Converge Newsletter, Calendar, and Mailing Export presentation

Status: blocked pending final verification — immutable user-authorized checkpoint 65fb9a8392ed76cc55e74a9b783e352914169411 with PM identity amendment approved; final quiescent preflight/full gate and fresh Designer, Tester, and PM gates remain pending; local, unpushed, and unshipped
Tags: enhancement, portal, frontend, testing, design, P1
Parent: #162, Wave A slice 5
Depends on: satisfied for implementation — accepted local commits #218 0c89588df809b2e84af02e796d1910a25eea0165, #219 9d204d208820e3d842a3d3fc83493c230bcadaa5, #220 d334020ca5a582d31a81b371988169cab4e7f6b2, and #221 8c3b110c8aa138d95385a89fe3328749bdf47250; checkpoint 65fb9a8 is based on that exact chain
Blocks: the #162 final integrated design-system audit for these three surfaces
Next owner: Software Engineer — only after the documented host process, port, resource, and retained 30-second network-quiescence prerequisites are demonstrably satisfied, execute the approved final protocol exactly
Resume condition: the host is demonstrably free of other-worktree Playwright/Chromium activity, required ports are free, resource checks pass, and the retained 30-second network observation is empty; then use immutable checkpoint 65fb9a8392ed76cc55e74a9b783e352914169411 without source or evidence drift

Product outcome

Make Newsletter, Calendar, and Mailing Exports read as one chronological planning and recovery workflow without changing their domain contracts.

Newsletter is an earliest-first publication plan with stable grouping and a clear next item.
Calendar remains an intentional desktop month/week calendar and becomes a true one-column date agenda on mobile.
Newsletter overlays and source outages remain explicit without hiding successful Calendar or Newsletter data.
Mailing Export cards name the existing safe next action precisely: wait/check status, retry, fix authorization before retrying, repair another named prerequisite, or download the completed private ZIP.

This is a presentation and evidence slice over the existing TypeScript frontend. It must preserve the accepted #108 Mailing Export product and #134 Europe/Berlin operator-day contract. It does not authorize provider execution, an API/data expansion, or a redesign of unrelated surfaces.

Frozen baseline and dependency reconciliation

The PM inventory was performed read-only at clean baseline 78e91223203aa54376a318fd1a3214ce0242e0c3.

That baseline already contains and this slice must preserve:

Restore behavior-based browser coverage and fix canonical UI accessibility races #180's accepted focus, refresh, dialog, diagnostics, fixture-isolation, and behavior-based browser foundations.
Finalize the canonical scan-first Operations Home #161's accepted shell/Home composition, route/history/focus behavior, responsive tokens, and source/SAM evidence contract.
Reconcile and close one Europe/Berlin business date #134's closed canonical Europe/Berlin operator-day behavior: Calendar starts/returns to the injected todayIsoDate(), Newsletter derives its default range from that day, and an absent Mailing run uses that day as its run key.
Automate private Mailchimp account exports and attach them to recurring work #108's accepted provider-neutral request/poll/download flow, durable run identity and idempotency, one-provider-export restrictions, private retained archive, Artifact/Task linkage, authenticated five-minute download, sanitized failures, and no-secret/no-contact/no-storage-identity portal boundary. Automate private Mailchimp account exports and attach them to recurring work #108's remaining HUMAN provider acceptance is not part of this slice.

#218 is not disjoint. It owns shared page-header, section, action-row, form, semantic-status, honest-state, responsive, and evidence convergence in:

frontend/src/styles.css
frontend/src/surfaces/planning.js
frontend/src/surfaces/finance/mailing.js
frontend/test/planning-surface.test.mjs
frontend/test/finance-surface.test.mjs
canonical capability/browser paths and synthetic screenshots

Therefore #222 implementation starts after #218's accepted exact commit. If another accepted branch is integrated first, reconstruct from the reviewed containing SHA, repeat the pre-edit criterion inventory, retain only still-unmet gaps, and send the reconstructed fingerprint through Designer, Tester, and PM. Do not resolve overlap by reverting, absorbing, or silently restyling dependency-owned behavior.

Criterion-to-current-source inventory at `78e9122`

Product criterion	Classification	Current source/test evidence	Bounded #222 responsibility
One canonical frontend, routes, shell, focus/history, tokens, and shared state presentation	Already compliant / dependency-owned	#180/#161 are in the baseline; `frontend/src/styles.css` contains the accepted token, focus, theme, density, and overlay vocabulary. #218 now owns primitive convergence.	Consume #218's accepted primitives. Do not alter shell IA, routing, account/team scope, or reintroduce route-local primitive duplication.
One Europe/Berlin operator day	Already compliant; preserve exactly	`planning.js` receives `todayIsoDate`; Calendar cursor/Today, Newsletter default bounds, and `mailing.js` absent-run key use it. `work-model`, Planning, Finance, and canonical browser tests cover the boundary. #134 is closed.	No new date resolver, timezone rule, backend timestamp change, or date library. Keep all current #134 tests green.
Newsletter chronological plan	Substantially compliant with one concrete determinism/evidence gap	`planning.js` groups by month or ISO week and sorts by `publicationDate`; rows use semantic `<time>`, human booking labels, status text, filters, alerts, native dialog, validation/conflict retention, and safe campaign links. Unit and browser suites cover grouping, mutation, conflict, empty/failure, mobile overflow, themes, and Axe. Current tests do not prove out-of-order same-date input produces a stable operator order or that the earliest actionable slot remains first across grouping/filter changes.	Define one earliest-first presentation order independent of API order: publication date, then stable human campaign label, then stable record identity only as a non-visible tie-breaker. Preserve grouping, filters, mutation contracts, booking labels, statuses, links, and #134 bounds. Add behavior evidence for shuffled records and filter/group changes.
Newsletter refresh failure after useful data	Concrete honest-state gap	`load()` replaces the schedule with `Newsletter schedule unavailable` and says to reopen; there is no in-surface Retry control. Existing tests prove initial failure and recovery via changing a filter, not preservation of a previously useful schedule.	On a later GET failure, keep the last confirmed schedule visible as stale/read-only context, identify Newsletter as unavailable, and provide one connected `Retry newsletter schedule` control that repeats the current query. On initial failure show no synthetic rows. Do not retain failed mutation as success; dialog values/conflict behavior remain unchanged.
Desktop Calendar month/week planning	Already compliant; preserve	`planning.js` renders deterministic Monday–Sunday month/week grids, ISO weeks, filters, layer toggles, holidays, activities, overlays, alerts, semantic dates, create/edit/conflict, and Today navigation. Unit, `calendar-seams`, canonical capability, and design suites cover these contracts.	Keep desktop month/week grid, dates, layers, alert dismissal, mutations, and #134 clock behavior unchanged.
Mobile Calendar agenda	Concrete gap	At `<=820px`, late CSS renders each week as seven `112px` columns with `overflow-x:auto`; the UI instructs operators to swipe horizontally. `planning-surfaces-design.spec.js` is titled “one-column agenda” but explicitly asserts the horizontal strip.	At 390×844, render the selected period as one chronological vertical agenda of date rows. Each meaningful day exposes its date, activity/holiday/newsletter items, and state in reading order; empty days may be compact but dates and controls remain reachable. No horizontal day strip, hidden off-screen action, or page-level overflow. Desktop remains a grid.
Newsletter overlay success	Already compliant; preserve	Calendar independently requests `/overlays`, renders linked Newsletter items, allows the layer to be toggled, and canonical real-server evidence covers `calendar.overlays-alerts`.	Preserve real overlay links, toggle behavior, chronology, and safe labels. Do not duplicate Newsletter records or create a second source.
Overlay unavailable while Calendar succeeds	Partially compliant with a concrete recovery/ownership gap	`Promise.allSettled` keeps Calendar items when the overlay request fails and appends terse text to the shared status. The layer remains checked, no source-owned unavailable block or retry action appears, and existing browser behavior does not prove recovery without reloading the whole route.	Keep Calendar activities/holidays usable, mark only Newsletter dates unavailable adjacent to the layer/calendar decision, never imply zero overlays, and provide one `Retry newsletter dates` action that retries the existing overlay request/range. Recovery removes the warning and restores overlays without duplicating Calendar records.
Full Calendar refresh failure	Concrete honest-state gap	The catch path clears `items`, `holidays`, and `overlays`, replaces the grid, and says `Reopen Calendar to retry`, although `calendar.failure` describes preserved successful data. Existing browser recovery uses Today/reload rather than an explicit recovery control.	Initial failure shows no invented records. A later failure preserves the last confirmed calendar as stale/read-only context, names Calendar as unavailable, retains the selected period/filter/layers, and offers one connected `Retry calendar` action. Recovery updates once without duplicate records or mutations.
Mailing Export durable behavior and privacy	Already compliant; preserve exactly	`mailing.js`, Finance tests, canonical real-server capability evidence, and accepted #108 behavior cover no-config, empty, pending, failed, completed, history pagination, deterministic run keys, one logical run, sanitized errors, Artifact linkage, and authenticated short-lived download.	No provider/service/API/persistence/configuration/security change. No provider call during implementation/review. Preserve no-secret/no-contact/no-storage-identity output and all #108 tests.
Mailing next-action explanation	Already present but not precise enough	`actionCopy` distinguishes `wait`, `retry`, `fix-authorization`, `fix-storage`, `fix-task-link`, and `download`. It also prints raw lower-case states/error codes and every non-completed run exposes the same `Advance / retry` button, obscuring whether the operator should wait, retry, or repair authorization first.	Render human state labels and one unambiguous next-action heading/instruction. Map the existing server `nextAction` to precise visible controls without changing which existing endpoint is invoked or its durable run key. Remove the combined `Advance / retry` label.
Wait / Retry / Fix authorization / Download language	Concrete gap	Pending runs say to wait but still show `Advance / retry`; failed authorization/storage/task-link states share the same button; completed uses `Download ZIP` while explanatory copy alone mentions privacy/expiry.	Required labels/meaning: `Check status` for `wait` (same durable run; no claim of a new export), `Retry export` for `retry`, `Retry after authorization is fixed` for `fix-authorization`, equivalent named repair-first labels for storage/task-link states, and `Download private ZIP` for `download`. Completed cards expose no start/advance action. Copy states that the download is authenticated and expires in five minutes; it never implies the browser has already downloaded or that provider work succeeded before authoritative completion.
Mailing history chronology and honest pagination	Already compliant; preserve	`sortedRuns()` orders newest request first with stable ID tie-break; pagination retains loaded history on later-page failure and offers retry.	Keep ordering, loaded records, continuation, and error behavior. Presentation may consume #218 primitives only.
Durable capability and source/SAM evidence	Machinery already compliant; candidate evidence gap	`frontend-capabilities.json` already defines all Newsletter, Calendar, and Mailing Export states. `canonical-capability-behavior.spec.js` emits real-server evidence; build/SAM parity machinery exists. Intercepted legacy/design specs are useful regression/visual fixtures but are not core behavior proof.	Reuse existing IDs; do not change #159 schema or add style-only capability IDs. Extend behavior assertions so the existing states prove current mobile agenda, partial/unavailable recovery, and exact mailing next-action semantics. Prove changed source, `backend/dist`, and SAM assets are identical.

Scope

Start from Converge Wave A surfaces on bounded shared UI primitives #218's exact accepted commit or reviewed containing SHA and post a refreshed version of the inventory above before editing.
Preserve already-compliant Newsletter, Calendar, Mailing Export, Automate private Mailchimp account exports and attach them to recurring work #108, Reconcile and close one Europe/Berlin business date #134, Restore behavior-based browser coverage and fix canonical UI accessibility races #180, Finalize the canonical scan-first Operations Home #161, and Converge Wave A surfaces on bounded shared UI primitives #218 behavior.
Implement only the concrete presentation/recovery gaps: deterministic Newsletter chronology, retained useful data with explicit retry, desktop Calendar/mobile agenda, overlay-specific unavailable recovery, and precise Mailing Export next-action language.
Add focused production-module tests, one dedicated real-server Converge Newsletter, Calendar, and Mailing Export presentation #222 browser journey, updates to existing regressions whose old mobile/action assumptions are intentionally replaced, and existing durable capability/source-SAM evidence.
Complete Designer → independent Tester → PM acceptance on one frozen fingerprint before commit.

Bounded write set

Production files:

frontend/src/surfaces/planning.js
frontend/src/surfaces/finance/mailing.js
frontend/src/styles.css

Focused tests/evidence:

frontend/test/planning-surface.test.mjs
frontend/test/finance-surface.test.mjs
backend/e2e/issue-222-planning-presentation.spec.js (new)
backend/e2e/canonical-capability-behavior.spec.js
backend/e2e/planning-surfaces-design.spec.js
backend/e2e/calendar-seams.spec.js
backend/e2e/newsletter-production-portal.spec.js

A newly required production or test path needs a PM amendment before editing. Do not edit backend/e2e/frontend-capabilities.json, capability reporter/schema machinery, backend routes/services/models, infrastructure, provider adapters, or configuration. Existing intercepted specs remain regression/visual checks only; the dedicated and canonical real-server journeys are the behavior authority.

Acceptance criteria

Newsletter chronology and recovery

Newsletter records render earliest publication first regardless of API order, grouped by the selected month/week with a stable same-date tie-break; filter/group changes preserve that chronology.
Semantic <time datetime> values, human campaign/booking labels, statuses, alert language, public campaign links, Add/Edit dialog, validation/conflict value retention, and Reconcile and close one Europe/Berlin business date #134 date bounds remain unchanged.
Initial Newsletter failure invents no records. A refresh failure after success preserves the last confirmed schedule as visibly stale/read-only context, identifies the unavailable source, retains current filters, and exposes one connected Retry newsletter schedule control.
Retry repeats the current query once, removes the stale/unavailable state on success, and neither duplicates rows nor performs a mutation.

