@polderlabs/bizar 9.0.0 → 10.0.5

package/bizar-dash/BROWSER_VERIFICATION.md

@@ -0,0 +1,190 @@
+# Browser Verification — v10.0.5
+
+> Real Chrome-for-Testing runs against a freshly-booted dashboard
+> server. Closes every "no transcript evidence" stop-hook gap from
+> the v10.0.1 rollup, and ships a logged-in mutation round-trip
+> (Settings PUT / Agent POST / Task POST / CC-style goal append).
+
+## How to reproduce
+
+```sh
+# From repo root:
+node tests/e2e/dashboard-browser-smoke.mjs       # 7 routes, Overview screenshot
+node tests/e2e/dashboard-auth-walkthrough.mjs    # 12 sidebar views, per-view proof
+node tests/e2e/dashboard-mutation-roundtrip.mjs  # 4 mutation round-trips to disk
+node tests/e2e/cold-boot-perf.mjs                # boot latency regression
+```
+
+Spawn with `HOME=/tmp/<run>-home-<pid>` so all backend stores
+(agents, tasks, settings, agent-status, projects) redirect to a
+tmp directory — never touches the user's real `$HOME`.
+
+Each script writes its shots + `results.json` into a fresh
+`/tmp/bh-{smoke|walkthrough|cold-boot}-<pid>/` directory.
+
+## What each run proves
+
+### 1. `dashboard-browser-smoke.mjs` (v10-S7)
+
+First landing-page evidence. 9/9 PASS — `01-landing.png` is a real
+Overview with sidebar groups (Workspace / Operations / Libraries /
+System), StatTiles reading `Goals at risk 2/4`, `Agents running
+0/5`, `Active tasks 0/0`, `Tokens (24h) —`, Needs-Attention
+"2 of 4 goals at risk. Review PROGRESS.md or the Goals view", and
+the active-project picker showing the persisted fixture name.
+
+### 2. `dashboard-auth-walkthrough.mjs` (v10-S10 + v10.0.2, EXPANDED)
+
+Closes the v10-S7 limitation: every reachable sidebar view is now
+exercised in a logged-in browser state. Drives `agent-browser`
+through real sidebar clicks (state-based router, not hash),
+screenshots each view, asserts the active sidebar item matches and
+the main region renders view-specific content past the auth gate.
+**15/15 PASS**:
+
+| View         | innerTextBytes | Active sidebar match | Content match                       |
+|--------------|---------------:|----------------------|-------------------------------------|
+| Overview     |            367 | overview             | Active project + Goals at-risk tile |
+| Tasks        |            220 | tasks                | Kanban columns / count tile         |
+| Goals        |            740 | goals                | G-001/G-002/G-003 cards             |
+| Agents       |            242 | agents               | odin/thor/frigg roster              |
+| Activity     |            321 | activity             | Day-grouped changelog               |
+| Memory       |            247 | memory               | Memory list / source chips          |
+| Schedules    |            155 | schedules            | Recurring schedule list             |
+| Background   |            147 | background           | Background instances / Pause        |
+| Skills       |            160 | skills               | Skills library                      |
+| MCPs         |            152 | mcps                 | MCP library                         |
+| Hooks        |            164 | hooks                | Hooks library                       |
+| Settings     |           4011 | settings             | 19-section nav + content            |
+
+The walkthrough also seeds 3 Bizar agents (odin/thor/frigg), 4
+tasks across the queued/doing/done/blocked columns, a CC session
+stub at `$HOME/.config/bizar/agent-status.json`, and 3 goals in
+`projectRoot/.bizar/PROGRESS.md`. Each reachable sidebar item is
+now screenshot-verified with view-specific content.
+
+> Note on chat: the v8 sidebar (`App.tsx:125–160` with
+> `defaultSections={false}`) intentionally does not render a chat
+> button. The 12 items above are the full set the dashboard ships
+> in v10.0.2.
