first all-up npm run verify failed at 99.29 percent statements / 98.43 percent branches. npm run test:coverage now reports 100 percent statements, branches, functions, and lines across 21 Vitest files / 232 tests.
• Final npm run verify passed end to end: forbidden-RPC checks, typecheck, lint, workspace builds, 100 percent coverage, 210 Playwright E2E/UI tests, 54 visual snapshots, 8 red-team tests, and docs check.
• Supplemental closeout also passed: npm run verify:desktop-native rebuilt the web bundle and passed 3 Tauri tests; npm run test:smoke passed 60 Vitest smoke tests, the Chromium operations-report empty-state check, and desktop cargo smoke.
• After committing the startup/load code tranche, rebuilt @openclog/api and restarted com.m4.openclog-api so /api/version reports runtime-code commit f6d3cef, PID 33268, build timestamp 2026-06-08T11:18:50.216Z, and runtime fingerprint 6a72172c2df794c23c2bfc2392bb037e3c6e689f39904e1866db23f7d4c3f435.
• Latest live route-budget proof against http://127.0.0.1:8787 stayed green with npm run test:load -- --base-url http://127.0.0.1:8787 --day-key 2026-06-06: /api/operations/report 396 ms / 750 ms, /api/verification/receipts 3 ms / 200 ms, /api/sessions/:key 2 ms / 300 ms, breachCount: 0.
• Live Gateway verification passed with status ready, role operator, scopes operator.admin, operator.read, and operator.write; mutation testing remained disabled.

2026-06-08 Default Startup Backfill And Live Load Closeout

• Moved OpenClaw session backfill out of the pre-listen boot path: apps/api/src/server.ts now starts Fastify first, then schedules the backfill; apps/api/src/openclaw-session-backfill.ts batches imported messages through the repository when available instead of summarizing each message one by one.
• Added a bounded startup recovery pass for the LaunchAgent default: 10 recent files / 10 messages unless OPENCLOG_OPENCLAW_SESSION_BACKFILL_MAX_FILES or OPENCLOG_OPENCLAW_SESSION_BACKFILL_MAX_MESSAGES is set. The disable switch still exists for emergencies, but it is no longer needed for prompt 8787 bind.
• Cleared the inherited launchd override with launchctl unsetenv OPENCLOG_OPENCLAW_SESSION_BACKFILL; launchctl print gui/$(id -u)/com.m4.openclog-api then showed no inherited backfill override, only SSH_AUTH_SOCK.
• Rebuilt and restarted com.m4.openclog-api; the default startup listener bound /api/version in 729 ms and reported commit 05fa238, PID 98679, build timestamp 2026-06-08T10:58:19.319Z, and runtime fingerprint 84b2ece13dc6062251447943a4754a04d14236819453b7d61f4a8a65cf4e4826.
• The scheduled default backfill imported 10 messages from 8 files through 2026-06-08T10:32:28.358Z. A larger 50-message trial proved why the default needed a tighter bound: it temporarily pushed /api/operations/report to 2958 ms / 750 ms before settling.
• Final live route-budget proof is green on the default-started listener: npm run test:load -- --base-url http://127.0.0.1:8787 --day-key 2026-06-06 reported breachCount: 0; /api/operations/report was 249 ms / 750 ms, /api/verification/receipts was 3 ms / 200 ms, and /api/sessions/:key was 2 ms / 300 ms.
• Focused verification passed with npx vitest run apps/api/test/openclaw-session-backfill.test.ts apps/api/test/repository.test.ts apps/api/test/routes.test.ts (66 tests), npm run typecheck, and npm run build -w @openclog/api.

