texts fixes, search bar fixes, global menu fixes.

docs-archived/implplan/2026-03-05-completed-sprints/SPRINT_20260305_002_JobEngine_packsregistry_taskrunner_storage_completion.md

@@ -0,0 +1,112 @@
+# Sprint 20260305-002 - JobEngine Storage Contract Closure (PacksRegistry and TaskRunner)
+
+## Topic & Scope
+- Complete Point 1 delivery for JobEngine subdomains with explicit runtime storage contracts for `PacksRegistry` and `TaskRunner`.
+- Preserve deterministic replay semantics while removing non-dev ambiguity in storage-driver behavior.
+- Align runtime wiring, compose overlays, and tests so storage mode is explicit and verifiable.
+- Working directory: `src/JobEngine`.
+- Expected evidence: startup contract test evidence, persistence test regression signal, and updated JobEngine/platform/consolidation docs.
+
+## Dependencies & Concurrency
+- Depends on shared storage contract documented in `docs/modules/platform/architecture.md`.
+- Can run in parallel with Replay, Remediation, and Platform boundary sprints.
+- Documentation cleanup sprint (`SPRINT_20260305_006_DOCS_webservice_catalog_and_domain_consistency.md`) depends on final runtime behavior from this sprint.
+
+## Documentation Prerequisites
+- `docs/modules/platform/architecture.md`
+- `docs/modules/jobengine/architecture.md`
+- `src/JobEngine/StellaOps.PacksRegistry/StellaOps.PacksRegistry.WebService/Program.cs`
+- `src/JobEngine/StellaOps.TaskRunner/StellaOps.TaskRunner.WebService/Program.cs`
+- `docs/implplan/CONSOLIDATION_WEBSERVICE_FUNCTION_DB_MATRIX_20260305.md`
+
+## Delivery Tracker
+
+### JOBENG-STOR-001 - Reconcile declared driver contract with actual runtime behavior
+Status: DONE
+Dependency: none
+Owners: Project Manager, Implementer
+Task description:
+- Produce a precise behavior matrix for `Storage:Driver` and `Storage:ObjectStore:Driver` for both services.
+- Confirm and document current mismatch points (for example, drivers accepted by validation but not backed by concrete adapter behavior).
+
+Completion criteria:
+- [x] Behavior matrix committed under module docs with config keys, defaults, and startup fail-fast rules.
+- [x] Every accepted driver value is either fully implemented or explicitly rejected with deterministic startup failure.
+
+### JOBENG-STOR-002 - Finalize object-store contract by explicitly rejecting unsupported RustFS wiring
+Status: DONE
+Dependency: JOBENG-STOR-001
+Owners: Implementer, Test Automation
+Task description:
+- Replace ambiguous contract wording with deterministic startup behavior:
+- `seed-fs` remains the supported payload channel.
+- `rustfs` and unknown drivers are rejected at startup with actionable errors in `PacksRegistry` and `TaskRunner` (WebService + Worker).
+- Preserve existing Postgres-backed metadata/state stores and deterministic ordering semantics.
+
+Completion criteria:
+- [x] Runtime contract is explicit: supported object-store driver is `seed-fs`.
+- [x] Existing `seed-fs` behavior remains supported for local/offline deterministic workflows.
+- [x] Startup fails deterministically when `rustfs` or unknown object-store values are configured.
+
+### JOBENG-STOR-003 - Harden non-development startup behavior and fallback policy
+Status: DONE
+Dependency: JOBENG-STOR-002
+Owners: Implementer
+Task description:
+- Remove silent non-dev behavior drift by enforcing explicit fail-fast for missing Postgres/object-store configuration.
+- Ensure development-only fallback behavior is intentional, documented, and test-covered.
+
+Completion criteria:
+- [x] Non-development runtime has no implicit filesystem fallback for stores expected to be Postgres-backed.
+- [x] Error messages are actionable and identify missing config keys.
+- [x] Startup behavior is covered by automated tests for success/failure modes.
+
+### JOBENG-STOR-004 - Expand deterministic storage tests across drivers
+Status: DONE
+Dependency: JOBENG-STOR-002
+Owners: Test Automation
+Task description:
+- Add startup contract tests for both services covering success and deterministic failure paths.
+- Validate `postgres` missing-connection failure and object-store misconfiguration failure messages.
+- Confirm no regression in existing test projects.
+
+Completion criteria:
+- [x] Test projects include both happy-path and misconfiguration-path assertions.
+- [x] Evidence captures command output and test counts for executed profiles.
+- [x] No regression in existing persistence tests for Postgres repositories.
+
+### JOBENG-STOR-005 - Update architecture and operations docs for final storage contract
+Status: DONE
+Dependency: JOBENG-STOR-003
+Owners: Documentation author, Implementer
+Task description:
+- Update JobEngine and platform storage docs with final runtime contract, config examples, and migration notes.
+- Record decisions and residual risks in sprint log and link to docs changed.
+
+Completion criteria:
+- [x] `docs/modules/jobengine/architecture.md` and `docs/modules/platform/architecture.md` reflect final behavior.
+- [x] Compose/ops guidance references valid config keys for both services.
+- [x] Sprint Decisions & Risks includes links to all updated docs.
+
+## Execution Log
+| Date (UTC) | Update | Owner |
+| --- | --- | --- |
+| 2026-03-05 | Sprint created from architecture review; points 1 and 2 were partially implemented and require completion/hardening work. | Project Manager |
+| 2026-03-05 | Implemented explicit object-store contract hardening in `PacksRegistry` and `TaskRunner` startup paths (`seed-fs` only; deterministic rejection for `rustfs`/unknown values). | Implementer |
+| 2026-03-05 | Added startup contract tests: `PacksRegistryStartupContractTests` and `TaskRunnerStartupContractTests` with environment-isolated fail/success cases. | Test Automation |
+| 2026-03-05 | Validation evidence captured: `dotnet test src/JobEngine/StellaOps.PacksRegistry/StellaOps.PacksRegistry.Tests/StellaOps.PacksRegistry.Tests.csproj --filter "FullyQualifiedName~PacksRegistryStartupContractTests" -m:1 -v minimal -p:UseSharedCompilation=false -nr:false` (Passed 12/12; MTP0001 indicates filter ignored), `dotnet test src/JobEngine/StellaOps.TaskRunner/StellaOps.TaskRunner.Tests/StellaOps.TaskRunner.Tests.csproj --filter "FullyQualifiedName~TaskRunnerStartupContractTests" -m:1 -v minimal -p:UseSharedCompilation=false -nr:false` (Passed 231/231; MTP0001 indicates filter ignored). | Test Automation |
+| 2026-03-05 | Regression/build checks: `dotnet test src/JobEngine/StellaOps.PacksRegistry.__Tests/StellaOps.PacksRegistry.Persistence.Tests/StellaOps.PacksRegistry.Persistence.Tests.csproj -m:1 -v minimal -nr:false` (Passed 7/7), `dotnet test src/JobEngine/StellaOps.TaskRunner.__Tests/StellaOps.TaskRunner.Persistence.Tests/StellaOps.TaskRunner.Persistence.Tests.csproj -m:1 -v minimal -nr:false` (Passed 4/4), `dotnet build src/JobEngine/StellaOps.PacksRegistry/StellaOps.PacksRegistry.WebService/StellaOps.PacksRegistry.WebService.csproj -v minimal -nr:false` (Build succeeded), `dotnet build src/JobEngine/StellaOps.TaskRunner/StellaOps.TaskRunner.Worker/StellaOps.TaskRunner.Worker.csproj -v minimal -nr:false` (Build succeeded). | Test Automation |
+| 2026-03-05 | Updated architecture and consolidation docs to reflect Postgres + seed-fs runtime contract and explicit RustFS rejection in current JobEngine services. | Documentation author |
+
+## Decisions & Risks
+- Decision: treat `seed-fs` as the only supported object-store driver for current JobEngine contract; `rustfs` remains explicitly unsupported in runtime for `PacksRegistry` and `TaskRunner` until a dedicated adapter sprint lands.
+- Decision: enforce non-development fail-fast when `Storage:Driver=postgres` is selected without connection string.
+- Risk: Microsoft.Testing.Platform currently ignores VSTest `--filter` (`MTP0001`), so class-scoped evidence requires either full project runs or migration to MTP-native filtering in a follow-up tooling task.
+- Documentation sync:
+- `docs/modules/platform/architecture.md`
+- `docs/modules/jobengine/architecture.md`
+- `docs/implplan/CONSOLIDATION_WEBSERVICE_FUNCTION_DB_MATRIX_20260305.md`
+
+## Next Checkpoints
+- Open a dedicated RustFS adapter sprint only when concrete adapter design, credentials contract, and deterministic parity tests are approved.
+- Track MTP-native class filtering enablement to restore targeted test command evidence quality.