Calendar desktop, mobile agenda, and source honesty

At 1440×900, Calendar retains the intentional seven-column month/week grid, Monday–Sunday/ISO-week semantics, activity filter, layer controls, holiday/activity/Newsletter distinctions, alert dismissal, and create/edit dialog.
At 390×844, the selected month/week is a one-column chronological agenda—not a horizontally scrolling seven-day strip. Dates, relevant items, status, and links follow DOM reading order; there is no hidden horizontal day content or page overflow.
The first meaningful current/next agenda date and its first item or honest empty decision are visible in the initial viewport after the page heading and compact controls. All controls and linked/actionable agenda items are at least 44×44 CSS pixels.
Overlay failure preserves successful Calendar activities/holidays, clearly labels only Newsletter dates unavailable, never presents zero as authoritative, and provides Retry newsletter dates for the same range.
Initial Calendar failure invents no records. A later Calendar refresh failure retains the last confirmed period as visibly stale/read-only context with selected view/filter/layers and a connected Retry calendar action.
Successful retries replace state once, remove the associated warning, restore overlays/calendar data without duplicates, and preserve Today/previous/next/week/month behavior under the Reconcile and close one Europe/Berlin business date #134 Berlin day.
Existing Calendar/Newsletter mutation, validation, conflict, dialog, route, focus, and history contracts remain unchanged.

Mailing Export next-action language

The existing server status and nextAction remain authoritative; no browser-only lifecycle or guessed provider success is introduced.
Human state labels and action instructions never expose raw enum/reason-code/storage/provider/credential identity as routine operator copy.
wait shows that the same durable run is still pending and labels its existing safe action Check status; it never claims a new export was requested.
retry labels the existing action Retry export and retains the same durable run key.
fix-authorization says authorization must be repaired through the approved external mechanism and labels the existing action Retry after authorization is fixed. Storage and Task-link repairs receive equally precise repair-first labels; no portal control claims to repair credentials, storage, or Task configuration itself.
download appears only for an authoritative completed run with an Artifact and is labeled Download private ZIP; nearby copy states that the authenticated link expires in five minutes. The UI claims preparation/success only after the existing download API succeeds.
Completed cards have no start/check/retry control; empty cards retain Start daily export; no-config remains non-actionable; later-page failures retain loaded history and precise retry.
All Automate private Mailchimp account exports and attach them to recurring work #108 privacy, idempotency, provider-limit, Artifact/Task relationship, controlled-download, and safe-failure tests remain green. No test or review calls an external provider.

Responsive, visual, and accessibility

At 1440×900 each surface has one dominant heading, adjacent description, content-width action hierarchy, and its first chronological decision visible without duplicated status/card chrome.
At 390×844 filters/actions/forms wrap in DOM order, dialogs remain within the viewport, controls meet 44×44, and there is no clipping, overlap, inaccessible off-canvas content, or page-level horizontal scrolling.
One owned page-heading contract, correctly nested period/date/history headings, semantic list/article/time/status/alert/dialog structure, native labels, and meaningful accessible names are retained.
Loading/progress uses role=status; blocking unavailable/mutation failure is announced; partial failure keeps successful content and names only the failed source. Status and next action are not conveyed by color alone.
Keyboard operation, visible focus, dialog containment/restoration, retry focus, 200% zoom, light/dark token hierarchy, and reduced-motion behavior remain intact.
Automated scans report zero critical/serious WCAG A/AA findings for every captured changed state.

Behavior, privacy, and parity

The engineer freezes HEAD plus binary diff, status, and candidate-content fingerprints before review; Designer, Tester, and PM use the same fingerprint.
A real local TypeScript server journey creates only synthetic records through normal authenticated APIs and exercises Newsletter chronology/recovery, Calendar desktop/mobile/overlay/full-failure recovery, and all Mailing next-action states without request interception for core behavior.
Deterministic local fault/provider-simulator controls may produce unavailable/run states, but there are no external provider calls, fixed sleeps, test-order dependencies, broad 404 swallowing, source-string assertions, incidental copy/whitespace pins, screenshot assertions, or screenshot goldens.
The normal full Playwright run emits passing evidence for every existing Newsletter, Calendar, and Mailing Export capability state and role; responsive-only assertions complement rather than replace durable state evidence.
Source, backend/dist, and packaged SAM frontend assets are identical for every changed asset; the normal source/SAM parity run accounts for all existing capability evidence and screenshots.
Fixtures, logs, screenshots, and comments contain only synthetic public-safe data: no provider execution, contact/audience data, production/private records, credentials, signed URLs, storage identity, private links, or operational artifacts.

Test scenarios

Shuffled Newsletter chronology

Given shuffled synthetic slots spanning month/week boundaries, including same-date records
When Newsletter loads and the operator switches grouping and filters
Then each visible group and row remains earliest-first with the documented stable tie-break, semantic dates and status stay correct, and the first actionable slot is not displaced by response order

Newsletter refresh outage and recovery

Given a confirmed visible schedule and current filters
When the next list request fails through the deterministic local fault seam
Then the prior schedule remains visibly stale/read-only, Newsletter alone is named unavailable, no false empty state appears, and Retry newsletter schedule repeats the same query once
When the fault clears
Then fresh rows replace the stale state once without duplication

Desktop Calendar and mobile agenda

Given synthetic activities, holidays, alerts, and linked Newsletter overlays across several dates
When Calendar opens at 1440×900 and then 390×844
Then desktop uses the existing month/week grid while mobile uses one chronological agenda in DOM order, the first meaningful date/item is visible, and there is no horizontal day strip or page overflow

Independent overlay outage

Given Calendar data succeeds and Newsletter overlays fail
When the period settles
Then activities and holidays remain usable, the overlay layer says Newsletter dates are unavailable rather than empty, and Retry newsletter dates restores links for the same range without re-creating Calendar records

Calendar refresh outage

Given a successful populated period and selected view/filter/layers
When a later Calendar request fails
Then the last confirmed period remains visibly stale and read-only with an announced Retry calendar action
When retry succeeds
Then the current period refreshes once, retained controls remain selected, and no record or mutation is duplicated

Exact Mailing next actions

Given synthetic no-config, empty, waiting, retryable failure, authorization failure, storage failure, Task-link failure, and completed runs returned by the normal local server/provider simulator
When the operator scans each card and invokes the available safe action
Then visible labels distinguish Start, Check status, Retry export, repair-first retries, and Download private ZIP; each existing action uses the same durable run key/endpoint, completed has no run action, and no secret/provider/storage identity appears

Source/SAM identity

Given the frozen accepted source candidate and a clean SAM build
When the same routes and existing durable states run from source and packaged targets
Then behavior evidence agrees, changed assets are byte-identical, and every expected source/SAM record is accounted for

Synthetic screenshot inventory

Capture exactly these 12 untracked native-size PNGs under .tmp/screenshots/issue-222/; delete stale extras before review:

01-newsletter-chronological-ready-desktop-1440x900.png
02-newsletter-chronological-ready-mobile-390x844.png
03-newsletter-retained-unavailable-desktop-1440x900.png
04-newsletter-retained-unavailable-mobile-390x844.png
05-calendar-overlay-ready-desktop-1440x900.png
06-calendar-overlay-ready-agenda-mobile-390x844.png
07-calendar-overlay-unavailable-desktop-1440x900.png
08-calendar-overlay-unavailable-agenda-mobile-390x844.png
09-mailing-wait-retry-fix-auth-desktop-1440x900.png
10-mailing-wait-retry-fix-auth-mobile-390x844.png
11-mailing-completed-download-desktop-1440x900.png
12-mailing-completed-download-mobile-390x844.png

Use the normal local server, deterministic local faults/provider simulator, and synthetic public-safe records. Tester and Designer inspect every image at native resolution for chronology, first-decision visibility, grid-versus-agenda behavior, state/action ownership, exact safe language, focus cues, target sizing, theme/contrast, overflow, clipping, overlap, and private-data leakage. Screenshots are visual evidence only: do not commit or publicly attach them, and do not use them as behavior/parity proof.

Required verification

Engineer may use focused commands while iterating. Independent Tester runs the complete relevant workflow on one frozen candidate and records commands, exit codes, observed counts, behavior titles, capability-state accounting, artifact/evidence paths, and every intentional skip:

node --test frontend/test/planning-surface.test.mjs frontend/test/finance-surface.test.mjs
npm run test:frontend:unit
npm run test:frontend:coverage
npm --prefix backend test
npm --prefix backend run typecheck
npm --prefix backend run build
node backend/scripts/verify-frontend-artifact.mjs --source frontend --artifact backend/dist
npm --prefix backend run test:e2e -- e2e/issue-222-planning-presentation.spec.js e2e/canonical-capability-behavior.spec.js e2e/planning-surfaces-design.spec.js e2e/calendar-seams.spec.js e2e/newsletter-production-portal.spec.js --retries=0
npm --prefix backend run test:e2e
npm --prefix backend run test:e2e:frontend-parity
make sam-validate
make sam-build
node backend/scripts/verify-frontend-artifact.mjs --source frontend --artifact .aws-sam/build/BackendFunction
make ci
git diff --check

The dedicated #222 spec must be part of the normal full Playwright run. Existing canonical capability evidence remains authoritative for durable state IDs. Intercepted Calendar/Newsletter regression/design specs do not substitute for the real-server journey.

Lifecycle gates

No HUMAN gate is required for this local, synthetic, provider-free presentation slice. #108's separate real-provider HUMAN gates remain untouched and do not block local #222 implementation/review after #218.

Out of scope

Provider execution, provider credentials/configuration, production/private data, real audiences/contacts, signed downloads, archive inspection, or Automate private Mailchimp account exports and attach them to recurring work #108's HUMAN acceptance/disposal of the legacy flow.
Imports, restores, migration frameworks, dry runs, data movement, new exports, provider adapter/service changes, API routes/shapes, backend models, persisted fields, DynamoDB, S3, Secrets/Dapier, IAM, SAM/CloudFormation, schedules, or deployment changes.
Home, shell IA, global navigation, account/team identity, Admin/Users/Settings, notifications, mobile drawer, Show signed-in identity and authorized teammates’ Task/Card work #164 authorization/work scope, or Make assistant output review safe and lifecycle-complete #158 Assistant/Artifact lifecycle.
Changing Calendar/Newsletter domain lifecycle, Reconcile and close one Europe/Berlin business date #134 date semantics, Automate private Mailchimp account exports and attach them to recurring work #108 idempotency/privacy/provider-limit behavior, Task/Card relationships, or download authorization.
Broad CSS rewrite, stylesheet split, framework/component library, second router/runtime, new token vocabulary, compatibility aliases, or dual old/new behavior.
Raw operational knowledge, private links/identifiers, tracked screenshots, screenshot goldens, generated design boards, provider logs, or source-repository edits.

PM GROOMED — agent-ready, dependency-serialized Wave A planning/export slice

I completed a read-only criterion-to-current-source/test inventory at clean baseline 78e91223203aa54376a318fd1a3214ce0242e0c3, reconciled the accepted #180/#161 foundations, closed #134 Europe/Berlin behavior, accepted #108 Mailing Export behavior, parent #162, and active shared-primitives child #218.

The bounded concrete gaps are:

stable earliest-first Newsletter presentation independent of API order;
retention and explicit retry of a previously useful Newsletter schedule after a refresh outage;
replacement of Calendar's mobile horizontal seven-day strip with a true one-column agenda while preserving the desktop month/week grid;
source-owned Calendar/Newsletter-overlay unavailable states that retain successful data and recover through explicit retries;
precise Mailing Export Wait/Check status, Retry, Fix authorization/other repair-first, and Download private ZIP language mapped to the existing server nextAction, endpoint, and durable run key.

The spec freezes route/API/data/auth/lifecycle behavior, #108 privacy/idempotency/provider limits, and #134 date semantics. It excludes provider execution, production/private data, imports/restores, API/data/infrastructure expansion, Home/shell/account/team identity, #164 authorization, #158 lifecycle work, and broad CSS rewrites.

#222 is agent-ready but implementation-blocked on #218 because both own planning.js, mailing.js, shared styles, focused tests, canonical capability evidence, and screenshots. The Orchestrator must record #218's accepted exact commit or reviewed containing SHA, serialize writers, and require the Software Engineer to refresh the inventory before editing.

The issue now includes the bounded write set, desktop/mobile/accessibility/honest-state criteria, exactly 12 synthetic screenshots, real-server behavior and existing capability/source-SAM evidence, exact verification commands, and full Designer → Tester → PM → commit → merge/push → On-Call gates.

Labels are enhancement, portal, frontend, testing, design, and P1; needs grooming was removed because the issue is self-contained and ready once its explicit dependency gate is met.

No repository file, worktree, commit, push, deployment, provider, production/private-data, or HUMAN action was performed.

Next owner: Orchestrator after #218 acceptance; record exact start SHA/writer order, then assign Software Engineer for the refreshed pre-edit inventory.

ORCHESTRATOR START — accepted containing baseline and writer order

Issue #222 starts from exact accepted #221 commit 8c3b110c8aa138d95385a89fe3328749bdf47250 (tree 5a63d7b4f34ff9281bd4aeb576fa9b7693902ec4). This reviewed containing baseline includes accepted #218 commit 0c89588df809b2e84af02e796d1910a25eea0165, #219 commit 9d204d208820e3d842a3d3fc83493c230bcadaa5, #220 commit d334020ca5a582d31a81b371988169cab4e7f6b2, and #221.

Project-local worktree: .tmp/worktrees/issue-222-newsletter-calendar-mailing
Branch: issue-222-newsletter-calendar-mailing

Shared writer order is serialized: #218 -> #219 -> #220 -> #221 -> #222. No concurrent Wave A writer owns planning.js, mailing.js, shared styles, focused planning/finance tests, or the overlapping browser evidence paths. #222 must preserve the accepted containing behavior and edit only its groomed paths or later explicit PM amendments.

Next owner: Software Engineer. Before editing, post the required refreshed criterion-to-current-source/test inventory against 8c3b110 and stop for PM amendment if any needed path or contract is outside the groomed boundary.

No product file, commit, merge, push, deployment, provider, production/private data, or HUMAN action was changed by this orchestration handoff.

SOFTWARE ENGINEER PREFLIGHT — refreshed criterion-to-current-source/test inventory before editing

Verified clean project-local worktree .tmp/worktrees/issue-222-newsletter-calendar-mailing at exact accepted containing HEAD 8c3b110c8aa138d95385a89fe3328749bdf47250 (tree 5a63d7b4f34ff9281bd4aeb576fa9b7693902ec4). Accepted #218 0c89588, #219 9d204d2, and #220 d334020 are ancestors; #221 is HEAD. No overlapping Wave A writer owns these paths. No production or test file has been edited.