2026-06-06 Current-Source Listener Reverification

• Confirmed the pre-refresh listener no longer reported 2d37c7f; /api/version already returned commit 05fa238 from PID 2162, but two dirty source files were newer than the API entry bundle, so the runtime proof still needed a focused rebuild/restart.
• Rebuilt @openclog/core, @openclog/app, and @openclog/api, restarted com.m4.openclog-api, and used the existing OPENCLOG_OPENCLAW_SESSION_BACKFILL=0 LaunchAgent environment override after the default startup backfill path spent more than two minutes in SQLite work before opening the listener.
• The final responsive listener now reports commit 05fa238, PID 90222, build timestamp 2026-06-06T19:35:03.247Z, and runtime fingerprint 5599ca09712b9833b9e3eb59a2167648162d4161d8962acdee35891ef0336bfa on http://127.0.0.1:8787/api/version.
• Live npm run test:load -- --base-url http://127.0.0.1:8787 --day-key 2026-06-06 reached all target routes on the same rebuilt source before the final post-proof restart, but failed the route-budget gate: /api/operations/report took 14454 ms / 750 ms, while /api/verification/receipts took 3 ms / 200 ms and /api/sessions/:key took 172 ms / 300 ms.
• npm run verify:desktop-native passed with receipt verification-npm-run-verify-desktop-native-20260606T192846262Z; no new desktop-host self-check row was produced, so the latest native-runner row remains the May 31 historical 2d37c7f evidence.

2026-06-03 Trust-Surface Visibility Reverification

• Reverified the dirty worktree on local HEAD 05fa238; the active tranche now includes attention-item acknowledge/snooze state, /api/healthz/details, the healthz shell detail chip, closeout-blocker copy, and the blocked-gates + dry-runs + stale summaries built-in saved view.
• Fixed the saved-view cap exposed by Playwright: built-in saved views no longer evict a newly saved operator view when the built-in list reaches the display cap.
• Fixed route-budget percentile truthfulness by suppressing percentile labels until persisted route-budget observations exist for the route.
• Refreshed all 54 visual snapshots after confirming the global shell drift was intentional for the healthz/saved-view additions.
• Kept the runtime boundary explicit for the June 3 check: the live 8787 endpoint still reported commit 2d37c7f then, so that proof was command, fixture-load, native-test, Gateway-probe, and visual proof rather than a rebuilt current-head live runtime. This boundary is superseded by the June 6 current-source listener proof above.

2026-06-01 Current-HEAD Proof And Focus Refactor

• Reconciled the repo-local reporting artifacts with the live Google Doc authority for local main commit 2d37c7f, replacing stale current-proof references to the older 4c15cf6 8787 runtime while preserving that proof only as historical May 27 context.
• Kept native cutover truth bounded: the May 30/31 evidence proves desktop self-check/native-runner evidence and live route-budget health, not browser-side receipt writes, mutation-enabled Gateway verification, live-send delivery success, or a full native authority handoff.
• Refactored timeline focus retention so it restores entry focus only while focus remains in the timeline context; diagnostics, shell, and other operator regions can now keep focus across health/report re-renders.
• Fresh closeout verification passed through npm run verify, npm run docs:check, npm run test:smoke, npm run verify:gateway, and npm run verify:desktop-native.

2026-05-30 Saved-View, Runtime Drift, And Route-Budget Closeout

• Finished the saved-view audit surface across the real settings/API path: saved views now persist created, updated, deleted, and workbench used audit events. The root DB proof added reversible audit rows for audit-proof-1780195919976 and retained the existing 7 used rows.
• Bounded the operations report payload instead of streaming the entire summary-job corpus: summaryJobHistory now returns 50 recent jobs with totalJobCount, and the Operations Ledger returns 100 entries with totalEntryCount and truncated metadata.
• Repaired the desktop self-check default API base to http://127.0.0.1:8787, rebuilt the service artifacts, and restarted com.m4.openclog-api from /Users/m4/OpenClog/scripts/run-openclog-api.sh.
• Optimized expensive report assembly reads with bounded SQL summaries for health history, SLO, retention, stale summaries, and recovered-evidence counts, then rebaselined the full /api/operations/report live budget to 750 ms.
• Reconciled the repo-local proof logs with the live Google Doc authority for closeout commit 2d37c7f: 8787 reported runtime fingerprint 96c1db842ef7bf6990883b995733c9cc491ca181dbee6d81ebefaea98388977f, the native self-check receipt was desktop-self-check:http___127_0_0_1_8787:2026_05_31T03_07_26_520Z, and the live route-budget proof remained prep-only native evidence rather than an authority handoff.