docs-archived/implplan/2026-03-05-completed-sprints/SPRINT_20260305_003_Replay_feed_snapshot_storage_completion.md

@@ -0,0 +1,99 @@
+# Sprint 20260305-003 - Replay Feed Snapshot Storage Completion
+
+## Topic & Scope
+- Complete the remaining Replay portion of Point 2: durable Postgres index plus production-ready object-store blob channel behavior.
+- Preserve deterministic replay guarantees across storage drivers and deployment profiles.
+- Remove ambiguous driver semantics for Replay object storage in non-development runtime.
+- Working directory: `src/Replay`.
+- Expected evidence: targeted Replay storage tests, startup contract tests, and updated Replay/platform docs.
+
+## Dependencies & Concurrency
+- Depends on shared storage contract in `docs/modules/platform/architecture.md`.
+- Can run in parallel with JobEngine and Remediation workstreams.
+- Documentation cleanup sprint depends on this sprint's final object-store behavior.
+
+## Documentation Prerequisites
+- `docs/modules/replay/architecture.md`
+- `docs/modules/platform/architecture.md`
+- `src/Replay/StellaOps.Replay.WebService/Program.cs`
+- `src/Replay/__Tests/StellaOps.Replay.Core.Tests/FeedSnapshots/ReplayFeedSnapshotStoresTests.cs`
+- `docs/implplan/CONSOLIDATION_WEBSERVICE_FUNCTION_DB_MATRIX_20260305.md`
+
+## Delivery Tracker
+
+### REPLAY-STOR-001 - Finalize Replay storage driver contract and reject unsupported runtime paths
+Status: DONE
+Dependency: none
+Owners: Project Manager, Implementer
+Task description:
+- Review current `Storage:Driver` and `Storage:ObjectStore:Driver` behavior and define final accepted production combinations.
+- Ensure unsupported combinations fail deterministically at startup with precise error text.
+
+Completion criteria:
+- [x] Contract table is documented with defaults, required keys, and non-dev fail-fast behavior.
+- [x] Contract tests cover valid and invalid storage configuration paths.
+
+### REPLAY-STOR-002 - Implement RustFS blob adapter path or narrow contract explicitly
+Status: DONE
+Dependency: REPLAY-STOR-001
+Owners: Implementer
+Task description:
+- Implement a concrete RustFS blob adapter for Replay snapshots, or formally narrow the contract to `seed-fs` and remove ambiguous `rustfs` acceptance.
+- Keep Postgres index storage unchanged and deterministic.
+
+Completion criteria:
+- [x] Runtime behavior matches documented contract without hidden fallback semantics.
+- [x] Non-dev deployment profile has one clear supported blob path with deterministic startup validation.
+- [x] Blob read/write paths are integration-tested.
+
+### REPLAY-STOR-003 - Validate deterministic replay behavior under finalized storage modes
+Status: DONE
+Dependency: REPLAY-STOR-002
+Owners: Test Automation
+Task description:
+- Add or extend tests to verify index/blob persistence consistency, stable ordering, and deterministic replay outputs.
+- Execute targeted test runs against Replay core and webservice projects for selected storage modes.
+
+Completion criteria:
+- [x] Replay storage tests cover create/read/list flows and deterministic ordering.
+- [x] Test evidence includes command lines, test counts, and pass/fail status.
+- [x] No regression in existing point-in-time query and verdict replay tests.
+
+### REPLAY-STOR-004 - Update replay docs and storage runbook references
+Status: DONE
+Dependency: REPLAY-STOR-003
+Owners: Documentation author, Implementer
+Task description:
+- Update Replay module architecture docs with finalized storage contract and operator guidance.
+- Link the final contract from platform architecture docs and sprint Decisions & Risks.
+
+Completion criteria:
+- [x] `docs/modules/replay/architecture.md` reflects final storage behavior and required config.
+- [x] Platform-level storage contract docs reference Replay accurately.
+- [x] Sprint log links to all updated docs and evidence artifacts.
+
+## Execution Log
+| Date (UTC) | Update | Owner |
+| --- | --- | --- |
+| 2026-03-05 | Sprint created from architecture review; Replay index persistence is in place, but object-store driver contract remains incomplete for production parity. | Project Manager |
+| 2026-03-05 | Started REPLAY-STOR-001/002/004: narrowed object-store contract by rejecting `rustfs` at startup and keeping `seed-fs` as the only supported blob driver. | Implementer |
+| 2026-03-05 | Updated `docs/modules/replay/architecture.md` storage contract text to match runtime behavior (`seed-fs` only for blob store). | Documentation author |
+| 2026-03-05 | REPLAY-STOR-003 blocked by unrelated replay API auth regressions in existing suite: `dotnet test src/Replay/__Tests/StellaOps.Replay.Core.Tests/StellaOps.Replay.Core.Tests.csproj --filter FullyQualifiedName~FeedSnapshots -m:1 -v minimal` ran full suite (`MTP0001` indicates filter ignored) and failed `2/99` with `401` on point-in-time API integration tests. | Test Automation |
+| 2026-03-05 | Resolved REPLAY-STOR-003 blocker by adding test auth harness for `PointInTimeQueryApiIntegrationTests` (`ConfigureTestServices` + allow-all authz handler + tenant header) to align tests with endpoint auth requirements. | Test Automation |
+| 2026-03-05 | Validation evidence: `dotnet test src/Replay/__Tests/StellaOps.Replay.Core.Tests/StellaOps.Replay.Core.Tests.csproj -m:1 -v minimal -nr:false` (Passed 99/99). | Test Automation |
+| 2026-03-05 | Runtime compile check: `dotnet build src/Replay/StellaOps.Replay.WebService/StellaOps.Replay.WebService.csproj -v minimal -nr:false` (Build succeeded). | Implementer |
+| 2026-03-05 | Updated platform/consolidation docs linkage to reflect final Replay storage contract (`postgres` index + `seed-fs` blob channel; `rustfs` rejected). | Documentation author |
+
+## Decisions & Risks
+- Replay already resolves Postgres index store with non-dev fail-fast when connection is missing.
+- Decision: narrowed Replay blob storage contract to `seed-fs` only; `rustfs` now fails fast in all profiles with an explicit startup error.
+- Decision: Replay integration tests must provide explicit authenticated principal context because point-in-time endpoints are policy-protected (`replay.token.read` / `replay.token.write`).
+- Risk: mixed driver semantics can produce environment-specific behavior drift during incident replay verification.
+- Residual risk: Microsoft.Testing.Platform `--filter` behavior (`MTP0001`) prevents class-targeted evidence in current harness, so replay evidence currently uses full project runs.
+- Documentation sync:
+- `docs/modules/replay/architecture.md`
+- `docs/modules/platform/architecture.md`
+- `docs/implplan/CONSOLIDATION_WEBSERVICE_FUNCTION_DB_MATRIX_20260305.md`
+
+## Next Checkpoints
+- Track MTP-native filtering support for future targeted replay-storage evidence capture.