Criterion	Refreshed classification at `8c3b110`	Current source/test evidence and bounded implementation decision
Canonical shell, routes, focus/history, shared tokens/primitives	Already compliant / dependency-owned	Accepted #180/#161/#218–#221 are contained. `planning.js`, `mailing.js`, and late shared CSS consume the accepted page-header, section, action-row, honest-state, status, dialog, and responsive vocabulary. Preserve; no shell/router/token/API work.
Europe/Berlin operator day	Already compliant / dependency-owned	`planning.js` uses injected `todayIsoDate()` for Calendar cursor/Today and Newsletter bounds; `mailing.js` uses it for absent-run keys. Existing focused, Calendar seam, canonical capability, and #134 tests cover the contract. Preserve exactly; no date resolver/library/backend change.
Newsletter earliest-first chronology	Concrete gap	`load()` sorts only by `publicationDate`; equal-date order remains API-order dependent, with no campaign-label then record-ID tie-break. Existing unit/browser tests use ordered fixtures and do not prove shuffled same-date stability through group/filter reloads. Implement comparator and dedicated behavior evidence in authorized paths.
Newsletter semantic labels, booking/status/link/dialog/mutation behavior	Already compliant / dependency-owned	Semantic `<time datetime>`, human booking fallback, safe campaign links, grouped headings, alert mapping, native dialog, validation/conflict value retention, and existing mutation contracts are present and covered. Preserve while changing only ordering/recovery.
Newsletter initial and retained refresh failure	Concrete gap	Initial catch invents no rows, but every failure replaces a previously confirmed schedule with `Newsletter schedule unavailable`, clears alerts, and offers only “Reopen Newsletter to retry.” Add retained visibly stale/read-only context plus one connected `Retry newsletter schedule`; initial failure remains row-free. Retry must reuse current query and replace once without mutation/duplication.
Desktop Calendar month/week grid	Already compliant / dependency-owned	`render()` produces Monday–Sunday grids, ISO weeks, period controls, layers, filters, holidays, activities, overlays, alerts, and edit dialog; existing unit/design/seam/canonical tests cover them. Preserve at 1440×900.
Mobile Calendar agenda	Concrete gap	The final `<=820px` CSS explicitly sets seven `112px` columns with `overflow-x:auto`; production copy says “Swipe each week horizontally,” and design regression asserts that strip. Replace only this responsive presentation with one chronological column and update authorized regressions; preserve DOM date order and desktop grid.
Overlay success	Already compliant / dependency-owned	The independent `/overlays` request, existing linked Newsletter items, layer toggle, chronology, and canonical state evidence are present. Preserve source/API/link behavior.
Overlay-only outage and retry	Concrete gap	`Promise.allSettled` preserves Calendar data but collapses overlay failure into terse shared status, sets overlays empty, leaves the checked layer looking authoritative, and has no retry. Add a source-owned warning adjacent to the Calendar/layer decision and `Retry newsletter dates` for the same bounds; successful retry replaces only overlays and removes the warning without reloading/duplicating Calendar data.
Full Calendar initial/refresh outage and retry	Concrete gap	Catch clears items/holidays/overlays/alerts and replaces the grid even after prior success; recovery relies on route/period controls. Add initial row-free failure and retained visibly stale/read-only confirmed period for later failure, with `Retry calendar` reusing current period while preserving selected view/filter/layers.
Existing Calendar/Newsletter mutations, focus/history, alerts, #134 behavior	Already compliant / dependency-owned	Current handlers and accepted unit/canonical/seam tests cover create/edit, validation, conflicts, dismissals, Today/previous/next/view changes, route and dialog behavior. Preserve; no contract changes.
Mailing durable run, provider/privacy, Artifact/Task/download contract	Already compliant / dependency-owned	Existing `/api/mailing-exports/run` and authenticated artifact download paths, durable `runKey`, one-provider constraints, private five-minute link handling, no-config/empty/history behavior, and #108 tests are present. No provider/backend/config/private-data action or change.
Mailing human state and exact next action	Concrete gap	`actionCopy` remains imprecise, cards expose raw `status`, provider, task-link status/ID, artifact ID and raw error code as routine copy, and every non-completed run shows `Advance / retry`; completed still renders the run button as `Start daily export` beside `Download ZIP`. Map authoritative `nextAction` to human labels/instructions and exact safe controls (`Check status`, `Retry export`, repair-first variants, `Download private ZIP`), with completed no run action and no browser-guessed lifecycle. Preserve endpoint and durable key.
Mailing empty/no-config/history chronology/pagination	Already compliant / dependency-owned	Empty/no-config states, newest-request-first stable ID tie-break, retained later-page history, continuation, and retry are implemented and tested. Preserve.
Durable capability/source/SAM evidence	Concrete candidate-evidence gap	Existing canonical state IDs and reporter/parity machinery are dependency-owned and must not change. The dedicated normal-server `issue-222-planning-presentation.spec.js` does not yet exist; existing design/seam/newsletter tests still assert old mobile/failure/action assumptions. Add the authorized real-server journey, update only authorized regressions, retain canonical IDs, and prove source/dist/SAM byte identity plus full capability accounting.
Unrelated APIs/backend/infrastructure/provider/private knowledge	Out of scope	No current criterion requires an unauthorized path or contract. I will stop for a narrow PM amendment if implementation discovers otherwise.

Planned bounded writes remain exactly the three authorized production paths and seven authorized focused/evidence paths in the groomed body. Core behavior evidence will use the normal local TypeScript server and deterministic local fault/provider simulator with synthetic public-safe records; intercepted specs remain regression/visual evidence only. Final candidate will be unstaged/uncommitted and will include the complete required workflow, independent comparison of any conversational backend baseline failures against accepted HEAD, exactly 12 cleaned untracked screenshots, native inspection, and exact HEAD/diff/porcelain/content/screenshot fingerprints.

SOFTWARE ENGINEER BLOCKED — narrow PM amendment required for normal-server Mailing evidence

The authorized production changes and focused unit coverage are currently bounded to the groomed paths, and the focused command is green: node --test frontend/test/planning-surface.test.mjs frontend/test/finance-surface.test.mjs → 23/23 passed.

While implementing the required dedicated normal-server journey, I verified the actual test-only simulator in backend/scripts/test-server.ts. Its /__e2e__/mailing-provider control accepts only pending, generic fail, and complete. Generic fail produces authoritative nextAction: retry; it cannot produce the required authoritative fix-authorization or fix-storage states. Intercepting the API or fabricating browser-only lifecycle state would violate the groomed behavior authority and acceptance criteria.

Requested narrow amendment:

Authorize backend/scripts/test-server.ts as a Converge Newsletter, Calendar, and Mailing Export presentation #222 test-infrastructure path only.
Permit extending the existing local-only /__e2e__/mailing-provider simulator with deterministic authorization and storage failure modes. These modes must flow through the existing production runMailingExport service/classification and normal authenticated /api/mailing-exports/run endpoint; they must not change any production route, model, service contract, provider adapter, configuration, or shipped Lambda behavior.
The existing generic fail, pending, and complete modes remain unchanged. No external provider call, credential, private data, or production action is permitted.
Clarify the existing server-authoritative status: completed plus nextAction: fix-task-link case: the archive is complete but the workflow is not operationally finished. Proposed presentation is human state Needs attention with Retry after Task link is fixed; a clean completed + download + Artifact card has no start/check/retry control and only Download private ZIP. This preserves the authoritative status/nextAction pair and the groomed repair-first criterion without claiming the portal repairs Task configuration.

No second helper path is needed: the dedicated authorized #222 spec can start its own normal local server with a synthetic missing taskId through the existing environment option to produce fix-task-link after a provider-free local completion.

If approved, I will edit only backend/scripts/test-server.ts beyond the original bounded set, add focused assertions through the already authorized backend/e2e/issue-222-planning-presentation.spec.js, rerun the complete prescribed workflow, and report the exact final fingerprint. If rejected, the full normal-server all-next-action acceptance criterion is not presently provable without weakening it.

Current diff remains unstaged and uncommitted. No commit, merge, push, deploy, provider, production/private-data, or HUMAN action was performed.

PM AMENDMENT APPROVED — narrow local Mailing evidence seam and authoritative completed/Task-link presentation

Decision

APPROVED solely for backend/scripts/test-server.ts as test infrastructure for #222. This amendment does not expand production scope.

Why this path is necessary

The groomed issue requires the dedicated real-server journey to prove every existing server-authoritative Mailing nextAction through the normal authenticated POST /api/mailing-exports/run path, without browser interception or fabricated lifecycle state. At accepted baseline 8c3b110c8aa138d95385a89fe3328749bdf47250, the local simulator can produce only pending, generic fail, and complete. Generic fail correctly classifies as retry; it cannot prove fix-authorization or fix-storage. A bounded extension of the existing test-only dependency seam is therefore required and is preferable to weakening the behavior authority.

Authorized path and exact line purpose

Only backend/scripts/test-server.ts is newly authorized, limited to these current baseline anchors:

Around line 45: extend the private in-process e2eMailingProviderMode type with deterministic authorization and storage values.
Around lines 103–126: extend only the already-installed setMailingExportDependenciesForTests dependencies:
- authorization must throw a synthetic, sanitized MailingExportProviderError with category authorization from the existing local provider request/check seam, so existing production runMailingExport and classifyFailure produce status: failed plus nextAction: fix-authorization.
- storage must allow the synthetic provider to reach deterministic completion/download, then fail only in the existing local store dependency with a sanitized storage-classifiable error, so production runMailingExport and classifyFailure produce status: failed plus nextAction: fix-storage. Do not model storage failure as a provider error.
- Existing pending, generic fail, and complete behavior must remain unchanged.
Around lines 247–258: allow only those two additional values in the existing local POST /__e2e__/mailing-provider control validation and response. No second helper route or alternate lifecycle authority is authorized.

No other purpose or line in that file is authorized by this amendment.

Authoritative status and next-action clarification

The production contract intentionally permits status: completed with nextAction: fix-task-link: the archive and Artifact were created, but attachment to the configured recurring Task is missing or failed. Retrying the same durable run key enters the existing Task-attachment retry branch and must not request, download, or store a second provider export.

For #222 presentation:

status: completed + nextAction: fix-task-link + Artifact is operationally Needs attention, not a clean completed workflow. Preserve the server fields unchanged; this is a human presentation derived from their authoritative combination.
Its card must state that the private archive was prepared but the recurring Task link still requires repair, keep Artifact readiness honest, and expose exactly Retry after Task link is fixed using the same existing configId, authenticated run endpoint, and exact existing runKey.
It must not show Start, Check status, or claim that the portal repairs Task configuration. It must not claim that the provider export runs again.
It must not show a download control while authoritative nextAction is fix-task-link; nextAction remains the action authority.
A clean completed card is specifically status: completed + nextAction: download + artifactId. Only that combination presents Completed, exposes only Download private ZIP, and has no start/check/retry control.
The groomed criterion “Completed cards have no start/check/retry control” is clarified to mean clean completed/download cards. The completed/fix-task-link combination is the explicit repair-first exception and is presented as Needs attention.
No browser-guessed provider success or browser-only lifecycle state is allowed.

Invariants and exclusions

Preserve existing production runMailingExport, failure classification, routes, models, schemas, service contracts, provider registry/adapters, persisted fields, configuration, and Lambda/SAM behavior byte-for-byte outside the already groomed frontend paths.
No browser request interception or fake browser lifecycle for core Mailing evidence.
No external provider call, credential read, real audience/contact, production/private record, signed URL, storage identity, private link, or provider log.
No production route, provider, service, model, schema, storage, configuration, infrastructure, or deployment edit.
Simulator controls remain local-test-only and flow through the existing production service and authenticated API.
Keep synthetic errors generic and public-safe; do not expose raw reason codes or storage/provider/credential identity in operator copy.
Preserve the durable run key, one logical run, Artifact identity, idempotency, provider limits, and Automate private Mailchimp account exports and attach them to recurring work #108 privacy/download boundaries.

Required verification

Use the already authorized backend/e2e/issue-222-planning-presentation.spec.js for the normal-server assertions. It must prove, without route interception:

pending remains wait and the UI action is Check status.
generic fail remains retry and the UI action is Retry export.
authorization traverses the authenticated run API and existing production service to failed + fix-authorization, with the exact repair-first UI action.
storage traverses provider completion/download and fails at the local store seam, producing failed + fix-storage, with the exact repair-first UI action.
a synthetic missing Task target produces completed + fix-task-link + Artifact; the card presents Needs attention and retry-after-repair with the exact same run key and does not expose a download control.
retrying that Task-link case preserves the run, Artifact, and provider-job identities and does not create another export/archive.
a clean completed + download + Artifact card presents Completed, only Download private ZIP, and no start/check/retry control.
existing pending, fail, and complete simulator behavior and canonical Mailing capability evidence remain green.

Then run the full #222 required verification exactly as groomed, including frontend unit/coverage, backend test/typecheck/build, focused and full Playwright, frontend parity, SAM validation/build and source/SAM identity, make ci, and git diff --check. Re-freeze the candidate fingerprints and exactly 12 screenshot hashes after this edit; Designer, independent Tester, and PM acceptance must review that new exact fingerprint.

Next owner

Software Engineer: implement only this amendment plus the previously groomed #222 paths, run the complete verification workflow, clean local artifacts/processes, and post a fresh unstaged/uncommitted READY handoff. Stop and request another PM amendment if any additional path or contract is needed.

No file edit, stage, commit, merge, push, deploy, provider action, private-data action, or HUMAN action is authorized or performed by this decision.

Narrow PM amendment request — accepted #218 regression label

The complete browser matrix now reaches 98 passed / 1 failed with complete capability evidence. The only failure is:

backend/e2e/issue-218-shared-primitives.spec.js:503
accepted Converge Wave A surfaces on bounded shared UI primitives #218 regression searches for the legacy Mailing button label Advance / retry
Converge Newsletter, Calendar, and Mailing Export presentation #222's approved precise next-action contract renders the authoritative pending action as Check status

The production behavior is intentional and already covered by the authorized #222 unit/canonical/dedicated normal-server evidence. Adding a hidden/ARIA compatibility alias would weaken the exact operator semantics and violate the repository's no-compatibility-shim rule.