2026-05-26 Native Runner Evidence Cutover Prep

• Added shared native-runner evidence contracts, repository read/write methods, a Drizzle schema export, and bounded SQLite busy handling so command receipts and native self-check rows wait through transient local locks instead of being silently lost.
• Promoted the Tauri scheduled self-check into a persisted desktop evidence producer: it writes normalized native-runner history to journal_native_runner_history, runs once on startup, and repeats on OPENCLOG_DESKTOP_SELF_CHECK_INTERVAL_MS unless the interval is 0.
• Wired native-runner evidence into the operations report, Native Truth Monitor, Operations Ledger, and workbench copy while keeping Fastify as policy/report authority and the browser read-only for verification evidence.

2026-05-25 One-Pass Operations Campaign

• Deepened the shared operations-report contract across @openclog/core, @openclog/app, and the SQLite repository instead of layering a second UI-only status model on top of the existing report scaffolding.
• Added persisted report snapshots, saved-view audit events, and evidence-drift observations so report freshness, diffing, provenance, and saved-view hygiene can fail closed from local evidence rather than inferred browser state.
• Extended the workbench shell with report freshness/status chips, smoke-receipt visibility, recovered-evidence provisional state, a morning-command panel, summary-job operator timeline copy, richer delivery-target diagnostics, and one-click Copy next safe action controls on blocked Verification Center gates.
• Added a fixture-backed local load harness at scripts/load-report-routes.ts so report-heavy route budgets can be rehearsed offline or measured against a live local API.

2026-05-24 Backlog Smoke And Readiness Closeout

• Closed the remaining quick backlog tranche by adding a root npm run test:smoke gate that exercises API route smoke coverage, workbench helper coverage, the operations-report empty-state browser check, and the desktop cargo check smoke command.
• Added /api/healthz as a cheap readiness probe that returns sanitized backend fingerprint metadata and public Gateway state without exposing Gateway credentials or raw transport details.
• Made operations-report freshness visible in the browser: Verification Center and Operations backlog panels now show report generation timestamps, and empty report states provide local reload and integrity-check actions.

2026-05-20 OpenClaw Session Backfill Live Closeout

• Re-read the authoritative Google Doc OpenClog (1FUJzFAW1TNgT42JWVeA2PClkyEPAgSt-PQYnCDj9B2Q) at revision AFwiY18A9XkufsG9rNVFGcddP3qtqhPRVEd8BOCOEh9Dt-LoZtPnlVJf2j6PiegI62j78yjsj9Bf-bOYW95OeYdaixm5ABOVCm60g5Gko6c before touching the backfill path.
• Ran backfillOpenClawSessions against the real local OpenClaw session logs at /Users/m4/.openclaw/agents/main/sessions and persisted the recovered entries into openclog.db.
• Fixed the drift exposed by live data: provenance was present on recovered entries and drilldowns, but quoted provenance search and route-preserved backfill filters were not wired all the way through.
• Rebuilt @openclog/api and restarted com.m4.openclog-api; the live API now returns recovered May 20 entries, provenance search hits, and drilldown import timestamps from the rebuilt server.
• Added recoveredEvidenceSummary to the operations-report contract and rendered it in the main day header plus the Operations backlog panel so material backfills show entry counts, recovered day counts, and the latest import timestamp without requiring a drilldown first.