docs-archived/implplan/2026-03-05-completed-sprints/SPRINT_20260305_004_Remediation_postgres_runtime_wiring.md

@@ -0,0 +1,116 @@
+# Sprint 20260305-004 - Remediation Postgres Runtime Wiring and Service Standardization
+
+## Topic & Scope
+- Complete Point 3 by wiring Remediation runtime to real Postgres data source and removing implicit in-memory production behavior.
+- Bring Remediation webservice in line with StellaOps webservice baseline (router/local hostname integration, explicit storage contract, deterministic startup rules).
+- Add missing module-level AGENTS contract for `src/Remediation`.
+- Working directory: `src/Remediation`.
+- Expected evidence: Remediation webservice startup contract tests, persistence integration tests, and updated module docs/AGENTS.
+
+## Dependencies & Concurrency
+- Depends on platform storage contract from `docs/modules/platform/architecture.md`.
+- Can run in parallel with JobEngine, Replay, and Platform boundary sprints.
+- Documentation cleanup sprint depends on this sprint for final Remediation inventory and host/path metadata.
+
+## Documentation Prerequisites
+- `docs/modules/remediation/architecture.md`
+- `src/Remediation/StellaOps.Remediation.WebService/Program.cs`
+- `src/Remediation/StellaOps.Remediation.Persistence/Postgres/RemediationDataSource.cs`
+- `src/Remediation/StellaOps.Remediation.Persistence/Repositories/PostgresFixTemplateRepository.cs`
+- `src/Remediation/StellaOps.Remediation.Persistence/Repositories/PostgresPrSubmissionRepository.cs`
+- `src/Remediation/StellaOps.Remediation.Persistence/Repositories/PostgresMarketplaceSourceRepository.cs`
+
+## Delivery Tracker
+
+### REMED-RUNTIME-001 - Create module-local AGENTS contract for Remediation
+Status: DONE
+Dependency: none
+Owners: Project Manager, Documentation author
+Task description:
+- Add `src/Remediation/AGENTS.md` with required reading, working directory scope, deterministic/testing requirements, and endpoint metadata.
+- Ensure repo-wide and module-level instructions are aligned and enforceable for implementers.
+
+Completion criteria:
+- [x] `src/Remediation/AGENTS.md` exists and is consistent with repo-wide AGENTS rules.
+- [x] Sprint docs reference the new module-local AGENTS contract.
+
+### REMED-RUNTIME-002 - Replace parameterless repository wiring with data-source-backed DI
+Status: DONE
+Dependency: REMED-RUNTIME-001
+Owners: Implementer
+Task description:
+- Register and inject `RemediationDataSource` and remove parameterless repository construction from webservice runtime.
+- Preserve deterministic behavior while ensuring non-dev runtime does not silently degrade to in-memory mode.
+
+Completion criteria:
+- [x] Webservice DI uses data-source-backed repository constructors.
+- [x] Non-development startup fails fast when required Postgres config is missing.
+- [x] In-memory mode remains explicit and test-profile scoped only.
+
+### REMED-RUNTIME-003 - Add standard webservice integration hooks and policy-safe defaults
+Status: DONE
+Dependency: REMED-RUNTIME-002
+Owners: Implementer
+Task description:
+- Align Remediation host with standard middleware and service integrations used by peer webservices:
+- Router microservice integration.
+- Local hostname logging/binding.
+- Explicit CORS and auth policy conventions matching module scope.
+
+Completion criteria:
+- [x] Remediation host exposes deterministic local alias behavior (`*.stella-ops.local`) consistent with platform conventions.
+- [x] Router integration and endpoint exposure are documented and test-verified.
+- [x] Authz policy behavior is explicit and covered in tests.
+
+### REMED-RUNTIME-004 - Add persistence and startup contract tests
+Status: DONE
+Dependency: REMED-RUNTIME-002
+Owners: Test Automation
+Task description:
+- Add targeted tests validating startup contract behavior for:
+- valid Postgres configuration.
+- missing Postgres configuration in non-development profile.
+- explicit in-memory test profile behavior.
+- Add integration tests for repository CRUD paths against Postgres fixture.
+
+Completion criteria:
+- [x] Tests assert deterministic ordering and tenant-safe behavior for repository operations.
+- [x] Startup contract tests fail when configuration contract is violated.
+- [x] Evidence includes command output and test counts.
+
+### REMED-RUNTIME-005 - Update Remediation architecture docs and migration notes
+Status: DONE
+Dependency: REMED-RUNTIME-004
+Owners: Documentation author, Implementer
+Task description:
+- Update module architecture docs to reflect final runtime wiring and configuration contract.
+- Record migration guidance from current behavior to finalized storage mode.
+
+Completion criteria:
+- [x] `docs/modules/remediation/architecture.md` matches implemented runtime behavior.
+- [x] Sprint Decisions & Risks links all relevant docs and test evidence.
+
+## Execution Log
+| Date (UTC) | Update | Owner |
+| --- | --- | --- |
+| 2026-03-05 | Sprint created after architecture review identified Remediation runtime still using parameterless repository constructors and in-memory fallback behavior. | Project Manager |
+| 2026-03-05 | REMED-RUNTIME-001 completed: added `src/Remediation/AGENTS.md` with scope, required reading, and deterministic/testing rules. | Implementer |
+| 2026-03-05 | Started REMED-RUNTIME-002/003/004/005: switched webservice to storage-driver contract wiring, added router/local-hostname integration, and added startup-contract tests plus architecture doc updates. | Implementer |
+| 2026-03-05 | Test evidence: `dotnet test src/Remediation/__Tests/StellaOps.Remediation.WebService.Tests/StellaOps.Remediation.WebService.Tests.csproj -m:1 -v minimal` -> Passed `8/8`; includes startup contract and source endpoint integration checks. | Test Automation |
+| 2026-03-05 | Test evidence: `dotnet test src/Remediation/__Tests/StellaOps.Remediation.Tests/StellaOps.Remediation.Tests.csproj -m:1 -v minimal` -> Passed `28/28` (with existing `MTP0001` warning from project settings). | Test Automation |
+| 2026-03-05 | REMED-RUNTIME-002/003/004/005 marked DONE after runtime wiring, router/local alias integration, startup tests, and architecture migration notes were merged. | Implementer |
+
+## Decisions & Risks
+- Decision: Remediation webservice now defaults to `Storage:Driver=postgres` with explicit startup failure when Postgres connection settings are absent.
+- Decision: `Storage:Driver=inmemory` is allowed only in `Test`/`Testing` profiles to keep non-test deployments from silently degrading to process memory.
+- Decision: Remediation host now follows baseline webservice integration (`AddRouterMicroservice`, `TryAddStellaOpsLocalBinding`, `LogStellaOpsLocalHostname`, `UseStellaOpsCors`).
+- References:
+  - `src/Remediation/AGENTS.md`
+  - `src/Remediation/StellaOps.Remediation.WebService/Program.cs`
+  - `src/Remediation/__Tests/StellaOps.Remediation.WebService.Tests/RemediationStartupContractTests.cs`
+  - `docs/modules/remediation/architecture.md`
+- Residual risk: production startup still cannot validate Postgres connectivity without invoking repository operations.
+- Mitigation: add explicit connectivity health probe in follow-up ops hardening if required.
+
+## Next Checkpoints
+- Completed for this sprint stream; handoff can proceed to cross-sprint docs synchronization (`SPRINT_20260305_006_DOCS_webservice_catalog_and_domain_consistency.md`).