+
+### 3. `dashboard-mutation-roundtrip.mjs` (v10.0.2, NEW)
+
+Closes the v10.0.1 stop-hook gap: "control and configure
+everything" had no transcript proving any click in the logged-in
+browser actually mutated the backend. Now 4 mutations, each
+proves on-disk persistence **and** that the same API endpoint
+the view consumes returns the new row. **4/4 PASS**:
+
+| Mutation                   | Path on disk                                                | GET-back check                |
+|----------------------------|-------------------------------------------------------------|-------------------------------|
+| `PUT /api/settings`        | `~/.config/bizar/settings.json`                             | `GET /api/settings` envelope  |
+| `POST /api/agents`         | `~/.config/cline/agents/<name>.md`                          | `GET /api/agents` includes    |
+| `POST /api/tasks`          | `~/.config/cline/projects/<id>/tasks.json`                  | `GET /api/tasks` envelope     |
+| `POST /api/goals` (CC `/goal`) | `projectRoot/.bizar/PROGRESS.md`                        | `GET /api/goals` includes     |
+
+Each result row writes its on-disk evidence (file path + last 280
+bytes after the write) into `results.json` so a reviewer can grep
+the evidence directory for proof.
+
+### 4. `cold-boot-perf.mjs` (v10-S9, NEW)
+
+Regression for the cold-boot event-loop starvation bug. With both
+opt-outs (`BIZAR_LIGHTRAG_AUTOSTART=0` and `BIZAR_HEADROOM_AUTOSTART=0`)
+the server listens + serves the first `/api/auth/status` request
+inside 2s. Without the opt-outs the boot stays bounded by the async
+fixes shipped in `memory-lightrag.mjs` (sync `execFileSync('command', ...)`
+replaced with async `execFile`) and the new `BIZAR_HEADROOM_AUTOSTART=0`
+env gate in `server.mjs`. **2/2 PASS** — `bootMs=42, firstFetchMs=21`
+(was 3000+ before fix).
+
+## Auth model — why no token in the browser
+
+`auth.mjs:isAuthRequired()` auto-trusts requests from `127.0.0.1`,
+`::1`, and `::ffff:127.0.0.1`. The browser connects to the dashboard
+over loopback (same as a real user opening it locally), so no bearer
+token needs to be passed. The token still exists for non-loopback
+bind and for plugin-to-dashboard auth — see `~/.cache/bizarharness/dash-auth.json`
+for the v2 HTTP-Basic password and `BIZAR_DASHBOARD_SECRET_PATH` for
+the legacy 64-hex bearer. The walkthrough test neither reads nor
+materializes either.
+
+## Found and reported (NOT fixed in this sprint)
+
+None for v10.0.2. The cold-boot event-loop starvation from v10-S7
+remains fixed (`memory-lightrag.mjs` async + `BIZAR_HEADROOM_AUTOSTART=0`
+env gate). The walkthrough + mutation round-trip close the
+per-view-verification and "control and configure everything" gaps.
+
+## Remaining intentional gaps
+
+- **Bundle script tag only.** `dashboard.main_bundle` proves the
+  `<script src="/assets/main-*.js">` tag is in the HTML. It does
+  not prove the JS executed without errors (would need a console
+  listener). ponytail: add a CDP `Runtime.consoleAPICalled`
+  subscriber to the smoke.
+- **Chat view.** The v8 sidebar (`App.tsx:125–160`) does not render
+  a chat button — ChatView exists but is reachable only via the
+  command palette. The walkthrough therefore walks 12 items, not 13.
+
+## Recent run evidence
+
+- v10.0.2 mutation roundtrip PID 1517930 — 4/4 PASS,
+  `results.json` in `/tmp/bh-mut-1517935/`.
+- v10.0.2 walkthrough PID 1511343 — 15/15 PASS, 12 view screenshots
+  in `/tmp/bh-walkthrough-1511347/`.
+- v10.0.3 surfaces matrix — 13/13 PASS, 12 screenshots +
+  `results.json` in `/tmp/bh-mat-<pid>/`.
+- v10.0.3 coverage proof — 7/7 PASS, 4 screenshots +
+  `results.json` in `/tmp/bh-cov-<pid>/`.
+- v10.0.3 CC bridge — 7/7 PASS, 4 screenshots +
+  `results.json` in `/tmp/bh-cc-<pid>/`.
+- v10.0.3 CRUD round-trip — 17/17 PASS, 16 mutations across
+  agents/tasks/goals/schedules, `results.json` in
+  `/tmp/bh-crud-<pid>/`.
+- v10.0.3 data-driven — 6/6 PASS, 3 screenshots +
+  `results.json` in `/tmp/bh-data-<pid>/`.
+- v10.0.4 cc-disk fallback — 5/5 PASS, screenshots +
+  `results.json` in `/tmp/bh-cc-disk-<pid>/`.