2026-05-18 Quick Wins Trust Tranche

• Implemented the approved Quick Wins tranche on local main by extending shared trust/report contracts first, then wiring the web shell to those bounded fields.
• Kept the refactor narrow: the new operator-facing trust strings live in apps/web/src/state/operator-workspace.ts, while App.tsx now consumes helpers for the shell badge, delivery-target status, verification comparisons, and timeline-source summaries.
• Added the built-in Needs operator action now view, a header-level active-incident badge, blocked-action copy affordances on delivery controls, and Alt+B / enhanced Alt+R keyboard focus paths for blocked actions and failed receipts.
• Repo-wide unit coverage now closes at 100% statements, 100% branches, 100% functions, and 100% lines without adding new exclusions.
• Tightened the desktop-native verifier contract so npm run verify:desktop-native builds the web dist before running Tauri cargo tests instead of assuming a stale bundle is already present.

2026-05-02 Bootstrap Intent

• Initialize this folder as the local OpenClog repo on main.
• Build the local-first OpenClog Journal MVP from Instructions.md.
• Keep Gateway protocol names dotted and documented: no underscore RPC variants.
• Treat deterministic verification and live Gateway verification as separate gates.

2026-05-02 MVP Closeout

• Initialized the repo on main and preserved Instructions.md.
• Built the React/Vite/TypeScript frontend, Fastify API, SQLite journal repository, Drizzle schema contract, core protocol/redaction/export/theme package, and deterministic fixture tests.
• Added the post-green refactor by splitting the React shell into focused journal layout components while keeping state and side effects in App.tsx.
• npm run verify passed after the refactor: dotted-RPC guard, typecheck, lint, build, 100% unit coverage, Playwright e2e, Playwright visual snapshots, red-team fixtures, and log checks.
• npm run verify:gateway failed closed with device identity required; no live Gateway activity was fabricated or logged as green.

2026-05-02 Local Gateway Token Follow-Up

• Read the local OpenClaw Gateway token from /Users/m4/.openclaw/openclaw.json without printing or storing the secret.
• Corrected the reconnect presence RPC from the invented system.presence name to the installed OpenClaw system-presence method.
• Added a live Gateway adapter for the API startup path; when the local token is present, OpenClog negotiates operator.read, operator.write, and operator.approvals.
• Restarted the local API and browser surface; /api/health now reports Gateway ready with no missing scopes.

2026-05-02 Live Flow Follow-Up

• Fixed the missing data flow from OpenClaw into OpenClog: live Gateway event frames are now emitted through the backend port, normalized, redacted, persisted in SQLite, and pushed to browsers over /api/stream.
• Changed composer ask/command flow to sessions.create with no duplicate initial message, then sessions.messages.subscribe, then one sessions.send.
• Removed the optional reused OpenClog session label after live Gateway rejected it as already in use.
• Verified a real OpenClog composer ping produced a real OpenClaw pong journal entry in the running app.

2026-05-02 Five-Theme UI Refinement

• Renamed product-facing UI copy to OpenClog and OpenClog Journal while keeping OpenClaw Gateway wording for integration/status text.
• Added the typed five-theme system with canonical IDs: openclog-journal, captains-log, accessibility, a-hearty-tale, and blackbeards-log; compatibility aliases remain centralized.
• Refactored the frontend into focused shell, sidebar, composer, readiness, day header, timeline, diagnostics, status chip, skip link, and shortcuts-help components.
• Added deterministic local background assets and refreshed Playwright desktop/mobile visual snapshots for all five themes.

2026-05-02 Interaction Refinement

• Fixed the Blackbeard's Log desktop overlap by tightening the shell grid, capping the diagnostics rail, and moving timeline status chips below entry text at narrower desktop widths.
• Added persisted Show Tool Calls display filtering in Recent Tools; all redacted OpenClaw events remain stored while tool entries can be hidden from the visible timeline.
• Added selected-day archive navigation, clickable 10-second live event toasts, target-entry scroll/focus, richer Agent Activity, and a Pending approvals popover with approve, disapprove, and defer choices.
• Refreshed the desktop/mobile visual snapshots after visually checking the Blackbeard layout.
• Deterministic npm run verify passed for this interaction refinement.
• Live npm run verify:gateway failed closed with device identity required; no live Gateway activity was fabricated.