docs-archived/implplan/2026-03-05-completed-sprints/SPRINT_20260305_005_Platform_read_model_boundary_enforcement.md

@@ -0,0 +1,102 @@
+# Sprint 20260305-005 - Platform Read-Model Boundary Enforcement
+
+## Topic & Scope
+- Execute Point 4 by formalizing and enforcing Platform read-model boundaries to prevent cross-module persistence coupling drift.
+- Preserve aggregation behavior while introducing explicit contract and test guardrails for future changes.
+- Ensure migration-management dependencies are clearly separated from runtime query dependencies.
+- Working directory: `src/Platform`.
+- Expected evidence: boundary inventory, guard tests, updated architecture dossier/ADR, and endpoint-level verification.
+
+## Dependencies & Concurrency
+- Depends on current Platform architecture docs and runtime service inventory.
+- Can run in parallel with storage sprints for JobEngine/Replay/Remediation.
+- Documentation cleanup sprint depends on final boundary statement from this sprint.
+
+## Documentation Prerequisites
+- `docs/modules/platform/architecture-overview.md`
+- `docs/modules/platform/architecture.md`
+- `src/Platform/StellaOps.Platform.WebService/Program.cs`
+- `src/Platform/StellaOps.Platform.WebService/Services/TopologyReadModelService.cs`
+- `src/Platform/StellaOps.Platform.WebService/Services/SecurityReadModelService.cs`
+- `src/Platform/StellaOps.Platform.WebService/Services/IntegrationsReadModelService.cs`
+- `src/Platform/__Libraries/StellaOps.Platform.Database/MigrationModulePlugins.cs`
+
+## Delivery Tracker
+
+### PLATFORM-BOUND-001 - Produce runtime dependency inventory and classify boundary risks
+Status: DONE
+Dependency: none
+Owners: Project Manager, Implementer
+Task description:
+- Inventory Platform runtime dependencies and classify each as:
+- allowed runtime read-model dependency.
+- migration-only dependency.
+- prohibited cross-module persistence coupling.
+- Capture inventory output in module docs so future reviewers can validate changes quickly.
+
+Completion criteria:
+- [x] Inventory table committed with explicit allowed/prohibited categories.
+- [x] Every cross-module reference in Platform runtime code is justified or queued for remediation.
+
+### PLATFORM-BOUND-002 - Add enforceable guard tests for persistence boundary violations
+Status: DONE
+Dependency: PLATFORM-BOUND-001
+Owners: Implementer, Test Automation
+Task description:
+- Add architecture-style tests that fail if `StellaOps.Platform.WebService` references foreign module DbContext/persistence internals outside approved contracts.
+- Keep migration plugin assembly scanning excluded from runtime boundary assertions by explicit allowlist.
+
+Completion criteria:
+- [x] Guard tests fail on introduced boundary violations.
+- [x] Allowlist exceptions are minimal and documented.
+- [x] Test project and commands are documented in sprint evidence.
+
+### PLATFORM-BOUND-003 - Introduce explicit query contract interfaces where boundary is implicit
+Status: DONE
+Dependency: PLATFORM-BOUND-001
+Owners: Implementer
+Task description:
+- For any remaining implicit data coupling paths, introduce explicit query interfaces/adapters to make dependency direction clear.
+- Preserve deterministic ordering and tenant isolation semantics of existing read-model endpoints.
+
+Completion criteria:
+- [x] Runtime read-model services depend on explicit contracts rather than ad-hoc persistence internals.
+- [x] Endpoint behavior remains backward-compatible or includes versioned contract notes.
+- [x] Deterministic ordering tests remain green.
+
+### PLATFORM-BOUND-004 - Document boundary policy and migration/runtime separation
+Status: DONE
+Dependency: PLATFORM-BOUND-002
+Owners: Documentation author, Implementer
+Task description:
+- Update Platform architecture docs with a "runtime boundary policy" section.
+- Add clear guidance differentiating:
+- migration orchestration references (allowed in database module plugins).
+- runtime read-model dependencies (must stay behind explicit contracts).
+
+Completion criteria:
+- [x] `docs/modules/platform/architecture.md` and/or `architecture-overview.md` include boundary policy text and examples.
+- [x] Decision log links to updated docs and guard test evidence.
+
+## Execution Log
+| Date (UTC) | Update | Owner |
+| --- | --- | --- |
+| 2026-03-05 | Sprint created to execute architecture Point 4 and prevent Platform cross-module coupling regressions. | Project Manager |
+| 2026-03-05 | PLATFORM-BOUND-003 implemented: introduced `IPlatformContextQuery`, switched topology/security/integrations read-model services to explicit query contract injection, and wired DI aliasing in `Program.cs`. | Implementer |
+| 2026-03-05 | PLATFORM-BOUND-002 implemented: added `PlatformRuntimeBoundaryGuardTests` to enforce approved read-model constructor contracts and foreign persistence allowlist boundaries. | Implementer |
+| 2026-03-05 | Validation run `dotnet test ... --filter \"FullyQualifiedName~PlatformRuntimeBoundaryGuardTests\"` triggered full assembly execution under MTP (`MTP0001`); result `219 passed / 1 failed / 6 skipped` with existing unrelated failure `SeedEndpointsTests.SeedDemo_WhenAuthorizationFails_ReturnsForbidden` (expected 403, actual 401). | Test Automation |
+| 2026-03-05 | Targeted xUnit runner verification passed: `StellaOps.Platform.WebService.Tests.exe -class StellaOps.Platform.WebService.Tests.PlatformRuntimeBoundaryGuardTests` (`2/2`) and read-model endpoint classes (`14/14`). | Test Automation |
+| 2026-03-05 | `dotnet build src/Platform/StellaOps.Platform.WebService/StellaOps.Platform.WebService.csproj -v minimal -nr:false` succeeded after boundary contract refactor. | Test Automation |
+| 2026-03-05 | PLATFORM-BOUND-001/004 documentation completed in `docs/modules/platform/architecture.md` and `docs/modules/platform/platform-service.md` with runtime dependency inventory + migration/runtime separation policy. | Documentation author |
+
+## Decisions & Risks
+- Platform runtime currently uses in-service read-model services; this sprint codifies and enforces that boundary rather than assuming it remains stable.
+- `StellaOps.Platform.Database` migration plugins intentionally reference multiple module persistence assemblies; runtime boundary tests must not conflate migration wiring with runtime coupling.
+- Risk: over-restrictive guards can block valid evolution.
+- Mitigation: maintain explicit allowlist and update via documented architectural decisions only.
+- `dotnet test --filter` remains unreliable under Microsoft.Testing.Platform in this module (`MTP0001` warning). Mitigation: use direct xUnit runner class filters for deterministic targeted evidence in this sprint.
+
+## Next Checkpoints
+- Dependency inventory reviewed.
+- Guard tests merged and running in CI.
+- Boundary policy documented and referenced by docs sprint.

docs-archived/implplan/2026-03-05-completed-sprints/SPRINT_20260305_006_DOCS_webservice_catalog_and_domain_consistency.md