Please approve this exact additional test-only path and change:

authorize backend/e2e/issue-218-shared-primitives.spec.js
update the pending action expectation from Advance / retry to Check status
update that same accepted regression's failed-state safe-copy/status expectations only if its next assertion exposes the already-approved provider-neutral Converge Newsletter, Calendar, and Mailing Export presentation #222 presentation
no production/API/backend/provider changes

Candidate remains unstaged/uncommitted at 8c3b110c8aa138d95385a89fe3328749bdf47250. I am stopping before touching the unauthorized path.

DESIGN EVIDENCE CONTRACT UPDATE APPROVED — image 03 only, not final candidate review

I completed the requested read-only Product Designer evidence-contract review. I read the Designer role, AGENTS.md, docs/PROCESS.md, the full #222 issue/evidence history, the authoritative PM contract in #issuecomment-5466670667, the exact-ten hard failure in #issuecomment-5466696262, and the preserved root-cause audit in #issuecomment-5466716120. I inspected the expected and actual native image 03 originals, the unmasked full-frame diff, changed-coordinate/value evidence, capture implementation, Newsletter DOM/source, and relevant control CSS.

This verdict updates screenshot identity only. It is not DESIGN PASS, TESTER PASS, PM acceptance, permission to commit, or a final candidate review.

Design-equivalence decision

APPROVED. The two proven native image 03 variants are materially design-equivalent. The variance is Chromium/Skia antialias sampling on four rounded one-pixel form-control corners, not a different rendered product state:

exactly 28 / 1,296,000 pixels (0.00216049%) differ;
normalized full-frame RMSE is 0.0000152765;
maximum per-channel delta is 2/255;
both originals are exactly 1440×900, 8-bit sRGB and contain only IHDR, IDAT, and IEND PNG chunks;
all changed samples are confined to the To-date upper-right, Group-by upper-left and upper-right, and Status upper-left rounded outer edges;
text, glyphs, icons, labels, warning/retry content, retained rows, focus-ring area, interior fills, remaining control edges, dimensions, layout, scroll, fonts, timestamps, route/state, and source/SAM behavior are unchanged.

The expected and actual originals are visually indistinguishable at native size. The unmasked diff exposes only the four tiny corner clusters. Chronology also proves both hashes recur for the same unchanged frontend/capture state. A production CSS or native-control replacement solely to chase these subvisible raster samples is not a warranted design repair.

Exact named exception: image 03

The PM contract may be amended to replace byte identity only for:

03-newsletter-retained-unavailable-desktop-1440x900.png

Every requirement below is conjunctive. AE/RMSE compliance alone is never sufficient.

Native format and numerical caps

For every pairwise A/B/C comparison and every later regeneration against the final frozen reviewed ordinal:

filename remains exact and the inventory remains exactly the required 12 PNGs;
dimensions are exactly 1440×900, depth exactly 8-bit, colorspace exactly sRGB;
PNG chunk classes remain only IHDR, IDAT, and IEND, with no ancillary metadata chunks;
full-frame ImageMagick AE is ≤ 28 changed pixels;
normalized full-frame ImageMagick RMSE is ≤ 0.0000152765;
absolute per-channel delta for every changed pixel is ≤ 2/255.

Permitted regions and cause

Every changed pixel must be an outer-edge antialias sample confined to the union of these inclusive full-frame coordinate boxes, measured from the top-left origin:

To-date field upper-right rounded edge: x=762..767, y=264..268;
Group-by select upper-left rounded edge: x=780..785, y=264..268;
Group-by select upper-right rounded edge: x=922..927, y=264..268;
Status select upper-left rounded edge: x=940..945, y=264..268.

These boxes are the observed clusters plus one surrounding pixel solely to name each edge region. The pixel-count, RMSE, and channel-delta caps do not expand. The sole permitted cause is Chromium/Skia antialias sampling at those rounded one-pixel outer edges.

No changed pixel may affect a label, text/glyph/icon, date value, select value/arrow, focus ring, warning or retry content, retained Newsletter row/content, link, status, heading, border away from the named corner, interior fill, or unnamed element—even if it falls within a containing box.

Exact image 03 semantic/DOM/font/scroll/layout invariants

The owned backend/e2e/issue-222-planning-presentation.spec.js may add only read-only image 03 invariant capture/reporting analogous to the already approved 05/07 instrumentation. Immediately after approved focus normalization and final bounded frame settling, and immediately before capture, source, packaged SAM, every A/B/C run, and every later regeneration must agree exactly on:

route/hash and complete Newsletter state: From/To values, Group-by value, Status and Booking values, stale/read-only state, unavailable/retry state, alert state, period groups, and ordered slot date/label/status/link/action sequence;
complete Newsletter-surface accessible snapshot and complete visible-text snapshot;
structural DOM manifest: ordered element/tag/role/class/state sequence plus relevant aria-*, data-*, value, selected, disabled, hidden, link-presence, and datetime attributes; only the already-approved opaque synthetic-ID normalization may remain, and it may not hide text, order, state, attributes, or geometry;
document.fonts.ready completion and document.fonts.status === "loaded";
viewport exactly 1440×900, scrollX === 0, exact integer scrollY, exact body/document client and scroll extents, and no horizontal overflow;
exact getBoundingClientRect() values for the Newsletter surface, page heading, Add slot button, filter panel, all five field labels and controls, load status, alert block, unavailable/retry block and button, first period heading/count, and first and last visible retained slot rows.

These invariants are exact, not tolerance-based. Existing behavior, accessibility, focus, source/SAM, and capability assertions remain authoritative and may not be removed or weakened.

Contract retained unchanged for every other image

The existing PM contract for images 05 and 07 remains byte-for-byte authoritative: same thresholds, named regions, invariant snapshots, repeat procedure, provenance, native inspection, and failure conditions. This update does not widen either Calendar exception.

The other nine screenshots remain byte-identical across all mandatory runs and later regenerations at their existing authoritative SHA-256 values:

01 f5d5d6b780f6b2e27d9d8bc3ec648dd1ad06d15402e41e3f858669742fe9cdaf
02 a8940f81fdd1eb686db8b48d59039d410ced6eef8d265e42f890165b3814cbba
04 7fff95cf0cdda7ae762aee9654538815e94642a133e1e1dff0a6578373dcf0e9
06 0e241b0240313dc5fb6f7ca2a9735c95ed3e433c9526b24fa6373f51d32d7814
08 e0edccb15db4e326a0f1eb7e0a8de6a2cc4c4b6df1150e3ca3572866fba50827
09 20c6b94eceaca4c1ec2809ad1b05f6478dfb7493e15ead27eda5977c63f25cda
10 8164710d3776974edffaf14a372e08349e056d5a3dfae6f4241f94741d90d09c
11 28b4c6235e86bc6bcc6365fc991a762f4e2193462d715a819a74aee0014ae7e5
12 5b5fc61ea8c0acdb6fe408e0e688be54b2fa0957157bb760628dd517d6ee9b22

Any byte drift in one of these nine is a hard failure.

Repeat-run, reviewed-ordinal, and inspection procedure

Freeze one unchanged source candidate with exact HEAD, tracked binary diff, empty index, porcelain, changed-content manifest, and authorized path inventory.
Run at least three consecutive fresh-process source/SAM journeys A/B/C. Each starts new owned processes, cleans the active destination, passes both journeys, emits exactly the 12 names and no extras, records all 03/05/07 invariants, and proves teardown.
Preserve every chronological native set before the next run and compare A↔B, A↔C, and B↔C in full. Apply this new contract to 03, the unchanged PM contract to 05/07, and exact hashes to the other nine.
Every later workflow regeneration is another chronological run under the same rules.
The final reviewed ordinal remains the last chronological successful source capture after the complete engineer workflow, never a preferred variant. Record all 12 hashes, the aggregate manifest, and exact 03/05/07 invariant hashes. An aggregate-manifest change is acceptable only when caused solely by compliant 03/05/07 edge samples.
Independent Tester must regenerate and compare against that ordinal. Designer and Tester must inspect all 12 native originals and every unmasked 03/05/07 full-frame diff; metrics cannot replace visual review.

Preserve complete local evidence: run logs and process identities, originals, per-file manifests, format/chunk inventories, invariant JSON/hashes, full pairwise and later-versus-ordinal AE/RMSE/channel-delta tables, exhaustive changed-coordinate lists and named-region classification, and unmasked full-frame diffs.

Prohibitions and hard failures

Do not mask, crop, clip, blur, scale, resample, normalize, recolor, re-encode, optimize, strip/rewrite chunks, composite, post-process, replace native controls, compare only subregions, use perceptual-only scoring, create screenshot goldens, weaken behavior/source-SAM/capability checks, select from observed hashes, copy a preferred variant, discard a failing run, rerun until a preferred hash appears, or redefine the final ordinal after observing results.

Stop immediately on any of these conditions:

any drift in the exact nine;
any violation of the unchanged 05/07 contract;
image 03 AE, RMSE, or per-channel delta above its cap;
any image 03 changed pixel outside the named union or affecting a forbidden pixel/element;
any image 03 cause other than the named Chromium/Skia rounded-edge antialias sampling;
any non-exact image 03 semantic, DOM, font, viewport, scroll, extent, or geometry invariant;
changed filename, inventory, dimensions, depth, colorspace, or PNG chunk class;
fewer than three valid consecutive runs, failed source/SAM journey, missing original/log/snapshot/coordinate/diff evidence, leaked processes, or evidence manipulation/selection.

On failure, do not widen a threshold or region. Investigate a further deterministic capture/runtime mechanism and request another explicit PM and Designer amendment.

Disposition

DESIGN EVIDENCE CONTRACT UPDATE APPROVED. Image 03 may use this exact named bounded exception; images 05/07 retain their current contract unchanged; all other nine remain byte-exact. No deterministic product-design repair is required on the evidence now proven.

Next owner is PM to accept, narrow, or reject this contract update. If PM accepts it, Software Engineer may add only the read-only image 03 instrumentation, rerun/refreeze under the amended contract, and then obtain fresh Designer candidate review, independent Tester verification, and final PM acceptance in order.

No repository file was edited, staged, committed, merged, pushed, deployed, or otherwise mutated by this design review.

PM AMENDMENT APPROVED — image 03 named Skia edge exception only

Decision and authority

APPROVED, narrowly and only as an update to the authoritative #222 screenshot-evidence contract in #issuecomment-5466670667.

The preserved root-cause audit in #issuecomment-5466716120 proves that image 03 has two recurring native raster variants for the same unchanged rendered state: exactly 28 / 1,296,000 pixels (0.00216049%), normalized full-frame RMSE 0.0000152765, maximum absolute per-channel delta 2/255, confined to four identified rounded one-pixel control corners. The Product Designer independently approved design equivalence and the same bounded contract in #issuecomment-5466727869.

This amendment supersedes only the image-03 byte-identity clause in the prior PM contract. It does not approve the candidate, grant DESIGN PASS or TESTER PASS, authorize commit, or change any product acceptance criterion.

Exact named exception

The exception applies only to:

03-newsletter-retained-unavailable-desktop-1440x900.png

Every requirement below is conjunctive. Passing a numerical threshold alone is insufficient.

For every A↔B, A↔C, and B↔C comparison, and every later regeneration against the final frozen reviewed ordinal:

filename remains exact and the inventory remains exactly the required 12 PNGs;
dimensions are exactly 1440×900, depth exactly 8-bit, colorspace exactly sRGB;
PNG chunk classes are only IHDR, IDAT, and IEND, with no ancillary metadata chunks;
full-frame ImageMagick AE is ≤ 28 changed pixels;
normalized full-frame ImageMagick RMSE is ≤ 0.0000152765;
absolute per-channel delta for every changed pixel is ≤ 2/255;
the sole permitted cause is Chromium/Skia antialias sampling at the four named rounded one-pixel outer edges below.

Every changed pixel must be confined to the union of these inclusive full-frame coordinate boxes, measured from the top-left origin:

To-date field upper-right rounded edge: x=762..767, y=264..268;
Group-by select upper-left rounded edge: x=780..785, y=264..268;
Group-by select upper-right rounded edge: x=922..927, y=264..268;
Status select upper-left rounded edge: x=940..945, y=264..268.

The boxes are the observed clusters plus one surrounding pixel solely to define inclusive regions. They do not expand the AE, RMSE, or channel-delta caps.

No changed pixel may affect a label, text, glyph, icon, date value, select value or arrow, focus ring, warning/retry content, retained Newsletter row or content, link, status, heading, border away from a named corner, interior fill, geometry, or unnamed element, even when it lies inside a containing box.

Exact image-03 invariants

Only backend/e2e/issue-222-planning-presentation.spec.js may add read-only image-03 invariant capture/reporting analogous to the already approved 05/07 instrumentation. After the approved focus normalization and bounded frame settling, immediately before capture, source, packaged SAM, every A/B/C run, and every later regeneration must agree exactly on:

route/hash and complete Newsletter state: From/To values, Group-by value, Status and Booking values, stale/read-only state, unavailable/retry state, alert state, period groups, and ordered slot date/label/status/link/action sequence;
complete Newsletter-surface accessible snapshot and complete visible-text snapshot;
structural DOM manifest: ordered element/tag/role/class/state sequence and relevant aria-*, data-*, value, selected, disabled, hidden, link-presence, and datetime attributes;
document.fonts.ready completion and document.fonts.status === "loaded";
viewport exactly 1440×900, scrollX === 0, exact integer scrollY, exact body/document client and scroll extents, and no horizontal overflow;
exact getBoundingClientRect() values for the Newsletter surface, page heading, Add slot button, filter panel, all five field labels and controls, load status, alert block, unavailable/retry block and button, first period heading/count, and first and last visible retained slot rows.

Only the already-approved opaque synthetic-ID normalization may remain. It may not hide text, order, state, attributes, or geometry. These invariants are exact, not tolerance-based. Existing behavior, accessibility, focus, source/SAM, and capability assertions remain authoritative and may not be removed, bypassed, or weakened.

Existing contract retained

The image 05 and 07 contracts in #issuecomment-5466670667 remain authoritative without any change: same thresholds, regions, invariant snapshots, repeat procedure, provenance, inspection, artifacts, prohibitions, and hard-failure conditions.