2026-05-02 Theme Families Expansion

• Expanded OpenClog from the original five themes into a 27-theme family system using shared familyPresets, accessibility overlays, defineTheme(), and token-driven CSS variables.
• Added grouped theme selection for Core, News / Media, Social / Community, OS / Desktop, and Accessibility while preserving theme switching as presentation-only behavior.
• Refactored the theme layer around reusable metadata, local asset registry entries, rail contrast variables, and browser-visible event preview/redaction helpers.
• Kept Gateway state, Agent Activity, Recent Tools, Pending approvals, status chips, degraded state, blocked state, and security warnings visible across every selectable theme.
• Removed stale decorative asset paths and updated desktop/mobile visual snapshots for every theme.
• Final deterministic closeout verification passed with npm run verify before commit.
• Live Gateway closeout verification failed closed with device identity required; no live Gateway activity was fabricated or claimed green.

2026-05-03 Stabilization And Refactor

• Stabilized the existing 27-theme set without adding themes or changing backend, Gateway, permission, composer, persistence, approval, API, or delivery behavior.
• Cleaned product-facing archive/export/sample display paths so historical source titles render as OpenClog Journal while OpenClaw Gateway wording stays limited to integration/status contexts.
• Added display-only timeline grouping for adjacent repeated low-value events, a grouped/raw timeline toggle, and target-entry navigation that expands the containing group when needed.
• Added browser-visible safety metadata with explicit redaction reasons for credentials, token-like values, auth headers, cookies, OAuth, SMTP, env assignments, raw Gateway-looking payloads, unsafe local paths, and long previews.
• Added theme lifecycle, use-case, timeline layout mode, and diagnostics density metadata for the existing theme catalog.
• Refactored timeline focus and grouped-entry rendering after the first green verification pass, keeping the behavior token-driven.
• Refreshed desktop/mobile visual snapshots for every selectable theme after checking diagnostics and status chips remained visible.
• Ignored local Stitch export artifacts so generated design bundles do not enter the verified source commit.
• Live Gateway verification failed closed with device identity required; no live Gateway activity was fabricated.

2026-05-03 Stitch Operator Shell Integration

• Integrated the approved Stitch visual direction as native React/CSS: a visible OpenClog operator top bar, safe Journal/Command/Network/Logs focus navigation, utility controls, local deterministic operator avatar, fixed 280px left rail, fluid center, 360px diagnostics rail, and structural dividers.
• Preserved the existing 27 theme IDs, token-driven theme family architecture, three-pane information model, grouped/raw timeline, newest-first ordering, diagnostics visibility, approval semantics, composer behavior, Gateway boundaries, and local-first data flow.
• Rebuilt the Stitch direction without importing raw generated HTML, Tailwind CDN scripts, Google fonts, Material Symbols, remote profile images, or external assets.
• Added tests for safe shell navigation, operator shell proportions, local-only asset usage, and source-level remote Stitch asset leakage.
• Refactored the shell after the first green verification pass by extracting the operator avatar/header helpers and deduplicating top-bar button rendering.
• Refreshed desktop and mobile visual snapshots for every selectable theme after comparing representative screenshots with the Stitch references.
• npm run verify passed after implementation, snapshot refresh, and refactor; coverage remained 100% statements, branches, functions, and lines for the configured coverage targets.
• npm run verify:gateway failed closed with device identity required; no live Gateway activity was fabricated or marked green.