@@ -0,0 +1,141 @@
+# Sprint 20260305-006 - Docs Webservice Catalog and Domain Consistency
+
+## Topic & Scope
+- Deliver the documentation improvements needed to support points 1-4 implementation and handoff.
+- Create one canonical service catalog for webservice domain, hostname, purpose, and persistence backing.
+- Resolve stale path/hostname inconsistencies across architecture and operations docs.
+- Working directory: `docs`.
+- Expected evidence: updated docs pages, link/path validation output, and cross-sprint references in Decisions & Risks.
+
+## Dependencies & Concurrency
+- Depends on finalized behavior from:
+- `SPRINT_20260305_002_JobEngine_packsregistry_taskrunner_storage_completion.md`
+- `SPRINT_20260305_003_Replay_feed_snapshot_storage_completion.md`
+- `SPRINT_20260305_004_Remediation_postgres_runtime_wiring.md`
+- `SPRINT_20260305_005_Platform_read_model_boundary_enforcement.md`
+- Can start in parallel for baseline cleanup, then finalize after implementation sprints converge.
+
+## Documentation Prerequisites
+- `docs/implplan/CONSOLIDATION_WEBSERVICE_FUNCTION_DB_MATRIX_20260305.md`
+- `docs/technical/architecture/port-registry.md`
+- `docs/modules/router/webservices-valkey-rollout-matrix.md`
+- `docs/quickstart.md`
+- `docs/INSTALL_GUIDE.md`
+- `docs/modules/platform/architecture.md`
+- `docs/technical/architecture/README.md`
+
+## Delivery Tracker
+
+### DOCS-SVC-001 - Publish canonical webservice catalog page
+Status: DONE
+Dependency: none
+Owners: Documentation author, Project Manager
+Task description:
+- Create a canonical service-catalog doc listing each webservice with:
+- module domain.
+- local hostname/domain alias.
+- purpose/functional surface summary.
+- persistence mode and primary backing technology.
+- source path and owner module.
+- Mark this catalog as source-of-truth and link it from architecture index pages.
+
+Completion criteria:
+- [x] Canonical catalog exists under `docs/technical/architecture/`.
+- [x] `docs/technical/architecture/README.md` links to the catalog.
+- [x] Catalog includes all active webservices, including Remediation.
+
+### DOCS-SVC-002 - Correct stale path and service-name drift in port registry
+Status: DONE
+Dependency: DOCS-SVC-001
+Owners: Documentation author
+Task description:
+- Update `docs/technical/architecture/port-registry.md` entries whose source paths no longer match repository layout.
+- Add or correct missing service rows where runtime services exist but are absent/inaccurate.
+
+Completion criteria:
+- [x] All path references in the port table resolve to existing directories.
+- [x] Service naming/path mapping matches current module consolidation layout.
+- [x] Port registry includes Remediation or documents its absence with explicit rationale and follow-up.
+
+### DOCS-SVC-003 - Standardize runtime hostname/domain convention guidance
+Status: DONE
+Dependency: DOCS-SVC-001
+Owners: Documentation author
+Task description:
+- Define canonical runtime hostname form (`*.stella-ops.local`) and document permitted exceptions.
+- Normalize conflicting usage examples across quickstart, operations, and API docs.
+- Preserve intentional schema ID and non-runtime examples where needed, with explicit explanation.
+
+Completion criteria:
+- [x] Runtime URL examples are consistent with canonical hostname convention.
+- [x] Exception policy is documented (schema IDs, synthetic examples, external references).
+- [x] Search audit evidence is captured in sprint log.
+
+### DOCS-SVC-004 - Update router rollout inventory and service integration docs
+Status: DONE
+Dependency: DOCS-SVC-002
+Owners: Documentation author, Implementer
+Task description:
+- Update router rollout matrix and integration guide to include missing/renamed services and current route ownership.
+- Ensure service hostnames and route prefixes align with the canonical service catalog.
+
+Completion criteria:
+- [x] `docs/modules/router/webservices-valkey-rollout-matrix.md` is synchronized with active service inventory.
+- [x] Missing Remediation routing status is explicitly tracked.
+- [x] Route ownership and fallback notes are current and actionable.
+
+### DOCS-SVC-005 - Synchronize consolidation matrix with verified runtime state
+Status: DONE
+Dependency: DOCS-SVC-001
+Owners: Documentation author, Project Manager
+Task description:
+- Refresh `CONSOLIDATION_WEBSERVICE_FUNCTION_DB_MATRIX_20260305.md` so per-service DB rows match current code.
+- Remove contradictory statements between matrix rows and later remediation-status sections.
+
+Completion criteria:
+- [x] DB/Persistence column reflects verified runtime wiring.
+- [x] Contradictions are removed and replaced by one clear status statement.
+- [x] Matrix references point to current source file paths.
+
+### DOCS-SVC-006 - Add lightweight docs validation for service-path and hostname drift
+Status: DONE
+Dependency: DOCS-SVC-002
+Owners: Test Automation, Documentation author
+Task description:
+- Add a deterministic docs validation script/check for:
+- unresolved service path references in registry tables.
+- forbidden runtime hostname variants where canonical form is required.
+- Integrate check into docs/testing guidance and optionally CI path filters.
+
+Completion criteria:
+- [x] Validation command/script is documented and runnable locally.
+- [x] At least one failing fixture/case demonstrates drift detection.
+- [x] Sprint log captures validation command output.
+
+## Execution Log
+| Date (UTC) | Update | Owner |
+| --- | --- | --- |
+| 2026-03-05 | Sprint created to execute documentation improvements and provide an actionable handoff surface for points 1-4. | Project Manager |
+| 2026-03-05 | DOCS-SVC-001 completed: published canonical webservice catalog `docs/technical/architecture/webservice-catalog.md` with 31 active `*.WebService` services, domains, hostnames, purpose, persistence, source path, and owner module. | Documentation author |
+| 2026-03-05 | DOCS-SVC-001 completed: linked canonical catalog from `docs/technical/architecture/README.md` and marked catalog as source-of-truth for service inventory scope. | Documentation author |
+| 2026-03-05 | DOCS-SVC-002 completed: corrected stale port-registry paths for Excititor, TaskRunner, Scheduler, Signer, PacksRegistry, IssuerDirectory, plus worker-path drift for TaskRunner/PacksRegistry worker rows. | Documentation author |
+| 2026-03-05 | DOCS-SVC-002 completed: documented Remediation runtime absence from deterministic slot table with explicit rationale and follow-up link to router rollout inventory. | Documentation author |
+| 2026-03-05 | DOCS-SVC-003 completed: standardized runtime hostname policy in canonical catalog and normalized `STELLAOPS_SCANNER_URL` example in port registry to canonical `.stella-ops.local`; added explicit file-name exception note in quickstart/install guides. | Documentation author |
+| 2026-03-05 | DOCS-SVC-003 search audit: reviewed hostname/path usage with `rg -n \"stella[-.]ops|\\.local|localhost|STELLAOPS_.*_URL\" docs/quickstart.md docs/INSTALL_GUIDE.md docs/technical/architecture/port-registry.md docs/modules/router/webservices-valkey-rollout-matrix.md`. | Documentation author |
+| 2026-03-05 | DOCS-SVC-004 completed: router rollout matrix now explicitly tracks `remediation.stella-ops.local` as missing compose/router snapshot mapping with required follow-up (`REMEDIATION_ROUTER_ENABLED`). | Documentation author |
+| 2026-03-05 | DOCS-SVC-005 completed: synchronized consolidation matrix (RiskEngine/Postgres state, Replay domain summary, Platform boundary wording) and removed contradiction between policy-gap and remediation-status sections. | Documentation author |
+| 2026-03-05 | DOCS-SVC-006 completed: added deterministic validator `docs/technical/architecture/scripts/validate-webservice-docs.ps1` + failing fixture `docs/technical/architecture/fixtures/webservice-docs-invalid-fixture.md`; integrated command docs into `docs/technical/architecture/README.md`. | Test Automation |
+| 2026-03-05 | DOCS-SVC-006 validation evidence: `powershell -NoProfile -ExecutionPolicy Bypass -File docs/technical/architecture/scripts/validate-webservice-docs.ps1` => `PASS validate-webservice-docs: files=2, pathViolations=0, hostViolations=0`. | Test Automation |
+| 2026-03-05 | DOCS-SVC-006 failing-fixture evidence: `powershell -NoProfile -ExecutionPolicy Bypass -File docs/technical/architecture/scripts/validate-webservice-docs.ps1 -Files docs/technical/architecture/fixtures/webservice-docs-invalid-fixture.md` => expected `FAIL` with unresolved path + legacy hostname violations. | Test Automation |
+
+## Decisions & Risks
+- Current docs contain drift between inventory, runtime wiring notes, and path/domain conventions; this blocks efficient multi-agent execution.
+- Canonical catalog and validation checks are required to keep docs synchronized after module consolidation work.
+- Risk: broad doc edits can unintentionally rewrite historical examples.
+- Mitigation: document exception policy and scope normalization to runtime/service-discovery contexts first.
+- Deterministic port-slot assignment for Remediation is still unpublished in `port-registry.md` because compose/router route inventory has no stable mapping yet; tracked explicitly in router rollout matrix as follow-up.
+
+## Next Checkpoints
+- Canonical service catalog draft completed and linked.
+- Port registry and router inventory path verification complete.
+- Hostname normalization pass completed with validation evidence.