The other nine images remain byte-identical in every mandatory run and later regeneration at these authoritative SHA-256 values:

01 f5d5d6b780f6b2e27d9d8bc3ec648dd1ad06d15402e41e3f858669742fe9cdaf
02 a8940f81fdd1eb686db8b48d59039d410ced6eef8d265e42f890165b3814cbba
04 7fff95cf0cdda7ae762aee9654538815e94642a133e1e1dff0a6578373dcf0e9
06 0e241b0240313dc5fb6f7ca2a9735c95ed3e433c9526b24fa6373f51d32d7814
08 e0edccb15db4e326a0f1eb7e0a8de6a2cc4c4b6df1150e3ca3572866fba50827
09 20c6b94eceaca4c1ec2809ad1b05f6478dfb7493e15ead27eda5977c63f25cda
10 8164710d3776974edffaf14a372e08349e056d5a3dfae6f4241f94741d90d09c
11 28b4c6235e86bc6bcc6365fc991a762f4e2193462d715a819a74aee0014ae7e5
12 5b5fc61ea8c0acdb6fe408e0e688be54b2fa0957157bb760628dd517d6ee9b22

Any byte drift in one of these nine is a hard failure.

Mandatory rerun, refreeze, and review sequence

Software Engineer instrumentation: add only the authorized read-only image-03 invariant reporting. Preserve the existing authorized path boundary and all 05/07 instrumentation.
Freeze source identity: record exact HEAD, tracked binary diff, empty index, porcelain-v1-z fingerprint, explicit changed-content manifest, and authorized path inventory.
Three fresh-process runs: execute consecutive source/SAM runs A, B, and C from that one unchanged candidate. Each run starts new owned processes, cleans the active destination, passes both journeys, emits exactly the 12 required names and no extras, records 03/05/07 invariants, preserves the chronological native set before the next run, and proves teardown.
Compare all runs: compare A↔B, A↔C, and B↔C in full. Apply this amendment to 03, the unchanged prior contract to 05/07, and exact hashes to the other nine.
Complete workflow: rerun the complete prescribed Converge Newsletter, Calendar, and Mailing Export presentation #222 workflow from #issuecomment-5466670667, including the corrected focused --reporter=line command and the separate unfiltered 162/162 capability gate. Every screenshot regeneration is an additional chronological run under the same contract.
Final refreeze: the final reviewed ordinal is the last chronologically executed successful source capture after the complete engineer workflow, never a preferred variant. Record all 12 hashes, ordered manifest hash, exact 03/05/07 invariant hashes, and unchanged source fingerprints. An aggregate-manifest change is acceptable only when caused solely by compliant 03/05/07 edge samples.
Fresh Designer review: inspect the unchanged source candidate, all 12 native final-ordinal originals, and every unmasked 03/05/07 full-frame diff.
Fresh independent Tester review: run the complete workflow, regenerate a new chronological set, compare it in full against the frozen ordinal under this contract, and natively inspect all 12 originals plus all unmasked 03/05/07 diffs.
Final PM acceptance: only after TESTER PASS, review the same source fingerprints and composite screenshot identity.
Only after PM acceptance may Software Engineer commit the exact accepted paths with Closes #222.

Required artifacts

Keep all evidence untracked and project-local under this worktree's .tmp/ until Designer, Tester, and PM finish. READY and Tester reporting must identify paths and hashes for:

complete chronological A/B/C and final-reviewed-ordinal native PNG sets;
ordered run logs with command, ordinal, start/end, owned process identity, exit result, source fingerprints, Playwright/Chromium version, and capture target;
per-run 12-file SHA-256 manifests and exact filename inventories;
dimensions, depth, colorspace, and PNG chunk inventories;
exact 03/05/07 semantic/DOM/font/scroll/layout invariant JSON and hashes for source and SAM;
complete pairwise and later-versus-ordinal AE/RMSE/per-channel-delta tables;
exhaustive changed-pixel coordinates and named-region classification;
unmasked full-frame 03/05/07 diff images and both native originals;
proof that exactly 12 PNGs and no extras were emitted, all nine exact images retained their authoritative hashes, and every owned process was stopped.

Automated metrics do not replace Designer and Tester native inspection.

Prohibitions

Do not mask, crop, clip, blur, scale, resample, normalize, recolor, re-encode, optimize, strip or rewrite chunks, composite, post-process, replace native controls, compare only subregions, use perceptual-only scoring, create screenshot goldens, weaken behavior/source-SAM/capability checks, select from observed hashes, maintain a hash allowlist/menu, copy a preferred variant, discard a failing run, rerun until a preferred hash appears, or redefine the final ordinal after observing results.

No application-state change, production CSS repair, altered fixture/journey, new route/configuration, external provider call, private/production data, credential, deployment, or HUMAN action is authorized by this amendment.

Hard failures

Stop immediately if any of the following occurs:

byte drift in any exact-nine image;
any violation of the unchanged image 05/07 contract;
image 03 AE, normalized RMSE, or per-channel delta exceeds its cap;
any image-03 changed pixel lies outside the named union or affects a forbidden pixel/element;
image-03 variance has any cause other than the named Chromium/Skia rounded-edge antialias sampling;
any non-exact image-03 semantic, DOM, font, viewport, scroll, extent, or geometry invariant;
changed filename, inventory, dimensions, depth, colorspace, or PNG chunk class;
fewer than three valid consecutive fresh-process runs;
failed source/SAM journey, failed required gate, missing original/log/snapshot/coordinate/diff evidence, leaked process, or evidence manipulation/selection.

On failure, do not widen a threshold or region. Preserve the failing chronological evidence, investigate a deterministic capture/runtime mechanism, and request another explicit PM and Designer amendment.

Disposition

PM AMENDMENT APPROVED. Image 03 may use only this precisely named bounded Chromium/Skia edge exception. Images 05/07 retain their existing contract unchanged; the other nine remain byte-exact.

Next owner: Software Engineer for the bounded instrumentation, complete rerun, refreeze, and READY handoff.

SOFTWARE ENGINEER — HARD STOP: image 07 exceeds the approved A/B/C contract

I stopped before the complete workflow and final refreeze, as required by the PM contract in #issuecomment-5466736144. The unchanged candidate and every chronological A/B/C native original remain preserved; I did not discard, regenerate, normalize, or select a variant.

Exact failure

07-calendar-overlay-unavailable-desktop-1440x900.png fails the unchanged image-07 contract from #issuecomment-5466670667:

Comparison	AE	normalized RMSE	Named-region result	Verdict
A↔B	22	`0.0000526945`	22/22 inside	pass
A↔C	2	`0.00000281262`	2 outside	hard fail
B↔C	24	`0.0000527695`	2 outside	hard fail

B↔C exceeds the approved AE cap 22 and RMSE cap 0.0000526945. The two out-of-region coordinates in A↔C and B↔C are exactly (444,863) and (445,864). They are one-channel, one-level samples on the Calendar grid upper-left rounded edge. Exact invariant geometry places that grid at x=444, y=858.078125; the contract names its symmetric right-edge region but not this left edge.

B↔C is the disjoint union of 14 checked-control/tick pixels, 5 filter-panel lower-left pixels, 1 Calendar count/grid-right pixel, 2 grid-right pixels, and these 2 grid-left pixels. This explains why A↔B is exactly at the existing ceiling while the independent two-pixel A↔C variant combines to 24 in B↔C.

Root-cause classification

This is a second independent Chromium/Skia rounded-edge antialias variant, not product-state drift:

A/B/C were consecutive fresh processes with distinct owned server tokens/PIDs; all three source/SAM journeys passed 2/2 and teardown succeeded.
All six image-07 source/SAM semantic/DOM/font/scroll/layout snapshots are byte-identical at SHA-256 dea8c9b40dac426f614e23436117565c3e5c01ded06435544e55987a9950d60d.
Fonts are loaded; viewport is exactly 1440×900; scroll is (0,0); route, DOM, accessibility tree, visible text, state, extents, and geometry are exact.
All originals are native 1440×900, 8-bit sRGB PNGs with only IHDR/IDAT/IEND chunks.
Capture already uses the approved fixed clock, waits for fonts and bounded frames, normalizes focus/scroll, disables animations, and does no post-processing.
I natively inspected B, C, and the unmasked B↔C full-frame diff; no content or layout changed.

The raw comparison table had incorrectly printed a literal PASS beside B↔C before strict cap/region validation. Its numeric measurements and exhaustive coordinates were preserved. The corrected strict classification is recorded separately.

Preserved evidence and identity

Evidence root: .tmp/issue-222-evidence/candidate-cc1477a6-contract-v2/

detailed audit: comparisons/HARD-FAILURE.md, SHA-256 c6a2963bd3d68291c94b4399b88fdf6fd11da18f473dd7ef89ac6f161504f2fc
strict validation: comparisons/strict-contract-validation.tsv, SHA-256 0535645bfd7ceecda9e4c4748b314e61a48097390ceba8ef0a51899953e2f86a
unmasked B↔C diff: comparisons/diffs/BC-07-unmasked-full-frame.png, SHA-256 d905175e9fe5bedca58e53c243cf5d54fa49462fae694a739849be27f1a172ad
A/B/C image-07 originals: aea37e61801d..., 7c11124b5ff..., aef19ab5c099...
preserved runs+comparisons aggregate fingerprint: a73318943cda03b83dce1dc3bcd6038b44565d956367424ee3254de9276b3a60
candidate remains HEAD 8c3b110c8aa138d95385a89fe3328749bdf47250, tracked diff cc1477a652572605c356a14666a299ebb36813367f921f8d7f7cd28217e4d22b, empty index e3b0c442..., porcelain cf07ab4499..., changed-content manifest b33338c636...
no owned Converge Newsletter, Calendar, and Mailing Export presentation #222 server, Playwright, Chromium, or SAM process remains.

Narrow PM + Designer decision required

Please review whether image 07 may add only the Calendar grid upper-left rounded-edge region x=443..446, y=862..864 and use the proven independent-union pairwise ceilings AE 24 and normalized RMSE 0.0000527695. I am not self-authorizing either change.

Until an explicit PM and Designer decision, the complete workflow, later screenshot ordinals, final refreeze, and READY handoff remain stopped. No tracked file was changed by this audit; the candidate remains unstaged/uncommitted.

DESIGN EVIDENCE CONTRACT UPDATE APPROVED — image 07 only, not final candidate review

I completed the requested read-only Product Designer evidence-contract decision. I read the Designer role, AGENTS.md, docs/PROCESS.md, the full #222 issue/evidence history, current image 03/05/07 contracts, and the hard stop in #issuecomment-5466769744. I inspected the preserved native A/B/C image-07 originals and unmasked full-frame B↔C diff under .tmp/issue-222-evidence/candidate-cc1477a6-contract-v2/, together with exhaustive coordinates, pixel values, metrics, PNG inventories, and invariant snapshots.

This updates screenshot identity only. It is not DESIGN PASS, TESTER PASS, PM acceptance, permission to commit, or final candidate review.

Design-equivalence decision

APPROVED. The new image-07 variance is materially design-equivalent Chromium/Skia rounded-edge antialias sampling, not product-state or layout drift:

A↔C changes only (444,863) and (445,864), on the Calendar grid's upper-left rounded outer edge; exact grid geometry is x=444, y=858.078125.
Each sample changes in exactly one channel by one level: rgb(231,234,238) → rgb(231,234,237) and rgb(245,246,249) → rgb(244,246,249).
This is symmetric with the already-approved Calendar grid right-edge exception.
A↔B contains the existing 22 approved samples, A↔C only the independent two-pixel left-edge variant, and B↔C their disjoint 24-pixel union.
All six A/B/C source/SAM semantic, accessible, DOM, font, viewport, scroll, extent, and layout snapshots are byte-identical at dea8c9b40dac426f614e23436117565c3e5c01ded06435544e55987a9950d60d.
All originals are native 1440×900, 8-bit sRGB PNGs with only IHDR, IDAT, and IEND; all three fresh-process source/SAM runs passed and tore down.
Native inspection shows no text, glyph, warning/retry content, count, grid content, focus, geometry, hierarchy, clipping, or layout change.

A product/CSS repair solely to force these two subvisible symmetric border samples is not warranted.

Exact image-07 contract update

This applies only to 07-calendar-overlay-unavailable-desktop-1440x900.png and supersedes only its region union and numerical ceilings. For every A↔B, A↔C, B↔C, and later-versus-final-ordinal comparison:

dimensions remain exactly 1440×900, depth exactly 8-bit, colorspace exactly sRGB, and PNG chunks only IHDR/IDAT/IEND;
full-frame ImageMagick AE is ≤ 24;
normalized full-frame ImageMagick RMSE is ≤ 0.0000527695;
the existing approved image-07 region union gains exactly one inclusive region:
- Calendar grid upper-left rounded edge: x=443..446, y=862..864.

The existing regions remain unchanged:

checked-control/tick: x=652..660, y=353..360;
filter-panel lower-left: x=443..446, y=400..404;
Calendar count/grid right: x=1261..1265, y=833..835;
Calendar grid right: x=1261..1265, y=862..864.

The new box only names the symmetric rounded edge; it does not independently expand the caps. Within it, a changed sample must be Chromium/Skia outer-edge antialiasing, change no more than one channel, and have absolute per-channel delta ≤ 1/255. No changed pixel may affect text, glyphs, warning/retry copy, headings, count, focus ring, grid content, interior fill, border away from that rounded edge, or an unnamed element, even inside a containing box.

Unchanged authority and failure boundary

All image-07 semantic/DOM/font/scroll/layout invariants remain exact and conjunctive. Any route, state, accessible snapshot, visible text, DOM manifest, font, viewport, scroll, extent, overflow, or geometry drift is a hard failure regardless of pixel metrics.

Image-03 and image-05 contracts remain unchanged. The other nine images remain byte-exact at their authoritative hashes. All repeat-run, chronological-final-ordinal, source/SAM provenance, artifact-preservation, native-inspection, anti-selection, no-mask/no-crop/no-re-encode/no-post-processing, capability, and lifecycle requirements and prohibitions remain unchanged.

Any sample outside the amended union, AE/RMSE excess, violation of the new-region channel rule, forbidden affected element, non-antialias cause, or invariant drift remains a hard failure. Do not widen this contract without a new explicit PM and Designer decision.