2026-05-03 Stitch Fidelity Correction

• Corrected the Stitch integration after visual review found the first pass too structurally themed and not close enough to the mockups.
• Tightened the shell toward the Stitch reference: 56px flat top bar, uppercase navigation, grouped operator rail shortcuts, larger journal-entry composer, constrained 800px center measure, and denser right diagnostics rail.
• Adjusted flagship surfaces so Blackbeard's Log uses a light operator/header shell with a dark diagnostics rail, Captain's Log uses dark operator-console chrome, and core/accessibility themes keep the flat light operator shell.
• Kept this as a frontend presentation pass only; no backend, Gateway, permission, composer forwarding, approval semantics, persistence, API, or delivery behavior changed.
• Added a browser fidelity regression for Stitch shell vocabulary and flagship rail colors, then refreshed all 54 desktop/mobile visual snapshots.
• Fixed the mobile Pending approvals review panel placement so the Stitch-style approval surface remains actionable on narrow viewports.
• Final npm run verify passed on the logged tree; npm run verify:gateway failed closed with device identity required.

2026-05-03 Gateway Device Auth And Shell Shortcut Fix

• Added backend-only OpenClaw device-identity authentication for the Gateway handshake, including challenge handling, v3 payload signing, connect-frame redaction, and classified verifier failures.
• Kept Gateway token ownership in the backend and continued requesting only operator.read, operator.write, and operator.approvals; no browser credential, secret, pairing, or admin surface was added.
• Fixed inert-looking shell controls: family shortcuts now select the default theme for Core, News, Social, OS, and Accessibility; Network, Monitors, and Security focus their corresponding diagnostics; settings and filter icons announce the focused control.
• Refactored the shortcut wiring into focused shell-target handlers and diagnostics refs while preserving presentation-only theme switching and existing Gateway/composer/approval behavior.
• Refreshed desktop/mobile visual snapshots after confirming the family shortcut chrome remained readable and diagnostics/status chips stayed visible.
• The first final live probe timed out waiting for connect.challenge; openclaw gateway restart restored the local Gateway listener before the final live probe.
• Live npm run verify:gateway passed after device auth, reaching hello-ok and probing health, presence, approval list, session list, and session subscriptions without mutation testing.

2026-05-03 Theme Intent Realignment And Contrast Pass

• Realigned the existing 27 themes to the user-provided intent table without adding themes, changing behavior, or cloning proprietary trade dress.
• Added presentation-only theme intent metadata: practical group, generic inspiration, OpenClog design intent, and interaction emphasis.
• Replaced the selector grouping with practical groups: Core Daily Modes, Narrative / Character Modes, News / Analysis Modes, Social / Feed Modes, and OS / Console Modes.
• Retuned theme tokens and archetype CSS so themes read as daybook, operations console, accessibility mode, narrative journal, news/analysis desk, social feed, desktop shell, or terminal instead of collapsing into one visual family.
• Improved non-accessibility theme contrast across shell text, side rails, archive metadata, status chips, placeholder text, dark/sidebar-heavy themes, and disabled/inactive surfaces.
• Tightened Dyslexia Friendly spacing, line-height, selector width, diagnostics card flow, mobile stacking, and 200 percent zoom behavior.
• Refactored the theme/style pass into token-driven metadata and CSS data attributes: data-practical-group and data-interaction-emphasis; no backend, Gateway, permission, composer, approval, persistence, API, or delivery behavior changed.
• Refreshed all 54 desktop/mobile Playwright visual snapshots after representative inspection of Blackbeard's Log, Clog News, Clog News Network, Clog-Net, Clogbuntu, Cloginal, Accessibility Dark, Dyslexia Friendly, and mobile OpenClog Journal.
• Final deterministic verification and live Gateway verification passed after the log update; live mutation testing remained disabled.