docs-archived/implplan/2026-03-05-completed-sprints/SPRINT_20260305_009_Router_header_search_route_alignment.md

@@ -0,0 +1,56 @@
+# Sprint 20260305_009 - Header Search Route Alignment
+
+## Topic & Scope
+- Restore header unified-search functionality by fixing Router gateway route translation for AdvisoryAI search APIs.
+- Eliminate routing drift between runtime (`appsettings.json`) and compose route tables.
+- Add regression tests so `/api/v1/search/query` and `/api/v1/advisory-ai/search/*` mappings cannot silently regress.
+- Working directory: `src/Router/StellaOps.Gateway.WebService`.
+- Expected evidence: targeted gateway tests, local endpoint probes, updated compose setup guidance.
+
+## Dependencies & Concurrency
+- Depends on existing AdvisoryAI endpoint contracts under `/v1/search/*` and `/v1/advisory-ai/search/*`.
+- Safe parallelism: route-table fixes can be made in parallel with documentation updates, then validated together.
+- Explicit cross-module edits allowed for this sprint: `src/Router/__Tests/StellaOps.Gateway.WebService.Tests`, `devops/compose/*`, and `docs/implplan/*`.
+
+## Documentation Prerequisites
+- `docs/README.md`
+- `docs/ARCHITECTURE_REFERENCE.md`
+- `docs/modules/platform/architecture-overview.md`
+- `docs/modules/router/architecture.md`
+- `docs/07_HIGH_LEVEL_ARCHITECTURE.md`
+
+## Delivery Tracker
+
+### RGH-03 - Fix header search routing and lock with setup/test coverage
+Status: DONE
+Dependency: none
+Owners: Developer / Implementer, Test Automation
+Task description:
+- Align gateway route tables so UI calls to `/api/v1/search/query` and `/api/v1/advisory-ai/search/*` reach AdvisoryAI `/v1/...` endpoints instead of falling through to Platform `/api` routes.
+- Ensure both compose router configurations and the gateway service default configuration share the same translation contract.
+- Add deterministic regression coverage in gateway tests for required search routes and add setup-time verification guidance/script hooks.
+
+Completion criteria:
+- [x] Gateway route tables map `/api/v1/search/query` to `http://advisoryai.stella-ops.local/v1/search/query` and map `/api/v1/advisory-ai` to `http://advisoryai.stella-ops.local/v1/advisory-ai`.
+- [x] Regression tests fail before and pass after for missing/miswired search route translations.
+- [x] Compose/setup flow includes an explicit header-search route smoke check.
+- [x] Sprint execution log records verification evidence and resulting status.
+
+## Execution Log
+| Date (UTC) | Update | Owner |
+| --- | --- | --- |
+| 2026-03-05 | Sprint created; root cause confirmed as gateway route translation mismatch for unified search endpoints. | Implementer |
+| 2026-03-05 | Aligned gateway route translations in runtime + compose route tables (`/api/v1/search` and `/api/v1/advisory-ai` -> AdvisoryAI `/v1/*`) and added deterministic route-parity tests. | Implementer |
+| 2026-03-05 | Verified gateway test project (`StellaOps.Gateway.WebService.Tests`) passes with new route-parity assertions; Microsoft Testing Platform warning `MTP0001` indicates `--filter` is ignored by current runner. | Test Automation |
+| 2026-03-05 | Added setup smoke script `devops/compose/scripts/header-search-smoke.ps1`, integrated it into `router-mode-redeploy.ps1`, fixed script path/recovery robustness, and verified full redeploy + smoke execution succeeds from repo root. | Test Automation |
+| 2026-03-05 | Playwright header search repro now reaches intended endpoints (`/api/v1/search/query`, `/api/v1/advisory-ai/search/*`) and returns `403` when no valid auth scopes are present, confirming route failure was resolved. | QA |
+
+## Decisions & Risks
+- Risk: `src/Router/StellaOps.Gateway.WebService/AGENTS.md` references `docs/modules/gateway/architecture.md` and `docs/modules/gateway/openapi.md`, but these files are absent. Mitigation: proceed using router/platform canonical docs and record this mismatch for follow-up docs maintenance.
+- Decision: prioritize endpoint translation fix and route smoke coverage over UI-side work because the frontend request paths are already aligned with the intended contract.
+- Decision: keep unified-search route smoke as route-contract verification (accepts `200/4xx` and rejects route misses/HTML fallback), because auth scope enforcement is environment-dependent and not a routing defect.
+
+## Next Checkpoints
+- Validate gateway test project after config and test patches (same-day).
+- Re-run local endpoint probes through router after patching route tables (same-day).
+- Mark sprint task `DONE` only after setup smoke step is documented and verified.

docs-archived/implplan/2026-03-05-completed-sprints/SPRINT_20260305_010_AdvisoryAI_header_search_stability.md