Disposition

DESIGN EVIDENCE CONTRACT UPDATE APPROVED. Image 07 may add only x=443..446, y=862..864 and use pairwise ceilings AE 24 and normalized RMSE 0.0000527695 under the conjunctive rules above. No deterministic visual-design repair is required on the proven evidence.

Next owner is PM to accept, narrow, or reject this update. If PM accepts, Software Engineer may resume the stopped workflow/refreeze, followed by fresh final-candidate Designer review, independent Tester verification, and final PM acceptance.

No file was edited, staged, committed, merged, pushed, deployed, or otherwise mutated.

PM AMENDMENT APPROVED — image 07 symmetric Calendar-grid edge only

Decision and authority

APPROVED, narrowly and only as an image-07 update to the authoritative #222 screenshot-evidence contracts in #issuecomment-5466670667 and #issuecomment-5466736144.

The preserved hard-stop evidence in #issuecomment-5466769744 proves that the two newly observed pixels are a second independent Chromium/Skia rounded-edge antialias variant on the Calendar grid upper-left outer edge. The Product Designer independently inspected the native originals, unmasked full-frame diff, exhaustive coordinates, pixel values, metrics, PNG inventories, and exact invariant snapshots and approved the same bounded design-equivalence contract in #issuecomment-5466786839.

This amendment supersedes only the image-07 region union and its full-frame AE/RMSE ceilings. It is not DESIGN PASS, TESTER PASS, final PM acceptance, permission to commit, or a change to any product acceptance criterion.

Exact image-07 amendment

This amendment applies only to:

07-calendar-overlay-unavailable-desktop-1440x900.png

For every A↔B, A↔C, and B↔C comparison, and every later regeneration against the final frozen reviewed ordinal:

dimensions remain exactly 1440×900, depth exactly 8-bit, colorspace exactly sRGB, and PNG chunk classes only IHDR, IDAT, and IEND;
native unmodified full-frame ImageMagick AE is ≤ 24 changed pixels;
normalized native unmodified full-frame ImageMagick RMSE is ≤ 0.0000527695;
the prior approved image-07 region union gains exactly this inclusive full-frame coordinate box:
- Calendar grid upper-left rounded edge: x=443..446, y=862..864.

All prior image-07 named regions remain unchanged and equally authoritative:

native checked-control/tick antialias: x=652..660, y=353..360;
filter-panel lower-left edge: x=443..446, y=400..404;
Calendar count/grid right edge: x=1261..1265, y=833..835;
Calendar grid right edge: x=1261..1265, y=862..864.

The new box only names the symmetric outer rounded edge. It does not add a per-region allowance or independently expand the full-frame caps. Within the new box, a changed sample must:

be caused solely by Chromium/Skia outer-edge antialias sampling;
change in no more than one channel;
have absolute per-channel delta ≤ 1/255.

No changed pixel may affect text, glyphs, warning or retry copy, headings, count, focus ring, Calendar content, interior fill, border away from that named rounded edge, geometry, or an unnamed element, even if it lies inside a containing box. Existing image-07 behavior for every prior region remains unchanged; this decision does not infer or add a broader channel-delta permission for those regions.

All requirements are conjunctive. Passing AE/RMSE alone is insufficient.

Exact invariants retained

Every existing image-07 semantic, content, accessibility, DOM, font, viewport, scroll, extent, overflow, and layout invariant remains exact and authoritative, including:

exact route/hash and complete Calendar mode, period, filters, layers/checked values, alerts, overlay state, day order, and item type/text/link-presence order;
exact complete Calendar accessible snapshot and visible-text snapshot;
exact structural DOM-state manifest and only the previously approved opaque synthetic-ID normalization;
document.fonts.ready completion and document.fonts.status === "loaded";
viewport exactly 1440×900, scrollX === 0, exact integer scrollY, exact body/document client and scroll extents, and no horizontal overflow;
exact bounding rectangles for every previously named Calendar surface, heading, control, warning, grid, and boundary-cell element.

Any invariant drift is a hard failure regardless of pixel metrics.

All other screenshot contracts retained

Image 03 retains the complete contract in #issuecomment-5466736144, including its named regions, AE/RMSE/per-channel caps, exact invariants, and sole-cause rule.

Image 05 retains the complete contract in #issuecomment-5466670667, including every named region, numerical cap, exact invariant, and sole-cause rule.

The other nine images remain byte-identical in every mandatory run and later regeneration at their authoritative hashes:

01 f5d5d6b780f6b2e27d9d8bc3ec648dd1ad06d15402e41e3f858669742fe9cdaf
02 a8940f81fdd1eb686db8b48d59039d410ced6eef8d265e42f890165b3814cbba
04 7fff95cf0cdda7ae762aee9654538815e94642a133e1e1dff0a6578373dcf0e9
06 0e241b0240313dc5fb6f7ca2a9735c95ed3e433c9526b24fa6373f51d32d7814
08 e0edccb15db4e326a0f1eb7e0a8de6a2cc4c4b6df1150e3ca3572866fba50827
09 20c6b94eceaca4c1ec2809ad1b05f6478dfb7493e15ead27eda5977c63f25cda
10 8164710d3776974edffaf14a372e08349e056d5a3dfae6f4241f94741d90d09c
11 28b4c6235e86bc6bcc6365fc991a762f4e2193462d715a819a74aee0014ae7e5
12 5b5fc61ea8c0acdb6fe408e0e688be54b2fa0957157bb760628dd517d6ee9b22

Any byte drift in one of these nine is a hard failure.

Repeat-run, refreeze, and review sequence

The preserved chronological A/B/C runs from the unchanged candidate may satisfy the mandatory three-consecutive-fresh-process proof under this amended contract because their complete native originals, logs, pairwise evidence, exact source/SAM invariants, process ownership, and teardown were preserved. They may not be reordered, replaced, discarded, or regenerated for a preferred outcome.
Resume the stopped complete Converge Newsletter, Calendar, and Mailing Export presentation #222 workflow from #issuecomment-5466736144, including the corrected focused --reporter=line command and the separate unfiltered 162/162 capability gate. Every screenshot regeneration is an additional chronological run under the same composite contract.
Refreeze source identity exactly: HEAD, tracked binary diff, empty index, porcelain-v1-z fingerprint, explicit changed-content manifest, and authorized path inventory.
The final reviewed ordinal is the last chronologically executed successful source capture after the complete Software Engineer workflow, never a selected variant. Record all 12 hashes, ordered manifest hash, exact image-03/05/07 invariant hashes, complete comparison evidence, and unchanged source fingerprints.
Obtain a fresh Product Designer final-candidate review of the unchanged source candidate, all 12 native final-ordinal originals, and every unmasked image-03/05/07 full-frame diff.
Obtain a fresh independent Tester full verification. Tester regenerates a new chronological set, compares it in full against the frozen ordinal under all three image contracts, runs every prescribed gate, and natively inspects all 12 originals and every unmasked image-03/05/07 diff.
Only after TESTER PASS may final PM acceptance review the same source fingerprints and composite screenshot identity.
Only after final PM acceptance may Software Engineer commit the exact accepted paths with Closes #222.

All prior artifact-preservation, source/SAM provenance, command logging, exact inventory, dimension/depth/colorspace/chunk reporting, exhaustive coordinate classification, unmasked diff, native-inspection, owned-process teardown, and private project-local .tmp/ requirements remain unchanged.

Prohibitions retained

No masking, cropping, clipping, blurring, scaling, resampling, normalization, recoloring, re-encoding, optimization, chunk stripping or rewriting, compositing, post-processing, native-control replacement, subregion-only comparison, perceptual-only scoring, screenshot golden, behavior/source-SAM/capability weakening, observed-hash allowlist/menu, preferred-variant copying, failing-run discard, rerun-until-preferred behavior, or final-ordinal redefinition is authorized.

No application-state change, production CSS repair, altered fixture or journey, new route or configuration, external provider call, private or production data, credential, deployment, or HUMAN action is authorized by this amendment.

Stop conditions

Stop immediately and preserve the failing chronological evidence if any of the following occurs:

image 07 exceeds AE 24 or normalized RMSE 0.0000527695;
any image-07 changed pixel lies outside the amended union, violates the new-region one-channel/1-per-255 rule, affects a forbidden element, or has a cause other than the named Chromium/Skia antialias sampling;
any image-07 semantic, content, accessibility, DOM, font, viewport, scroll, extent, overflow, or geometry invariant differs;
any image-03 or image-05 contract is violated;
any of the exact nine images changes by one byte;
filename, 12-image inventory, dimensions, depth, colorspace, or PNG chunk class changes;
any required source/SAM journey or workflow gate fails;
evidence is missing, manipulated, selected, or incomplete, or an owned process leaks.

On failure, do not widen a cap, region, cause, or normalization rule. Preserve the failed run in chronological order, investigate a deterministic capture/runtime mechanism, and request another explicit PM and Product Designer amendment before continuing.

Disposition

PM AMENDMENT APPROVED. Image 07 gains only the symmetric Calendar grid upper-left rounded-edge region x=443..446, y=862..864 and uses full-frame pairwise/later-versus-ordinal ceilings AE 24 and normalized RMSE 0.0000527695 under every conjunctive rule above.

Next owner: Software Engineer to resume the stopped complete workflow, refreeze, and post a new unstaged/uncommitted READY handoff.

No repository file was edited, staged, committed, merged, pushed, deployed, or otherwise mutated by this PM decision.

SOFTWARE ENGINEER — HARD STOP before #222 capture: Chromium network transition in full gate

I stopped the sole unfiltered npm --prefix backend run test:e2e gate when test 77 failed, as required by the current PM contract. I did not rerun it, continue to later gates, or create/select a screenshot variant.

Exact failure and root cause

issue-218-shared-primitives.spec.js:331 timed out waiting for .runtime-template-projection. The preserved Playwright trace proves:

the direct /api/templates fixture request returned HTTP 200 from the owned isolated server on 127.0.0.1:33219;
on the following browser navigation Chromium emitted 35 net::ERR_NETWORK_CHANGED failures for JavaScript modules, including operation-kernel.js, runtime shell/surface/workspace composition, tasks/templates.js, Finance, Knowledge, and Work Detail modules;
the failure snapshot consequently contains initialized shell chrome but no hydrated route surface;
this assertion is unchanged from accepted HEAD; the PM-authorized Converge Wave A surfaces on bounded shared UI primitives #218 edits affect only Mailing action/failure copy near lines 500-515;
the same complete Converge Wave A surfaces on bounded shared UI primitives #218 test passed 1/1 in the immediately preceding isolated run, and the corrected five-spec focused run passed 20/20.

This is a Chromium network-stack transition during module loading, not a #222 behavior, content, selector, source/SAM, or screenshot-identity delta.

Chronology and preservation

The full run failed before issue-222-planning-presentation.spec.js executed, so it emitted no new #222 screenshot ordinal. The active exactly-12 set and all current 03/05/07 invariant files remain byte-identical to preserved ordinal D; active/D ordered hash-manifest SHA-256 is 3deac72578a42061819f804f0d6394ddb9acdb5966477eeb78a6c71db84133af.

Preserved failure evidence:

.tmp/issue-222-evidence/candidate-cc1477a6-contract-v2/failures/full-e2e-20260830-state77-no-222-capture/

full command log;
error context;
native failure screenshot;
trace with all failed module requests;
evidence manifest fingerprint b85323b91ce6789c2f9702d45344a5266fd228e6335c01dc536f10aee8dd4834.

Candidate identity is unchanged: HEAD 8c3b110c8aa138d95385a89fe3328749bdf47250, tracked diff cc1477a652572605c356a14666a299ebb36813367f921f8d7f7cd28217e4d22b, empty index e3b0c442…, porcelain cf07ab4499…, content manifest b33338c636…. Port 3001 is closed and no owned #222 server, Playwright, Chromium, or SAM process remains.

Narrow PM decision requested

Please authorize retaining this failed environmental attempt in chronology and running exactly one fresh unfiltered npm --prefix backend run test:e2e from the unchanged candidate. It would remain the sole required 162/162 capability gate: no filter, reporter override, retry flag, assertion edit, source change, or weakened accounting. Any repeat failure or screenshot-contract violation would stop again immediately.

Until that decision, the workflow, final refreeze, native final inspection, and READY handoff remain stopped. The candidate remains unstaged/uncommitted; no merge, push, or deploy occurred.

PM VERIFICATION RERUN APPROVED — one unchanged-candidate unfiltered full-E2E attempt

Decision

APPROVED, narrowly, for exactly one fresh terminal invocation of:

npm --prefix backend run test:e2e

This is an environmental verification rerun disposition only. It does not amend product behavior, assertions, capability accounting, screenshot contracts, source/SAM parity, acceptance criteria, or the reviewed candidate. It is not DESIGN PASS, TESTER PASS, final PM acceptance, permission to commit, or permission to merge, push, or deploy.

Evidence basis

I read the Product Manager role, AGENTS.md, docs/PROCESS.md, the current #222 evidence contracts and amendments, and the Software Engineer report in #issuecomment-5466884825. I also inspected the preserved failure bundle and current worktree identity read-only.

The preserved trace and log support an environmental interruption rather than a #222 assertion/product failure:

the owned isolated server returned HTTP 200 for the direct /api/templates fixture request;
Chromium then failed 35 distinct local JavaScript module requests with net::ERR_NETWORK_CHANGED while navigating;
the shell initialized but the route could not hydrate, so the unchanged wait for .runtime-template-projection timed out;
that Converge Wave A surfaces on bounded shared UI primitives #218 journey passed in the immediately preceding isolated 1/1 run and in the corrected focused 20/20 run;
the failed full run stopped at test 77 before issue-222-planning-presentation.spec.js, so it created no Converge Newsletter, Calendar, and Mailing Export presentation #222 capture and no new screenshot ordinal.

The current candidate still matches the preserved identity exactly:

HEAD: 8c3b110c8aa138d95385a89fe3328749bdf47250;
tracked binary diff: cc1477a652572605c356a14666a299ebb36813367f921f8d7f7cd28217e4d22b;
staged diff: empty, SHA-256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855;
porcelain-v1-z: cf07ab4499f70208dea596fd97a41700a1452d078b5703a0e0db04a1e5170b5f;
changed-content manifest: b33338c636eabda78defd2544f175768e58ed51eb303da912606ea9cf37b296a.