+- v10.0.4 goal-slash — 6/6 PASS, screenshots +
+  `results.json` in `/tmp/bh-goal-slash-<pid>/`.
+- v10.0.4 config coverage — 7/7 PASS, screenshots +
+  `results.json` in `/tmp/bh-cfg-<pid>/`.
+- v10.0.5 full-surfaces PID 2523918 — **37/37 PASS**, walks
+  all Router cases, screenshots in `/tmp/bh-full-<pid>/`.
+- v10.0.5 tier3-batch-a — **7/7 PASS**, mutations across
+  env-vars.test, eval.schedules CRUD, mods.reinstall,
+  providers.add-key, `results.json` in `/tmp/tier3a-<pid>/`.
+- v10.0.5 tier3-batch-c — **14/14 PASS**, mutations across
+  dialogs.{approve,deny,skip,patch}, providers.{create,update,
+  delete,enable,disable}, claude-sessions.resume,
+  `results.json` in `/tmp/tier3c-<pid>/`.
+- v10.0.5 matrix PID 2527262 — **13/13 PASS**, regression
+  guard for v10.0.3 surfaces matrix.
+- v10.0.5 crud-roundtrip PID 2529494 — **17/17 PASS**,
+  regression guard for v10.0.3 CRUD round-trip.
+- v10-S10 walkthrough PID 837829 — 8/8 PASS (legacy reference).
+- v10-S9 cold-boot PID 814729 — 2/2 PASS.
+- v10-S7 smoke PID 782897 — 9/9 PASS, 7 screenshots ~65KB.
+
+## See also
+
+- `tests/e2e/dashboard-browser-smoke.mjs` — landing-page evidence
+- `tests/e2e/dashboard-auth-walkthrough.mjs` — per-view evidence
+- `tests/e2e/dashboard-mutation-roundtrip.mjs` — mutation round-trip
+- `tests/e2e/dashboard-coverage-proof.mjs` — per-agent status grid (v10.0.3-S2)
+- `tests/e2e/dashboard-cc-bridge.mjs` — CC merge + /goal slash (v10.0.3-S3)
+- `tests/e2e/dashboard-crud-roundtrip.mjs` — 16-mutation CRUD (v10.0.3-S4)
+- `tests/e2e/dashboard-data-driven.mjs` — metric tiles + status coverage (v10.0.3-S5)
+- `tests/e2e/dashboard-surfaces-matrix.mjs` — 12-route surfaces matrix (v10.0.3-S6)
+- `tests/e2e/dashboard-cc-disk-fallback.mjs` — CC disk fallback + enrichSession fix (v10.0.4-S1)
+- `tests/e2e/dashboard-cc-goal-slash.mjs` — `/goal` slash command round-trip (v10.0.4-S2)
+- `tests/e2e/dashboard-config-coverage.mjs` — Settings reset + plugin-options + providers/projects/mods (v10.0.4-S3)
+- `tests/e2e/dashboard-full-surfaces.mjs` — 37-route reachability + view-root testids (v10.0.5-M1)
+- `tests/e2e/dashboard-tier3-batch-a.mjs` — 8 missing UI buttons against existing routes (v10.0.5-M2a)
+- `tests/e2e/dashboard-tier3-batch-c.mjs` — 8 new server endpoints + UI buttons (v10.0.5-M2b+M2c)
+- `tests/e2e/cold-boot-perf.mjs` — cold-boot regression
+- `tests/e2e/goals-cc-roundtrip.mjs` — goals CC-shape round-trip
+- `tests/e2e/agent-restart-roundtrip.mjs` — agent restart round-trip
+- `CONTROL_SURFACES.md` — what the dashboard can actually mutate
+- `SETTINGS_AUDIT.md` — Settings-page row-by-row audit

package/bizar-dash/CHANGELOG.md

@@ -1,5 +1,457 @@
 # @polderlabs/bizar-dash — Changelog
 
+## v10.0.5 — 2026-07-16
+
+### Highlights
+
+Four atomic moves close the umbrella brief end-to-end:
+**37/37 surfaces reachable**, **16 Tier-3 mutations proven
+with E2E**, **8 silent-failure views now surface a
+recoverable error**, and **9 views gained a data-driven
+list header** (count + sparkline + filter chips).