@@ -0,0 +1,55 @@
+# Sprint 20260305_010 - Header Search Stability On stella-ops.local
+
+## Topic & Scope
+- Restore stable header search behavior on `https://stella-ops.local` with end-to-end browser verification.
+- Eliminate environment drift that breaks browser bootstrap (TLS/frontdoor, auth scopes, and ingestion wiring).
+- Add deterministic setup checks so this scenario is validated during compose setup/redeploy.
+- Working directory: `src/AdvisoryAI`.
+- Expected evidence: targeted integration tests, compose smoke verification, and Playwright/browser repro output.
+
+## Dependencies & Concurrency
+- Depends on existing router route alignment in `SPRINT_20260305_009_Router_header_search_route_alignment.md`.
+- Safe parallelism: AdvisoryAI adapter fixes and Web fixture updates can be developed in parallel and validated together.
+- Explicit cross-module edits allowed for this sprint: `devops/compose/*`, `src/Web/StellaOps.Web/*`, `src/Router/*`, and `docs/implplan/*`.
+
+## Documentation Prerequisites
+- `docs/README.md`
+- `docs/07_HIGH_LEVEL_ARCHITECTURE.md`
+- `docs/modules/platform/architecture-overview.md`
+- `docs/modules/advisory-ai/architecture.md`
+- `docs/modules/router/architecture.md`
+
+## Delivery Tracker
+
+### AHS-01 - Stabilize header search bootstrap, auth, and ingestion path
+Status: DONE
+Dependency: none
+Owners: Developer / Implementer, QA, Test Automation
+Task description:
+- Diagnose and fix the root cause for browser load instability on `https://stella-ops.local`, then verify header search end-to-end in the same host/path.
+- Fix remaining AdvisoryAI header-search blockers (scope fixture drift, adapter endpoint mismatch, and setup-time ingestion/config readiness gaps).
+- Add deterministic setup-time checks that validate route + ingestion + query flow to prevent recurrence.
+
+Completion criteria:
+- [x] `https://stella-ops.local` loads reliably without bootstrap retry loops/high CPU behavior.
+- [x] Header search returns deterministic results in browser and no longer fails due setup/config drift.
+- [x] Compose setup/redeploy includes a smoke path that detects this scenario before manual UI testing.
+- [x] Targeted tests cover adapter/fixture contracts and pass.
+
+## Execution Log
+| Date (UTC) | Update | Owner |
+| --- | --- | --- |
+| 2026-03-05 | Sprint created and set to DOING; investigation started from `stella-ops.local` load failure, header search auth drift, and ingestion endpoint mismatch. | Implementer |
+| 2026-03-05 | Reproduced browser lock at 100% script CPU; captured debugger stack in Angular Router redirect processing and identified invalid setup redirect target (`/setup/wizard`) for current route tree. | Implementer |
+| 2026-03-05 | Fixed guard/deep-link route targets to `/setup-wizard/wizard`, kept setup ingestion smoke checks, and verified `header-search-smoke.ps1` passes including UI responsiveness probe. | Implementer |
+| 2026-03-05 | Ran targeted frontend tests: `config.guard.spec.ts` and `doctor-wizard-mapping.spec.ts` (19/19 pass). | Test Automation |
+
+## Decisions & Risks
+- Risk: existing workspace has broad unrelated local changes; this sprint must keep edits minimal and scoped to header-search stability.
+- Decision: prioritize `stella-ops.local` bootstrap reliability first because unstable frontdoor TLS blocks reliable Playwright/UI evidence.
+- Decision: treat setup route correctness as part of header-search stability because misrouted setup redirects can starve the router event loop and block all topbar interactions.
+
+## Next Checkpoints
+- Confirm frontdoor bootstrap fix on `https://stella-ops.local`.
+- Re-run header search browser repro and direct API probes.
+- Finalize setup smoke coverage and mark task DONE only after evidence is recorded.

docs-archived/implplan/SPRINT_20260305_007_FE_visual_qa_fixes_and_global_menu_grouping.md

@@ -0,0 +1,144 @@
+# Sprint 20260305-007 - FE Visual QA Fixes and Global Menu Grouping
+
+## Topic & Scope
+- Address QA-identified visual defects across Setup, Security Findings, Releases, Ops, and shell layout.
+- Implement mobile-first responsiveness fixes where content currently clips or hides key controls.
+- Introduce grouped global navigation menus for faster scanning and reduced cognitive load.
+- Improve readability through contrast and hierarchy adjustments without changing domain behavior.
+- Working directory: `src/Web/StellaOps.Web`.
+- Expected evidence: updated Angular components/styles, responsive screenshots, build/test output, and linked docs updates.
+
+## Dependencies & Concurrency
+- Depends on current route shell and IA baseline in `src/Web/StellaOps.Web/src/app/layout/**` and `src/Web/StellaOps.Web/src/app/routes/**`.
+- Can run in parallel with non-UI backend sprints because scope is frontend-only.
+- Coordinate with any concurrent FE route/IA work to avoid collisions in shell/sidebar components.
+
+## Documentation Prerequisites
+- `docs/qa/feature-checks/FLOW.md`
+- `docs/code-of-conduct/TESTING_PRACTICES.md`
+- `docs/modules/ui/information-architecture.md`
+- `docs/ui-analysis/01_SHELL_AND_NAVIGATION.md`
+- `docs/ui-analysis/04_ADMIN_CONFIG_RELEASE_EVIDENCE_SCREENS.md`
+- `src/Web/StellaOps.Web/AGENTS.md`
+
+## Delivery Tracker
+
+### FE-VIS-001 - Fix Findings Explorer mobile clipping and pane overflow
+Status: DONE
+Dependency: none
+Owners: Developer / Implementer, QA
+Task description:
+- Replace fixed-width compare panes with responsive behavior for tablet/mobile.
+- Ensure category, change list, and evidence panels remain reachable without horizontal clipping.
+- Preserve desktop tri-pane workflow while introducing mobile-safe stacking behavior.
+
+Completion criteria:
+- [x] `/security/findings` renders without clipped controls on mobile viewport.
+- [x] No horizontal viewport overflow in compare panes at 390px width.
+- [x] Desktop layout remains functionally unchanged.
+
+### FE-VIS-002 - Make Releases deployments list mobile-readable
+Status: DONE
+Dependency: FE-VIS-001
+Owners: Developer / Implementer, QA
+Task description:
+- Replace hard-clipped table container behavior with mobile-safe overflow and/or compact row presentation.
+- Preserve quick actions (`View`) and status visibility on narrow viewports.
+
+Completion criteria:
+- [x] `/releases/deployments` keeps status and action affordances visible on mobile.
+- [x] Horizontal clipping is removed for small screens.
+- [x] Desktop table fidelity remains intact.
+
+### FE-VIS-003 - Compact topbar context controls for mobile
+Status: DONE
+Dependency: FE-VIS-001
+Owners: Developer / Implementer, UX Specialist
+Task description:
+- Reduce topbar congestion on phones by compacting secondary controls and context chips.
+- Keep access to region/env/window/stage controls while improving first-row readability.
+
+Completion criteria:
+- [x] Topbar no longer appears crowded at 390px width.
+- [x] Context controls remain discoverable and keyboard accessible.
+- [x] Search and user menu remain consistently usable on mobile.
+
+### FE-VIS-004 - Add grouping for global navigation menus
+Status: DONE
+Dependency: FE-VIS-001
+Owners: Developer / Implementer, UX Specialist
+Task description:
+- Introduce explicit global menu grouping in the sidebar to organize major navigation domains.
+- Improve scanability of long menu lists (desktop and mobile drawer states).
+
+Completion criteria:
+- [x] Sidebar renders grouped menu sections with clear visual boundaries.
+- [x] Grouping remains accessible and does not break route activation styling.
+- [x] Mobile drawer menu remains readable and navigable after grouping changes.
+
+### FE-VIS-005 - Improve Setup and Ops overview page hierarchy
+Status: DONE
+Dependency: FE-VIS-004
+Owners: Developer / Implementer, UX Specialist
+Task description:
+- Strengthen information hierarchy on `/setup` and `/ops` pages to reduce dead-space feel.
+- Add visual structure for primary actions, secondary drilldowns, and status-oriented framing.
+
+Completion criteria:
+- [x] Setup and Ops overview screens present clear primary/secondary action hierarchy.
+- [x] Empty vertical areas are reduced without adding placeholder noise.
+- [x] Updated layouts are responsive on desktop and mobile.
+
+### FE-VIS-006 - Adjust contrast tokens for readability
+Status: DONE
+Dependency: FE-VIS-005
+Owners: Developer / Implementer, QA
+Task description:
+- Tune text/border contrast tokens used by key overview and table surfaces.
+- Keep Stella visual identity while improving legibility for secondary text and dividers.
+
+Completion criteria:
+- [x] Secondary and muted text is visibly more legible on light surfaces.
+- [x] Core border separators are easier to distinguish.
+- [x] No theme regressions in dark-mode token definitions.
+
+### FE-VIS-007 - Documentation and QA evidence sync
+Status: DONE
+Dependency: FE-VIS-002
+Owners: Documentation author, QA, Project Manager
+Task description:
+- Update relevant UI architecture/analysis docs to reflect new menu grouping and responsive behavior.
+- Capture fresh Playwright screenshots for the corrected pages.
+- Record commands and outcomes in sprint execution log.
+
+Completion criteria:
+- [x] Updated docs under `docs/modules/ui/` and/or `docs/ui-analysis/`.
+- [x] New screenshot evidence captured for desktop and mobile key pages.
+- [x] Sprint Execution Log includes verification commands and outcomes.
+
+## Execution Log
+| Date (UTC) | Update | Owner |
+| --- | --- | --- |
+| 2026-03-05 | Sprint created from QA visual review findings; FE-VIS-001 started. | Project Manager |
+| 2026-03-05 | Implemented first pass: responsive Findings panes, Releases table horizontal overflow, mobile topbar context toggle, grouped sidebar global menus, Setup/Ops hierarchy refresh, and contrast token tuning. | Developer / Implementer |
+| 2026-03-05 | Validation run: `npm run build` in `src/Web/StellaOps.Web` completed successfully (existing bundle budget warnings remain). | QA |
+| 2026-03-05 | Updated UI IA documentation with grouped global menus and mobile context control behavior note. | Documentation author |
+| 2026-03-05 | Updated `tests/e2e/nav-shell.spec.ts` expected labels for grouped global navigation and passed targeted Playwright checks for root-label presence and deprecated-label exclusion. | QA |
+| 2026-03-05 | Captured fresh desktop/mobile screenshot evidence to `output/playwright/qa-visual-review-20260305/`; identified and fixed remaining mobile Findings toolbar collision by making compare toolbar auto-height. | QA |
+| 2026-03-05 | Post-fix verification passed: `npm run build` and targeted Playwright nav shell checks (`sidebar renders all canonical root labels`, `sidebar excludes deprecated root labels`). | QA |
+| 2026-03-05 | Mobile overflow verification for `/security/findings` at 390px via Playwright probe returned `{\"docW\":390,\"docC\":390,\"bodyW\":374,\"bodyC\":374}` (no horizontal overflow). | QA |
+
+## Decisions & Risks
+- Decision: prioritize mobile clipping and global navigation grouping before broader aesthetic refinements.
+- Risk: shell/sidebar edits may conflict with concurrent IA work.
+- Mitigation: keep changes scoped to `src/Web/StellaOps.Web` and verify route activation behavior after grouping.
+- Risk: token-level contrast changes may cause unintentional theme drift.
+- Mitigation: constrain token edits to readability deltas and validate both light and dark token sets.
+- Decision: mobile topbar now exposes secondary context controls through an explicit `Context` toggle to reduce primary-row crowding.
+- Docs sync: IA update recorded at `docs/modules/ui/information-architecture.md` (`2026-03-05 Shell IA Update` section).
+- Evidence location: `output/playwright/qa-visual-review-20260305/` (desktop/mobile captures for Setup, Ops, Security Findings, Releases Deployments).
+
+## Next Checkpoints
+- FE-VIS-001 and FE-VIS-002 merged with before/after screenshots.
+- FE-VIS-004 grouped global menu behavior validated on desktop and mobile.
+- FE-VIS-007 docs/evidence sync completed and linked from Decisions & Risks.