The active exactly-12 image set remains byte-identical to preserved ordinal D. The failure evidence remains at:

.tmp/issue-222-evidence/candidate-cc1477a6-contract-v2/failures/full-e2e-20260830-state77-no-222-capture/

Its files.sha256 fingerprint remains b85323b91ce6789c2f9702d45344a5266fd228e6335c01dc536f10aee8dd4834; its four non-self evidence entries verify byte-for-byte. Ports 3001 and 33219 are not listening, and no owned #222 server, Playwright, Chromium, or SAM process remains.

Mandatory prerequisites immediately before the rerun

The Software Engineer must record and verify all of the following before starting the one authorized invocation:

HEAD, tracked binary diff, empty staged diff, porcelain-v1-z, changed-content manifest, authorized path inventory, active exactly-12 screenshot manifest, and current 03/05/07 invariant files still match the identities above and the current composite evidence contract.
The preserved failed attempt remains intact in chronological order. Do not delete, replace, rename out of chronology, rewrite, or treat it as a pass.
Ports 3001 and any prior isolated-server port are free; no owned Converge Newsletter, Calendar, and Mailing Export presentation #222 test server, Playwright, Chromium, or SAM process survives; the new run receives a fresh owned process/server context.
No source, test, fixture, config, dependency, environment-contract, screenshot, invariant, or evidence-contract edit occurs between identity verification and command start.
Record the exact command, start/end timestamps, process ownership, complete stdout/stderr, exit status, test/capability totals, generated artifact inventory, and teardown evidence in the project-local private .tmp/issue-222-evidence/ chronology.

If any prerequisite does not hold, do not consume the authorized attempt; stop and request a new PM disposition with the discrepancy preserved.

Exact rerun rules

Run the command exactly once, unfiltered and to terminal completion.
Use no Playwright retry flag or configuration change; retries remain disabled within Playwright.
Use no grep/filter, shard, focused project/spec selection, reporter override, timeout weakening, assertion edit, skip/fixme annotation, expected-failure marker, capability exclusion, or altered pass accounting.
Do not manually restart a failed browser/test inside the invocation.
Do not hide, delete, downgrade, reclassify, or explain away any assertion failure as environmental after the fact.
Retain the original failed attempt and the complete rerun evidence regardless of outcome.
Any Converge Newsletter, Calendar, and Mailing Export presentation #222 screenshots generated by the authorized run are the next chronological ordinal. Preserve all 12 native originals, hashes, ordered manifest, 03/05/07 source/SAM invariants, unmasked full-frame comparisons, PNG inventory, and contract-validation evidence. Do not select or restore a preferred visual variant.

Stop conditions

Stop the workflow immediately after preserving evidence if:

the authorized invocation exits nonzero for any reason, including another ERR_NETWORK_CHANGED, process interruption, timeout, capability-accounting failure, assertion failure, accessibility failure, source/SAM failure, or screenshot-contract failure;
any candidate or pre-run evidence identity differs;
the run does not execute the complete unfiltered suite and prove the full 162/162 capability catalog with no internal retries;
image 03, 05, or 07 violates any current conjunctive contract; any of the exact-nine images changes by one byte; any required semantic/DOM/font/viewport/scroll/layout invariant differs; or evidence is incomplete or manipulated;
a required process leaks or teardown cannot be proved.

There is no second rerun under this approval. On any failure, preserve it in chronology and return to PM. Do not alter assertions or widen/reclassify evidence without a separate explicit amendment.

Continuation on a clean terminal rerun

If—and only if—the one authorized invocation exits 0, executes the entire unfiltered suite, reports every expected browser journey passing, proves the full 162/162 capability catalog, satisfies the current composite screenshot contracts, preserves its new chronological evidence, and tears down cleanly, the Software Engineer may continue the already-approved remaining gates and final refreeze sequence from #issuecomment-5466796237.

That clean result does not erase the preserved environmental attempt. Both attempts remain part of the audit chronology. Fresh final-candidate Product Designer review, independent Tester verification, and final PM acceptance are still required before commit.

Disposition

PM VERIFICATION RERUN APPROVED. Exactly one unchanged-candidate, unfiltered, no-Playwright-retry full-E2E rerun is authorized under the prerequisites and hard-stop rules above.

Next owner: Software Engineer to verify preconditions, execute the single authorized attempt, preserve all outcomes, and either stop on any failure or continue the remaining gates only after a clean terminal pass.

No repository file was edited, staged, committed, merged, pushed, deployed, or otherwise mutated by this PM decision.

SOFTWARE ENGINEER HARD STOP — authorized full-E2E rerun failed

The one PM-authorized invocation was run exactly as approved:

npm --prefix backend run test:e2e

Start: 2026-08-30T05:24:14Z
End/termination: 2026-08-30T05:30:13Z
Playwright configuration retries: 0
Invocation count: 1; no hidden or manual rerun
Fresh main server: port 3001, owner token ebfe4bdc3336058d76300da8a8041d1d630a28be8655feb1
Failed journey server: port 44467, owner token 7ab6abef8acc372aff38bf63029bedd2a7e588185f599dbd
First observed failure: test 59, frontend-module-characterization.spec.js:177:3
Assertion: expected the page error collector to be empty; received one failed GET /work/api/notifications?limit=100 fetch with net::ERR_ABORTED
The canonical Cards/archive/Card/Task URLs, panels, titles, history restoration, and horizontal-overflow assertions all passed before the error-collector assertion.
Trace network evidence records three other GET /work/api/notifications?limit=100 responses as HTTP 200 during the same journey.
Test 60 was already in flight and printed a pass before the interrupt reached the runner. The process was then terminated with exit 130 under the PM first-failure stop rule.
Completed before stop: 59 passed and 1 failed of 99 tests. The 162-state capability reporter and issue Converge Newsletter, Calendar, and Mailing Export presentation #222 capture were not reached.
No new issue Converge Newsletter, Calendar, and Mailing Export presentation #222 screenshot ordinal was generated. The active exactly-12 set remains byte-identical to preserved ordinal D.
The prior state-77 ERR_NETWORK_CHANGED failure bundle remains retained and verifies independently.
No remaining gate was run. No source/test/config/evidence-contract edit was made.

Candidate identity after failure:

HEAD: 8c3b110c8aa138d95385a89fe3328749bdf47250
Tracked binary diff: cc1477a652572605c356a14666a299ebb36813367f921f8d7f7cd28217e4d22b
Staged diff: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Porcelain-v1-z: cf07ab4499f70208dea596fd97a41700a1452d078b5703a0e0db04a1e5170b5f
Changed-content manifest: b33338c636eabda78defd2544f175768e58ed51eb303da912606ea9cf37b296a
Authorized paths: 10 tracked plus 1 untracked, all unstaged/uncommitted

Cleanup evidence: ports 3001, 33219, and 44467 are free; the recorded owned server/worker PIDs are absent.

Disposition: hard stop and return to PM. This is not READY and no second rerun is authorized.

Failure evidence bundle: .tmp/issue-222-evidence/candidate-cc1477a6-contract-v2/failures/full-e2e-authorized-rerun-20260830-state59/

Final files.sha256 fingerprint: ea4cde249e425d5764859b133303c151e985b57d258ccc12555472289758166c.

PM VERIFICATION PROTOCOL APPROVED — final quiescent preflight plus one complete unchanged-candidate gate

Decision

APPROVED, narrowly, for the final verification protocol below.

The authorized rerun's result remains a real failed gate. It is not waived, reclassified as a pass, deleted from chronology, or replaced by older green evidence. The isolated preflight below is diagnostic admission control only; it cannot prove the 162-state catalog and cannot substitute for the complete unfiltered gate.

This disposition does not amend product behavior, assertions, tests, fixtures, reporter/capability accounting, screenshot contracts, source/SAM parity, or acceptance criteria. It is not DESIGN PASS, TESTER PASS, final PM acceptance, permission to commit, or permission to merge, push, or deploy.

Evidence basis

I read the Product Manager role, AGENTS.md, docs/PROCESS.md, the current composite #222 evidence contracts, the prior ERR_NETWORK_CHANGED hard stop and its one-rerun approval, and the latest hard stop in #issuecomment-5466940315. I inspected the current worktree and both preserved failure bundles read-only.

The latest preserved evidence supports a local transport abort rather than a #222 assertion or visual-state regression, but does not prove completion:

test 59 exercised all named Cards/archive/Card/Task URL, panel, title, history-restoration, and overflow assertions successfully before the error collector found one failed request;
the sole collected error was one same-origin GET /work/api/notifications?limit=100 fetch with net::ERR_ABORTED;
the same trace records three other notifications fetches returning HTTP 200 from the same owned server during that journey;
the runner had retries: 0; no second invocation occurred; 59 tests passed before the first failure and test 60, already in flight, printed a pass before the required interrupt;
the 162-state reporter and Converge Newsletter, Calendar, and Mailing Export presentation #222 capture were not reached, so no new screenshot ordinal exists and the current candidate still lacks a clean complete gate;
the latest bundle's files.sha256 fingerprint is ea4cde249e425d5764859b133303c151e985b57d258ccc12555472289758166c, and its recorded entries verify byte-for-byte from the worktree root;
the earlier ERR_NETWORK_CHANGED evidence remains separately preserved with manifest fingerprint b85323b91ce6789c2f9702d45344a5266fd228e6335c01dc536f10aee8dd4834.

Current candidate identity remains:

HEAD: 8c3b110c8aa138d95385a89fe3328749bdf47250;
tracked binary diff: cc1477a652572605c356a14666a299ebb36813367f921f8d7f7cd28217e4d22b;
staged diff: empty, SHA-256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855;
porcelain-v1-z: cf07ab4499f70208dea596fd97a41700a1452d078b5703a0e0db04a1e5170b5f;
changed-content manifest: b33338c636eabda78defd2544f175768e58ed51eb303da912606ea9cf37b296a;
authorized inventory: 10 tracked paths plus one untracked path, all unstaged and uncommitted;
active exactly-12 screenshot manifest: 3deac72578a42061819f804f0d6394ddb9acdb5966477eeb78a6c71db84133af, still preserved ordinal D with the current image-03/05/07 invariants.

Older successful 99/99 and 162/162 results remain useful history, but they may not be reused as proof for a stale or unjustified fingerprint. The current exact candidate must pass the full gate below.

Phase 0 — immutable identity and evidence preflight

Before running any browser command, record and verify all of the following in a new chronological directory under project-local private .tmp/issue-222-evidence/candidate-cc1477a6-contract-v2/:

Recompute HEAD, tracked binary diff, empty staged diff, porcelain-v1-z, changed-content manifest, and exact authorized path inventory; all must equal the identities above.
Recompute the active 12-image ordered manifest and image-03/05/07 invariant identities; they must equal ordinal D and the current composite contract.
Verify every non-self entry in both preserved failure manifests. Preserve both failed attempts in their existing chronological locations; do not delete, replace, rename, rewrite, truncate, or treat either as a pass.
Record CI state and the effective Playwright retry count. CI must remain unset for this local protocol and effective retries must be exactly zero.
Prove ports 3001, 33219, and 44467 are free; prove no DataOps test server, Playwright runner/worker, Chromium process, SAM process, or browser process from any worktree is alive. A fresh invocation must own every process and dynamic port it creates.
Record host link, address, and route state, then observe link/address/route events continuously for at least 30 seconds before the isolated preflight. The observation must be retained and empty. Any transition, monitor failure, or inability to establish process/port quiescence is a hard stop before consuming either browser command.
Record sufficient resource state to rule out local exhaustion: free disk/inodes for the worktree filesystem, available memory, process/file-descriptor limits, and current process count. Any exhausted or materially constrained state is a hard stop for investigation, not permission to run until green.

No source, test, fixture, config, dependency, browser version, environment contract, screenshot, invariant, or evidence-contract change may occur after identity capture.

Phase 1 — one isolated affected-journey preflight

Run exactly one terminal invocation of:

npm --prefix backend run test:e2e -- \
  e2e/frontend-module-characterization.spec.js \
  --grep "Cards, archive, card detail, and nested Task restore their canonical URLs" \
  --retries=0 --reporter=line

Requirements:

Playwright must report exactly one selected journey and exactly one pass.
The existing error collector must remain unchanged and empty: no request failure, page error, or disallowed console error, including no ERR_ABORTED or ERR_NETWORK_CHANGED.
The owned server health/ownership checks and all existing canonical URL, panel, title, history-restoration, and overflow assertions must pass.
Record exact command, start/end timestamps, complete stdout/stderr, exit status, Playwright/browser versions, selected/pass totals, server/browser ownership, dynamic ports, trace/artifact inventory, and teardown.
--reporter=line is allowed only because this is an explicitly focused preflight. This result does not count toward capability completeness.

If this preflight exits nonzero, selects anything other than the one named journey, records any transport/browser error, or cannot prove teardown, stop. Do not run it again and do not start Phase 2. Preserve the result and return to PM/Tester with a root-cause disposition request.

Inter-phase quiescence

After a clean Phase 1:

prove all Phase-1-owned server, Playwright, and Chromium processes are gone and all owned ports are free;
recompute the candidate/source/evidence fingerprints and require exact equality;
observe another retained, empty 30-second link/address/route quiescence window;
keep continuous link/address/route monitoring active and logged through Phase 2.

Any discrepancy or network-state event is a hard stop. Do not consume Phase 2.

Phase 2 — one final complete unfiltered no-retry gate

Run exactly one terminal invocation of:

npm --prefix backend run test:e2e

This command must remain unfiltered and use the configured capability reporter. No reporter override is allowed. Effective Playwright retries must be exactly zero.

A qualifying result requires all of the following together:

exit status 0 without manual intervention;
all 99 expected browser journeys pass in the single invocation;
the configured reporter proves all 162/162 stable capability states;
no request failure, page error, disallowed console error, timeout, process interruption, accessibility failure, assertion failure, source/SAM failure, or capability-accounting failure occurs;
the continuous host-network monitor records no link/address/route transition;
any generated Converge Newsletter, Calendar, and Mailing Export presentation #222 captures become the next chronological ordinal and satisfy the complete current image-03/05/07 and exact-nine screenshot contracts, with all originals and comparison evidence retained;
all owned processes and ports tear down cleanly;
the source and evidence fingerprints remain exact after the run.