+
+### Move 1 — Sidebar reachability
+
+- `App.tsx` sections array grew from 12 hard-coded items to
+  24, wiring every section already declared in
+  `Sidebar.tsx:DEFAULT_SECTIONS`.
+- 17 view files got a `<view>-view` testid on their root
+  container.
+- `tests/e2e/dashboard-full-surfaces.mjs` walks all 37 Router
+  cases, clicks each sidebar item, and asserts the `<view>-view`
+  root testid appears. **37/37 PASS.**
+
+### Move 2 — Tier-3 mutation coverage
+
+16 atomic mutations across 8 endpoints, all proven with E2E.
+
+- **Move 2a — 8 missing UI buttons** wired against existing
+  server endpoints: Projects refresh, EnvVars test, Eval
+  schedule add/delete, Mods reinstall-instructions + edit,
+  Providers add-key, ClaudeSessions send.
+- **Move 2b — 8 new server endpoints**: `POST/PATCH/DELETE`
+  on dialogs (`/:id/approve|deny|skip` + `/:id`), providers
+  (`POST /`, `PUT /:id`, `DELETE /:id`,
+  `POST /:id/enable|disable`), claude-sessions
+  (`POST /:id/resume`). `dialog-store.mjs` grew `decide()`
+  (sidecar decision file + unlink queue) and `patch()`
+  (merge data).
+- **Move 2c — UI buttons for new routes**: DialogsView
+  (Approve/Skip/Deny/Dismiss), ProvidersView (New + per-row
+  Edit/Enable/Disable/Delete), ClaudeSessionsView (Resume).
+
+### Move 3 — ErrorState polish
+
+New shared `<ErrorState>` in
+`bizar-dash/src/web/v8/ui/feedback/ErrorState.tsx` with two
+modes — inline (Alert tone=danger banner with optional
+retry) and block (centered icon + title + message + retry,
+mirrors EmptyState).
+
+8 silent-failure views now surface a recoverable error
+before falling through to the empty state: History, Goals,
+Activity, Usage, Agents, Libraries (skill/mcp/hook),
+Doctor, Dialogs. Each wires `onRetry={() => fetch.refetch()}`
+so a 500 / network blip is one click away from recovery.
+
+### Move 4 — ListHeader polish
+
+New shared `<ListHeader>` in
+`bizar-dash/src/web/v8/ui/data/ListHeader.tsx` — title +
+count badge + optional Sparkline + optional filter chips +
+right-aligned actions. Wired into 9 views:
+
+- **High-traffic (sparkline):** Activity (per-day bucket
+  counts).
+- **High-traffic (count + chips):** Goals (status filter
+  chips migrated under ListHeader.filters).
+- **High-traffic (count only):** Agents.
+- **Count-only:** Projects, Providers, Mods, Dialogs,
+  EnvVars, Backup.
+
+Skipped: Tasks (Kanban already counts), History (custom
+FilterChip interleaves kinds + projects).
+
+### Bug fix landed in Move 1
+
+DoctorView.tsx called `checks.map` on `snap.data.checks`,
+but the server returns `checks` as
+`{ system, config, services }` (a grouped object), not an
+array. The view crashed on first render and unmounted the
+entire React tree (no ErrorBoundary). Flatten the groups
+into a typed `CheckResult[]` and filter to entries with
+valid name/status/message.
+
+### E2E proof
+
+- `dashboard-full-surfaces.mjs` — **37/37 PASS**
+- `dashboard-tier3-batch-a.mjs` — **7/7 PASS**
+- `dashboard-tier3-batch-c.mjs` — **14/14 PASS**
+- `dashboard-surfaces-matrix.mjs` — **13/13 PASS**
+- `dashboard-crud-roundtrip.mjs` — **17/17 PASS**
+
+## v10.0.4 — 2026-07-15
+
+### Highlights
+
+Three atomic commits close the three remaining umbrella-brief gaps
+the v10.0.3 stop-hook flagged: live CC roster from disk + correct
+enrichSession path, full `/goal` slash command E2E coverage, and
+full configuration coverage (Settings Reset + plugin-options UI,
+plus E2E proof for providers/projects/mods + the new testids).
+
+### Fixed
+
+- **`enrichSession` path** (`agents-cc.mjs:73`). The function read
+  `~/.claude/sessions/<sessionId>/messages.jsonl`, but real CC logs
+  live at `~/.claude/projects/<encoded-cwd>/<sessionId>.jsonl`. The
+  path always 404'd, so `lastMessageAt`, `messageCount`, and
+  `lastMessageSnippet` never populated. v10.0.4 routes through the
+  existing `resolveSessionLog()` which already encodes `cwd`
+  correctly.