2026-05-03 Durable Gateway Connection

• Fixed the recurring stale Gateway condition by replacing the one-shot backend socket lifecycle with a resilient live Gateway manager.
• The root cause was an OpenClog API process surviving an OpenClaw Gateway restart: the existing socket marked itself stale/degraded but never reconnected, while fresh live verifier connections succeeded.
• The backend now reconnects automatically after socket close, socket error, heartbeat/request timeout, sequence gap, or startup unavailability; every reconnect re-reads Gateway token and device identity, signs a fresh connect challenge, validates hello-ok, and reruns the reconnect subscription plan.
• Added guarded backend-only auto-restart for the local loopback LaunchAgent after repeated eligible reconnect failures; it is cooldown-bound, macOS/loopback-only, and never runs for token mismatch, missing device identity, pairing-required, missing-scope, or remote Gateway failures.
• Added safe public health fields for reconnect status, last connection/disconnection times, last error reason, next reconnect, reconnect attempt, and redacted service-recovery summary.
• Added visible UI copy for reconnecting/stale service recovery states without adding admin, pairing, config, secret, or broad-scope controls.
• Refactored timeout handling so connect-timeout failures are counted once, while ordinary request timeouts still stale the socket and schedule recovery.

2026-05-04 Phase 1 Quick Wins Hardening

• Implemented the Quick Wins as a bounded tranche: API/view-model changes first, then frontend wiring, then helper extraction, then verification and docs.
• Pulled the new operator-surface logic out of apps/web/src/App.tsx into apps/web/src/state/operator-workspace.ts so validation, stale-summary checks, URL safety classification, reconnect trend text, and empty-state decisions are unit-testable without rendering the full shell.
• Kept the route-state refactor narrow by extending apps/web/src/hooks/useJournalRouting.ts with URL-backed q= search state instead of introducing another state container.
• Tightened the operator workflow by blocking pinned-context saves on invalid summary text, adding a clear-filters affordance, and routing the incident bundle copy action through the existing export path rather than duplicating serialization logic.
• Preserved additive schema/domain growth already underway in the repo and extended tests around it rather than trying to collapse Phase 2-4 into a single speculative rewrite.

2026-05-04 Phase 2 Domain And Lifecycle Tranche

• Added the new @openclog/app workspace package and drove it from failing tests first before wiring the API to it.
• Kept the first application-layer cut narrow and useful: stable cursor pagination, retention snapshot/apply/rollback, alert acknowledgement/snooze state, integration payload pass-through, and replay bundle inspection.
• Corrected the package integration at the workspace level with a real npm install refresh so @openclog/app resolves as a package in tests and tsc -b, instead of leaving brittle cross-package source imports in place.
• Let the full verify gate find the schema-ordering regression before touching the logs, then fixed the canonical table-name order and reran the full gate from scratch.

2026-05-04 Ladder 1 Investigation Acceleration Slice

• Extended the existing search lane instead of replacing it: /api/search now preserves cursor pagination and adds sanitized matchSnippet plus matchFieldHints, while the web workbench adds saved search presets and explicit load-more behavior.
• Added operator-facing review helpers in the current shell: sanitized session-summary copy, bundle-manifest preview before offline review/copy, generated-summary freshness detail, and inline empty-state actions for incidents, alerts, and adapter-driven offline review.
• Added bounded Gateway diagnostic enrichment without widening authority: a redacted last-error category, repo-derived recent health-history entries, and keyboard search focus that behaves as a true global operator shortcut.

2026-05-04 Ladder 2 Incident Workspace Slice

• Continued the roadmap with the next bounded tranche instead of jumping to native/plugin surfaces: persistent investigation notes, incident workspace retrieval, replay-bundle diffing, and an end-of-day closeout planner are now implemented across packages/app, the API, SQLite persistence, and the web workbench.
• Added a dedicated investigation-note artifact path backed by journal_investigation_notes, keeping operator-authored notes distinct from pinned context and generated summaries.
• Promoted more operator workflow logic into @openclog/app: incident workspace assembly, replay-bundle diffing, investigation-note lifecycle, and closeout-plan construction now live behind the shared application seam rather than inside Fastify handlers.
• Kept the tranche additive and fail-closed: new surfaces operate on stored redacted evidence, not live raw Gateway payloads, and the browser still receives only bounded, sanitized view models.