Record the exact command, timestamps, full stdout/stderr, exit status, all totals, capability report, process ownership, ports, network-monitor output, artifact inventory, screenshot chronology, and teardown evidence.

Prohibitions

The following are explicitly prohibited throughout this protocol:

Playwright retries, retry configuration, a second isolated preflight, a second full invocation, or rerunning a failed browser/test within an invocation;
hidden, unlogged, exploratory, partial, selected, shard, grep, focused, or reporter-overridden runs other than the one exact Phase-1 command above;
source, assertion, selector, fixture, timing, timeout, reporter, catalog, config, dependency, browser, test-server, screenshot-capture, or environment-contract changes;
skips, fixme, expected-failure markers, capability exclusions, weakened accounting, or treating transport errors as passes;
deleting, replacing, truncating, restoring over, reordering, or concealing either prior failure or any new failure evidence;
selecting a preferred screenshot variant, restoring ordinal D after a later capture, or redefining the final ordinal;
reusing any old green result or stale fingerprint as current proof without exact identity and chronology justification;
commit, merge, push, deploy, provider, private-data, credential, or HUMAN action.

No assertion failure is waived. A nonzero full gate remains a failed full gate even if its symptom appears environmental.

Stop conditions and finality

Stop immediately and preserve chronology if any prerequisite fails, any command selects unexpected tests, any transport/browser/network event occurs, either command exits nonzero, any assertion/capability/accessibility/source/SAM/screenshot contract fails, any fingerprint drifts, evidence is incomplete, or teardown leaks.

There is no additional PM rerun allowance after Phase 1 or Phase 2. If either phase fails, #222 verification is BLOCKED from further rerun-based disposition until a separately groomed root-cause issue establishes and verifies a deterministic local transport/runtime repair or the execution environment is demonstrably stabilized. Do not solve that blocker by changing #222 source under this protocol.

Continuation after a qualifying full pass

If—and only if—both phases qualify and Phase 2 proves 99/99 plus 162/162 from the exact unchanged candidate, Software Engineer may resume the remaining complete workflow and final refreeze sequence required by #issuecomment-5466796237.

The two preserved failed full attempts remain in the audit chronology. The new successful full result does not erase them. The final reviewed screenshot ordinal is the last chronologically executed successful source capture after the complete Software Engineer workflow, never a selected variant.

Fresh Product Designer final-candidate review, fresh independent Tester full verification, and final PM acceptance remain mandatory before commit. If independent Tester regenerates screenshots, that regeneration is the next ordinal under the same composite contract.

Disposition

PM VERIFICATION PROTOCOL APPROVED. One exact isolated affected-journey preflight followed, only after full quiescence and a clean result, by one exact unchanged-candidate unfiltered no-retry full gate is authorized.

Next owner: Software Engineer to execute the protocol exactly, retain every outcome, and either hard-stop on the first discrepancy or continue only after a qualifying 99/99 and 162/162 result.

No repository file was edited, staged, committed, merged, pushed, deployed, or otherwise mutated by this PM decision.

SOFTWARE ENGINEER HARD STOP — final protocol Phase 0 process quiescence failed

I did not consume either authorized browser invocation. Phase 0 found active Playwright runners and Chromium/browser descendants from two other worktrees, which violates the approved prerequisite requiring no Playwright, Chromium, or browser process from any worktree before the network-quiescence admission window.

Observed active worktree owners:

/data/agents/ai-shipping-labs/worktrees/swe-1451: active pytest Playwright suite, four Playwright driver processes, and live Chromium descendants.
/data/agents/ai-shipping-labs/worktrees/swe-1491: active pytest Playwright suite, four Playwright driver processes, and live Chromium descendants.

The recorded process snapshot contains 10 direct worktree Playwright entries; the retained process trees prove their Chromium descendants. These processes are not owned by #222, so they were not interrupted or modified.

Other Phase-0 facts:

HEAD, tracked diff, empty index, porcelain, changed-content manifest, and the authorized 10-tracked-plus-1-untracked inventory match the approved identities.
The active exactly-12 screenshot set and all image-03/05/07 invariants are byte-identical to preserved ordinal D.
Both prior full-gate failure bundles remain in their original locations; their manifest fingerprints match and every non-self entry verifies.
CI is unset and effective Playwright retries are zero.
Required ports 3001, 33219, and 44467 are free.
Disk, inodes, memory, process/file limits, current link/address state, and route state were recorded; no local resource is exhausted.
The mandatory 30-second network observation was not started because the earlier process-quiescence prerequisite had already failed.
Phase-1 invocations: 0. Phase-2 invocations: 0. No screenshot ordinal was generated.
Candidate remains unstaged and uncommitted; no source, test, fixture, config, dependency, screenshot, invariant, or contract was changed.

Disposition: hard stop before browser execution. The execution environment must be demonstrably free of other-worktree Playwright/Chromium activity before this final protocol can begin. No rerun/test allowance was consumed.

Evidence directory: .tmp/issue-222-evidence/candidate-cc1477a6-contract-v2/verification/final-protocol-phase0-process-conflict-20260830/

Final files.sha256 fingerprint: ae1ae44cb321232c3f5df8fdbe398e0649d8c26c464e7c96a4fc0d7570a72ae1.

PM PROTOCOL IDENTITY AMENDMENT APPROVED — immutable user-authorized checkpoint only

Decision

APPROVED, narrowly, to translate the final protocol's candidate-identity checks from the formerly unstaged/uncommitted representation to the user-authorized immutable checkpoint commit.

This amendment changes only how the unchanged candidate is identified. It does not waive or alter any product behavior, acceptance criterion, assertion, fixture, capability accounting, source/SAM parity requirement, evidence chronology, screenshot contract, quiescence prerequisite, command, retry prohibition, stop condition, or review gate.

Read-only identity verification

I read the complete Product Manager role, docs/PROCESS.md, the full issue body, the governing screenshot/refreeze amendment in #issuecomment-5466796237, the two preserved full-gate hard stops and rerun disposition, the final protocol approval in #issuecomment-5466956731, and the Phase-0 hard stop in #issuecomment-5466972888. I ran no browser command and made no repository-file or Git-state change.

The committed candidate verifies exactly:

checkpoint commit: 65fb9a8392ed76cc55e74a9b783e352914169411;
parent: 8c3b110c8aa138d95385a89fe3328749bdf47250;
tree: fd3fc78356d8eb5dcb47dbc41d152d61968b005d;
the binary diff for the ten formerly tracked paths, excluding the formerly untracked dedicated spec, remains exactly cc1477a652572605c356a14666a299ebb36813367f921f8d7f7cd28217e4d22b;
backend/e2e/issue-222-planning-presentation.spec.js is now tracked with file SHA-256 9ae0d35057b78438701f046fc2ccb86fd05e87096884822e015ec9e42aed75ed;
the complete parent-to-checkpoint binary diff SHA-256 is cf883fb180559e0e552c7a328509470dd496a10dc9b711ab1e16b05d8b07dbc4;
the existing eleven-file changed-content manifest still verifies byte-for-byte and retains SHA-256 b33338c636eabda78defd2544f175768e58ed51eb303da912606ea9cf37b296a;
the worktree and index are clean; both porcelain-v1-z and staged-binary-diff empty-output SHA-256 values are e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855.

The checkpoint contains exactly these eleven candidate paths and no others:

backend/e2e/calendar-seams.spec.js
backend/e2e/canonical-capability-behavior.spec.js
backend/e2e/issue-218-shared-primitives.spec.js
backend/e2e/issue-222-planning-presentation.spec.js
backend/e2e/planning-surfaces-design.spec.js
backend/scripts/test-server.ts
frontend/src/styles.css
frontend/src/surfaces/finance/mailing.js
frontend/src/surfaces/planning.js
frontend/test/finance-surface.test.mjs
frontend/test/planning-surface.test.mjs

These checks prove that the checkpoint changed representation only; candidate content did not change.

Exact Phase-0 and refreeze translation

For #issuecomment-5466956731 and the remaining refreeze/review sequence in #issuecomment-5466796237, supersede only the old mutable representation identity:

old HEAD 8c3b110... plus ten tracked modifications and one untracked file;
old nonempty porcelain fingerprint cf07ab....

The authoritative candidate identity is now the checkpoint commit, parent, tree, eleven-path inventory, ten-path compatibility diff hash, dedicated-spec file hash, complete binary-diff hash, unchanged content-manifest hash, and clean index/worktree hashes listed above.

Phase 0 and every inter-phase/final refreeze must require exact equality to these immutable identities. Any commit, tree, parent, path, file-content, diff, manifest, index, or worktree drift is a hard stop.

All existing private evidence remains governed by its original chronology and identities. Both failed full-gate bundles must remain intact. Ordinal D and every image-03/05/07 invariant and exact-nine screenshot rule remain unchanged. The commit does not select, regenerate, replace, or legitimize any screenshot ordinal.

Protocol status and retained constraints

The Phase-0 process-quiescence stop consumed neither browser allowance. Once—and only once—the host satisfies the approved process, port, resource, and retained 30-second network-quiescence prerequisites, the Software Engineer remains authorized to execute:

exactly one isolated affected-journey preflight with the exact approved command and --reporter=line;
only after a qualifying Phase 1 and inter-phase quiescence, exactly one unfiltered npm --prefix backend run test:e2e invocation with configured capability reporting and zero retries.

Every behavioral, evidence, quiescence, one-preflight/one-full-run, screenshot, preservation, teardown, stop, and no-rerun constraint remains intact. Any Phase-1 or Phase-2 failure still ends rerun-based verification under the approved protocol. No browser command was run for this disposition.

Lifecycle status

The user-authorized checkpoint commit is not DESIGN PASS, TESTER PASS, final PM acceptance, permission to merge, permission to push, or permission to deploy. It does not make the failed gates pass and does not advance #222 beyond the Phase-0 waiting state.

If this exact immutable checkpoint completes the protocol and then receives fresh Product Designer review, independent Tester PASS, and final PM acceptance on the same identities, no additional commit is required merely to restate the already committed bytes. No additional commit should be created unless fixes result. Any fix changes candidate identity, ends this unchanged-candidate protocol path, and requires a new explicit disposition/refreeze and the applicable review gates.

Disposition

PM PROTOCOL IDENTITY AMENDMENT APPROVED. Resume Phase 0 only after the host is demonstrably quiescent, using checkpoint 65fb9a8392ed76cc55e74a9b783e352914169411 as the immutable unchanged candidate.

Next owner: Software Engineer, after the documented quiescence prerequisite is satisfied.

No repository file was edited, staged, merged, pushed, deployed, or otherwise mutated by this PM decision. The only external write is this issue comment.

PM TRACKER RECONCILIATION — lifecycle metadata now records immutable user-authorized checkpoint 65fb9a8392ed76cc55e74a9b783e352914169411 and the approved PM identity amendment only. This is not DESIGN PASS, TESTER PASS, final PM acceptance, merge, push, deployment, shipment, or closure. Resume remains conditional on exact host/process/port/resource/network quiescence; the one-preflight/one-full-run, evidence chronology, hard-stop, and no-rerun constraints remain unchanged. Fresh Designer, independent Tester, and PM gates remain pending.

Closing during the Oct-5 branch cleanup: the Aug-30 implementation (commit SHAs recorded earlier in this thread) was discarded rather than merged — it predates the Oct-3 frontend redesign and no longer applies. Re-groom a fresh issue if this work is still wanted on the current frontend.

Converge Newsletter, Calendar, and Mailing Export presentation #222

Description

Converge Newsletter, Calendar, and Mailing Export presentation

Product outcome

Frozen baseline and dependency reconciliation

Criterion-to-current-source inventory at 78e9122

Scope

Bounded write set

Acceptance criteria

Newsletter chronology and recovery

Calendar desktop, mobile agenda, and source honesty

Mailing Export next-action language

Responsive, visual, and accessibility

Behavior, privacy, and parity

Test scenarios

Shuffled Newsletter chronology

Newsletter refresh outage and recovery

Desktop Calendar and mobile agenda

Independent overlay outage

Calendar refresh outage

Exact Mailing next actions

Source/SAM identity

Synthetic screenshot inventory

Required verification

Lifecycle gates

Out of scope

Activity

alexeygrigorev commented on Aug 29, 2026

alexeygrigorev commented on Aug 30, 2026

alexeygrigorev commented on Aug 30, 2026

alexeygrigorev commented on Aug 30, 2026

alexeygrigorev commented on Aug 30, 2026

alexeygrigorev commented on Aug 30, 2026

Narrow PM amendment request — accepted #218 regression label

13 remaining items

alexeygrigorev commented on Aug 30, 2026

DESIGN EVIDENCE CONTRACT UPDATE APPROVED — image 03 only, not final candidate review

Design-equivalence decision

Exact named exception: image 03

Native format and numerical caps

Permitted regions and cause

Exact image 03 semantic/DOM/font/scroll/layout invariants

Contract retained unchanged for every other image

Repeat-run, reviewed-ordinal, and inspection procedure

Prohibitions and hard failures

Disposition

alexeygrigorev commented on Aug 30, 2026

PM AMENDMENT APPROVED — image 03 named Skia edge exception only

Decision and authority

Exact named exception

Exact image-03 invariants

Existing contract retained

Mandatory rerun, refreeze, and review sequence

Required artifacts

Prohibitions

Hard failures

Disposition

alexeygrigorev commented on Aug 30, 2026

SOFTWARE ENGINEER — HARD STOP: image 07 exceeds the approved A/B/C contract

Exact failure

Root-cause classification

Preserved evidence and identity

Narrow PM + Designer decision required

alexeygrigorev commented on Aug 30, 2026

DESIGN EVIDENCE CONTRACT UPDATE APPROVED — image 07 only, not final candidate review

Design-equivalence decision

Exact image-07 contract update

Unchanged authority and failure boundary

Disposition

alexeygrigorev commented on Aug 30, 2026

PM AMENDMENT APPROVED — image 07 symmetric Calendar-grid edge only

Decision and authority

Exact image-07 amendment

Exact invariants retained

All other screenshot contracts retained

Repeat-run, refreeze, and review sequence

Prohibitions retained

Stop conditions

Disposition

alexeygrigorev commented on Aug 30, 2026

Criterion-to-current-source inventory at `78e9122`