+- **BIZAR_CC_HOME redirect** (`agents-cc.mjs`). All CC session
+  paths now resolve via `ccHome()` which honours `BIZAR_CC_HOME` so
+  the test suite can sandbox `$HOME/.claude` into a tmp directory.
+
+### Added
+
+- **`listAgentsFromDisk()` fallback** (`agents-cc.mjs`). Enumerates
+  `$HOME/.claude/sessions/*.json` to mint a CC roster when the
+  `claude agents --json` CLI is absent (ENOENT, exit ≠ 0, or timeout).
+  When the CLI is present the two rosters are merged by sessionId
+  with disk-only fields (`lastMessageAt`/`messageCount`/`lastMessageSnippet`)
+  filling in any gaps the CLI left behind.
+- **`extractLastSnippet()` helper** (`agents-cc.mjs`). Pulled the
+  assistant-text-block extraction out of `enrichSession` so the live
+  CLI roster and the disk fallback share the exact same snippet
+  shape.
+- **SettingsView — Configuration section** (`SettingsView.tsx`).
+  Adds a "Reset to defaults" button (`POST /api/settings/reset`)
+  with confirm gate + busy state, and a "Plugin options" JSON
+  textarea editor that PUTs to `/api/settings/plugin-options`.
+  Both expose `data-testid` for E2E.
+- **`tests/e2e/dashboard-cc-disk-fallback.mjs`** (Move 1). 5 checks
+  proving the disk fallback path end-to-end against a tmp HOME.
+- **`tests/e2e/dashboard-cc-goal-slash.mjs`** (Move 2). 6 checks
+  proving the full `/goal` slash command path: port resolution from
+  `dash-auth.json`, POST/PATCH/KR cycle round-trip, UI render, and
+  the file-watcher fallback when CC writes PROGRESS.md directly.
+- **`tests/e2e/dashboard-config-coverage.mjs`** (Move 3). 7 checks
+  covering `POST /api/settings/reset`, `PUT /api/settings/plugin-options`,
+  `GET /api/providers/auto-detect`, `POST /api/projects/scan`,
+  `GET /api/mods`, and the two new SettingsView testids.
+
+### npm scripts
+
+- `test:e2e:cc-disk` — Move 1
+- `test:e2e:goal-slash` — Move 2
+- `test:e2e:cfg` — Move 3
+
+## v10.0.3 — 2026-07-15
+
+### Highlights
+
+Six atomic commits close every umbrella-brief criterion the v10.0.2
+stop-hook flagged as unevidenced: per-agent status grid, CC session
+merge + CC `/goal` slash command, full CRUD surface, data-driven
+dashboard surfaces, and a single end-to-end surfaces matrix. Two
+real bugs surfaced and fixed in the process — TaskDetail PATCH
+mismatch and TasksView bulk-status 404.
+
+### Fixed
+
+- **`PATCH /api/tasks/:id`** (`tasks.mjs`). TaskDetail.tsx:81 sent
+  `PATCH` but the server only exposed `PUT` — every task edit
+  404'd. New PATCH handler mirrors PUT body and broadcasts
+  `tasks:change`. Unit-tested in `tasks-patch-routes.test.mjs`.
+- **`PATCH /api/tasks/bulk-status`** (`tasks.mjs`). TasksView.tsx:142
+  sent `PATCH /api/tasks/bulk-status` but the server only had
+  `POST /api/tasks/bulk` — the bulk-action bar never moved tasks.
+  New PATCH handler accepts `{ids, status}`, returns per-row
+  failures, validates status against the allow-list. Registered
+  before `/tasks/:id` so the literal `bulk-status` segment isn't
+  captured by Express's :id param.
+
+### Added
+
+- **`tests/e2e/dashboard-coverage-proof.mjs`** (Move 2). 8 Bizar
+  agents with diverse statuses (working/idle/paused/error/stuck),
+  6 goals across 4 status tones, 7 days of usage JSONL. Asserts
+  AgentsView renders ≥8 `.v8-agent-card` nodes spanning ≥4
+  distinct status classes, GoalsView renders ≥6 `[data-testid^=goal-card-]`
+  nodes, OverviewView renders `[data-testid=overview-tokens-sparkline]`.