2026-05-04 Full Improvement Tranche Closeout

• Completed the next operator tranche on top of the existing dirty implementation rather than cherry-picking only fresh edits: the workbench now ships eight default investigative search presets, per-day evidence-completeness badges, API route/payload copy controls, local note confirmation, and replay-bundle diff classifications.
• Corrected global keyboard commands away from plain Shift+letter chords; command shortcuts now use Alt+E, Alt+A, Alt+T, Alt+C, and Alt+S so operators can still type capital letters in text fields.
• Kept the refactor boundary practical: shared behavior lives in @openclog/app, core display/types, repository helpers, and frontend state helpers while Fastify routes stay mostly as API adapters.
• Refreshed deterministic visual baselines after the archive badge and workbench control changes, and added .gitignore coverage for repo-local cache/build output that should not be committed as source.

2026-05-05 Workbench Execution Lanes

• Implemented this as a narrow web-workbench activation over existing backend contracts rather than adding new application routes.
• Added client wrappers for retention apply/rollback and alert acknowledge/snooze, then kept React mutation handlers fail-closed: successful actions refetch authoritative data; failed actions leave existing state untouched and report explicit local notices.
• Continued the frontend refactor by moving retention impact, alert-state classification, snooze calculation, replay-step formatting, correlation formatting, and workbench-copy redaction into apps/web/src/state/operator-workspace.ts.
• Expanded the fixture-driven browser lane so lifecycle execution, per-finding alert controls, and replay/correlation inspection are tested as operator workflows instead of helper-only behavior.

2026-05-08 Monitoring Import And Capability Registry

• Added a local, explicit monitoring-import flow for newsletter-monitoring.md style Gmail, blogwatcher, and OpenClaw triage decisions, turning bullets into redacted investigation notes, incident summaries, handoff packets, pinned context, and delivery payload context.
• Added capability registry manifests for incident actions, delivery targets, plugins, and governance surfaces with purpose, version, permissions, failure modes, audit provenance, approval signature, and review or expiry gates before live use.
• Kept the new lanes fail-closed: monitoring imports require explicit local confirmation, malformed capability manifests block execution, incident action buttons surface registry state, and delivery/plugin routes translate blocked capabilities into bounded API errors.
• Refactored capability error handling in the API, moved registry and monitoring-import logic into @openclog/app, extended the SQLite schema and Drizzle schema list, and refreshed mobile visual baselines for the new operator panels.
• Verification passed with npm run verify after the visual refresh, keeping configured coverage at 100% statements, branches, functions, and lines; npm run verify:gateway also passed against the live Gateway with mutation testing disabled; npm run verify:desktop-native passed the desktop-native cargo tests.

2026-05-09 Process Swarm Compatibility Closeout

• Kept Process Swarm heartbeat ingestion on the existing POST /api/investigation-notes path; no OpenClog API route change was needed.
• Reconciled the local install lockfile with the workspace manifests through npm ci.
• Repaired local iCloud path handling in Vite and Vitest aliases by using decoded fileURLToPath(...) workspace paths.
• Ordered the root build so shared core, app, API, web, and desktop packages build in dependency order before the desktop app checks for the web bundle.
• Raised the visual snapshot pixel-diff allowance for full-page browser captures after verification showed tiny rendering drift, not layout or content regression.

2026-05-09 Operations Report Follow-Through

• Kept this tranche additive over the current dirty main tree instead of peeling off a fresh branch, because the existing shell work and visual state were already the right base for the report implementation.
• Moved the new report behavior through the shared seams first: contracts in @openclog/core, composition in @openclog/app, repository/api integration in apps/api, then browser wiring in apps/web.
• Let targeted tests and the Chromium workbench spec be the first authority before attempting broader repo gates, so the UI glue, fixture contract, and retry/report affordances were correct before touching the larger verification chain.