docs(02): session handoff — resumable state, shared-tree hazards, next actions

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.planning/phases/02-ui-performance/.continue-here.md

@@ -0,0 +1,98 @@
+# Continue Here — Phase 02 (ui-performance) close-out
+
+**Written:** 2026-07-31, mid-session (user changing wifi; session may drop)
+**Milestone:** v1.8.0 · **Phase 02 status:** executed, gap closure in progress
+
+## Where we are in one paragraph
+
+Phase 02's 8 plans all executed and were signed off by the user on real hardware.
+`gsd-verifier` then returned **gaps_found (6/8 must-haves)**, which routed into
+`/gsd-plan-phase 2 --gaps` → gap plans **02-09** (Server remount) and **02-10**
+(timing verdict). 02-09 is **COMPLETE** — it proved the "Server.vue remounts"
+finding was a *probe-measurement artifact*, not a defect (no source change needed;
+regression tests now pin instance survival via `vm.$.uid`). 02-10 is still running.
+A separate code review found and fixed 1 Critical + 6 Warnings; a follow-up security
+task is also in flight. Once 02-10 and the security task land, **re-run the verifier**;
+if it passes, mark the phase complete.
+
+## Critical hazards — read before ANY git command
+
+1. **SHARED WORKING TREE.** The user runs a SEPARATE session on **BotFights (phase 9)**
+   in this same checkout. Their uncommitted work is interleaved with ours.
+   - NEVER `git add -A` / `git add .` / `git commit -a` / `git stash` (stash refs are
+     shared — it strands their work) / `git checkout|restore` files you didn't edit /
+     `git reset --hard`.
+   - Stage ONLY exact paths you personally modified.
+   - Known to be THEIRS (do not stage/revert/modify): `releases/app-catalog.json`
+     (regenerated catalog, ~5090 lines, BotFights registry work),
+     `neode-ui/src/components/LightningChannelsPanel.vue`, `neode-ui/package-lock.json`,
+     `.planning/config.json`, `scripts/resilience/.gitignore-reports.tmp`.
+   - `neode-ui/src/views/AppDetails.vue` and `Cloud.vue` may hold a MIX of their edits
+     and our persist-audit edits — inspect `git diff -- <file>` hunk by hunk; never
+     commit a hunk you didn't write.
+2. **DO NOT DEPLOY** to archi-dev-box right now. A frontend deploy would ship their
+   in-progress BotFights work plus unreviewed security changes to the node together.
+3. **Never touch the user's dev servers:** `:8100` (vite), `:5959` (mock backend),
+   `:5173` (AIUI dev), `:3141` (claude-api-proxy). Never use broad `pkill` patterns —
+   an earlier agent killed the user's `:8100` session that way. Kill only exact PIDs
+   you started; use port 8104+ for your own.
+
+## Critical anti-patterns
+
+| Anti-pattern | Severity | Why |
+|---|---|---|
+| Changing existing visuals/animations during perf or refactor work | blocking | 02-02's KeepAlive restructure broke page margins and the up/down slide transitions; caught only at a human checkpoint, needed a dedicated fix commit. Perf work must be visually invisible. `keepAliveTabs.test.ts` structurally pins the DOM shape — if a change breaks it, the change is wrong. |
+| Broad `pkill` / `git add -A` / `git stash` in a shared tree | blocking | Both have already destroyed or risked others' work in this project this session. |
+| Parking review/verifier findings as "advisory" | blocking | User's explicit rule: findings get fixed in the same run, not deferred. |
+| Trusting a CSS-selector remount probe | major | The generic `.view-container [data-controller-container]` selector cannot disambiguate the foreground tab from other still-connected KeepAlive-cached tabs; it produced a false "Server remounts" verdict that cost a whole gap-closure cycle. Use `vm.$.uid` (see `keepalive-remount-probe.spec.ts`). |
+
+## In-flight background agents (may still be running)
+
+| Agent | Owns | Deliverable |
+|---|---|---|
+| 02-10 executor | `02-PERF-REMEASURE.json`, `02-FINDINGS.md`, `02-10-SUMMARY.md`, STATE/ROADMAP | Verdict for 6 surfaces: cleared-as-noise / fixed / accepted deviation |
+| security follow-up | `stores/resources.ts`, `composables/useCachedResource.ts`, persist call sites, `vite.config.ts`, `PWAUpdatePrompt.vue`, `02-REVIEW.md` | One-time snapshot purge, `persist` required everywhere, PWA auto-update |
+
+If neither has committed and both are gone, their work is recoverable from the plan
+files and `02-REVIEW.md`; re-dispatch rather than guessing.
+
+## Next actions, in order
+
+1. Wait for / confirm 02-10 + security follow-up commits.
+2. **Re-run `gsd-verifier` on phase 02** against `02-VERIFICATION.md`'s two gaps
+   (gap 1 closed by 02-09; gap 2 by 02-10). If passed → `phase.complete`.
+3. **VPS2 domain migration** — see `.planning/todos/pending/2026-07-30-migrate-source-references-to-https-domain.md`.
+   ~196 refs of `146.59.87.168` → `https://source.archipelago-foundation.org`;
+   `companion.archipelago-foundation.org` and `fips.archipelago-foundation.org` are now
+   live (DNS verified). Needs a core Rust rebuild + on-node verification. NOTE:
+   `core/target` was deleted to reclaim disk, so the first cargo build will be slow.
+4. **Phase 1 (federation & mesh hardening)** — 10 existing plans, PLUS a required gap
+   plan for the 8 items the user added on 2026-07-30: FED-07 (fedimint gateway ships
+   with a pre-set password — security blocker) and UIFIX-01..06 (FIPS/Tor pills on
+   mobile, connected-nodes scroll height, onboarding tickbox on short screens, Paid
+   Files lightbox, PiP robustness incl. surviving tab switches + buffering, loader
+   states). See ROADMAP phase 1 criteria 7-13 and `.planning/todos/pending/`.
+
+## Environment facts
+
+- This machine **IS** archi-dev-box (Tailscale MagicDNS; also `100.69.68.39`). Deploys
+  are loopback SSH: `ARCHIPELAGO_TARGET=archipelago@archi-dev-box scripts/deploy-to-target.sh --frontend-only`.
+- UI password for archi-dev-box: **ask the user** — pass at runtime as `ARCHY_PASSWORD`
+  env var only, never written to any file or commit.
+- `archy-x250-dev` (dev pair's 2nd node) is **offline/gone** — dev-pair verification is
+  deferred; run single-node and record the gap honestly.
+- AIUI source: `https://git.tx1138.com/lfg2025/AIUI`, working branch `development`,
+  local clone at `/home/archipelago/Projects/AIUI`. D-14 embed defaults + embed
+  round-trip fixes are pushed upstream.
+- git remote `gitea-ai` now uses HTTPS via `source.archipelago-foundation.org`.
+- Node disk was at 85%; ~118G reclaimed (`core/target`, `image-recipe/build`, caches).
+  `image-recipe/results` (~34G of ISOs) was deliberately NOT deleted — needs user OK.
+
+## Known-open, user-accepted items (do not re-litigate)
+
+- Timing regressions on Discover/Web5/Fleet/AppDetails/OpenWrtGateway — 02-10 is
+  producing the verdict.
+- `/dashboard/settings` deliberately withheld from KeepAlive (unaudited side effects
+  in its child sections).
+- `PeerFiles.vue` raw-store loading/refreshing conflation; `CloudFolder.vue` TTL gate —
+  both flagged, out of phase 02 scope.