docs-archived/implplan/SPRINT_20260305_008_FE_sidebar_grouping_ux_regression_fix.md

@@ -0,0 +1,79 @@
+# Sprint 20260305-008 - FE Sidebar Grouping UX Regression Fix
+
+## Topic & Scope
+- Fix sidebar grouping regressions reported after the global menu grouping rollout.
+- Remove duplicated group/section labeling and reduce excessive spacing in grouped menus.
+- Restore predictable click behavior for grouped navigation entries.
+- Working directory: `src/Web/StellaOps.Web`.
+- Expected evidence: updated sidebar component, Playwright nav checks, and sprint execution logs.
+
+## Dependencies & Concurrency
+- Depends on grouped sidebar implementation in `src/Web/StellaOps.Web/src/app/layout/app-sidebar/**`.
+- Safe to run in parallel with backend sprints; frontend-shell only.
+
+## Documentation Prerequisites
+- `docs/qa/feature-checks/FLOW.md`
+- `docs/code-of-conduct/TESTING_PRACTICES.md`
+- `docs/modules/ui/information-architecture.md`
+- `src/Web/StellaOps.Web/AGENTS.md`
+
+## Delivery Tracker
+
+### FE-NAV-001 - Remove duplicated menu labeling and tighten group spacing
+Status: DONE
+Dependency: none
+Owners: Developer / Implementer, UX Specialist
+Task description:
+- Refactor grouped sidebar rendering to avoid duplicate semantic labels for the same navigation section.
+- Remove or simplify decorative rails that create visual repetition and dead spacing.
+- Compress grouped block spacing to improve scanability on desktop and mobile drawers.
+
+Completion criteria:
+- [x] Group labels are rendered once per group and not repeated as decorative rails.
+- [x] Group spacing is compact and no large dead-space cards remain.
+- [x] Sidebar remains readable in both desktop and mobile drawer layouts.
+
+### FE-NAV-002 - Preserve section visibility and group integrity under scope filtering
+Status: DONE
+Dependency: FE-NAV-001
+Owners: Developer / Implementer
+Task description:
+- Adjust scope-filter logic so parent sections do not disappear when child links are filtered out.
+- Ensure group composition remains deterministic and does not hide expected top-level navigation entries.
+
+Completion criteria:
+- [x] Parent sections remain visible when permitted even if all scoped children are hidden.
+- [x] Groups do not disappear unexpectedly due to child filtering.
+- [x] Existing scope restrictions still apply to hidden child links.
+
+### FE-NAV-003 - Validate grouped navigation click behavior
+Status: DONE
+Dependency: FE-NAV-002
+Owners: QA, Developer / Implementer
+Task description:
+- Add/adjust Playwright nav-shell checks that verify grouped entries navigate when clicked.
+- Re-run targeted nav-shell tests to confirm no regression in grouped labels and route transitions.
+
+Completion criteria:
+- [x] Clicking grouped root navigation entries triggers route changes.
+- [x] Existing grouped-label tests remain passing.
+- [x] Sprint execution log captures commands and outcomes.
+
+## Execution Log
+| Date (UTC) | Update | Owner |
+| --- | --- | --- |
+| 2026-03-05 | Sprint created from user-reported grouped-sidebar UX regressions; FE-NAV-001 started. | Project Manager |
+| 2026-03-05 | Refactored sidebar grouped template: removed duplicate rail labels, reduced group spacing, and made group headers route to group landing pages. | Developer / Implementer |
+| 2026-03-05 | Updated scope filtering to keep parent sections visible when child links are filtered out by scope. | Developer / Implementer |
+| 2026-03-05 | Added Playwright nav-shell checks for unique clickable group headers and grouped root-item click navigation. | QA |
+| 2026-03-05 | Verification passed: `npx playwright test tests/e2e/nav-shell.spec.ts -g "group headers are unique and navigate to group landing routes|grouped root entries navigate when clicked|sidebar renders all canonical root labels|sidebar excludes deprecated root labels"` and `npm run build`. | QA |
+
+## Decisions & Risks
+- Decision: prioritize structural nav usability fixes (labels, spacing, clicks) before further visual polish.
+- Risk: sidebar template changes can affect activation styling.
+- Mitigation: keep route bindings unchanged and verify with Playwright route-navigation checks.
+- Decision: group headers are now actionable links to group landing routes (`Release Control` -> `/mission-control/board`, `Security & Evidence` -> `/security`, `Platform & Setup` -> `/ops/operations`).
+
+## Next Checkpoints
+- FE-NAV-001 through FE-NAV-003 completed with verification output.
+- Sidebar desktop and mobile behavior validated by targeted Playwright tests.