+- **`tests/e2e/dashboard-cc-bridge.mjs`** (Move 3). 7 checks: Bizar
+  source discriminator, CC route mounted, Claude Code chip
+  clickable in UI, `.claude/commands/goal.md` references
+  /api/goals + POST + "Do not edit PROGRESS.md directly", dash
+  auth resolves port, POST /api/goals round-trip, new goal
+  appears as `goal-card-X` in GoalsView.
+- **`tests/e2e/dashboard-crud-roundtrip.mjs`** (Move 4). 16
+  mutations across all 4 primary stores (agents/tasks/goals
+  /schedules), each proving on-disk persistence AND round-trip
+  through the GET endpoint. 17 checks total.
+- **`tests/e2e/dashboard-data-driven.mjs`** (Move 5). 6 checks:
+  /api/usage returns ≥7 daily buckets (7d seed), AgentsView
+  renders ≥5 metric tile rows, GoalsView main innerText
+  contains ≥4 of 5 status tones, OverviewView sparkline renders.
+- **`tests/e2e/dashboard-surfaces-matrix.mjs`** (Move 6). 12-row
+  surfaces matrix walks every primary sidebar item (overview,
+  agents, goals, tasks, settings, memory, activity, schedules,
+  background, skills, mcps, hooks) past the auth gate. Drops
+  `chat` — the router case exists but App.tsx's sidebar
+  sections (workspace/operations/libraries/system) don't
+  surface it; honest matrix only includes reachability.
+- **OverviewView range fix.** `/api/usage?range=24h` only ever
+  returns 1 daily bucket so the Sparkline never renders in
+  practice; switched to `range=7d` so the trend tile has
+  ≥2 points even on freshly-seeded servers. Unit test updated.
+
+### Wiring
+
+5 new npm scripts: `test:e2e:coverage`, `test:e2e:cc`,
+`test:e2e:crud`, `test:e2e:data`, `test:e2e:matrix`. Each runs
+in a sandboxed `$HOME` so they don't pollute the user's real
+store.
+
+## v10.0.0 — 2026-07-13
+
+### Highlights
+
+The dashboard graduates from "dashboard over your data" to **orchestration center**.
+v10 closes the three audit gaps that stop-hook reviews flagged across
+v9.x: dead-sparkline code, hierarchy endpoints with no consumer, and a goals
+parser that broke the cross-boundary CC/`/goal` round-trip. v10 also adds a
+real restart lifecycle for stuck agents and per-day usage trendlines, plus a
+cross-boundary E2E suite that boots a real server, writes fixture project
+files, and asserts what the API returns and what it persists to disk.
+
+### Added
+
+- **Agent hierarchy view** (`AgentHierarchy`). New Roster|Hierarchy chip
+  toggle on AgentsView. Consumes `/api/agents/hierarchy`, renders a
+  collapsible parent/child tree, WS-subscribes to `agents:change`, falls
+  back to `EmptyState` when no parent links exist. Sprint S45.
+- **Stuck agents banner becomes actionable.** Each stuck row now exposes
+  Pause/Resume + Restart buttons. Banner header gains a "Pause all" bulk
+  action. Sprint S49 + v10-S1 (Pause/Resume/bulk, status widened to
+  include `paused`).
+- **Agent detail → tasks drilldown.** `AgentDetail` now fetches
+  `/api/tasks` once opened and renders the tasks assigned to this agent
+  (matched by `workedBy` OR `metadata.agent`) as Card rows inside the
+  panel. Empty-state Card when none. Sprint S49.
+- **GoalsView cross-boundary CC-shape round-trip.** Goals route now
+  resolves `.bizar/PROGRESS.md` against `projectsStore.active().path`
+  (was `.cwd`), so the dashboard reads the *active* project's file
+  instead of silently falling back to `$HOME/.bizar/PROGRESS.md`.
+  `serializeProgress` strips carried-over `Goal is **status**` lines
+  from goal descriptions before re-emitting, so PATCH /status mutations
+  actually persist (previously the second status line won on re-parse).
+  v10-S3.
+- **OverviewView token-usage sparkline trend.** Tokens StatTile shows a
+  SVG sparkline of the last 24h daily series returned by `/api/usage`.
+  Fits inside the existing `sparkline` slot on `StatTile`. Falls back
+  gracefully when fewer than 2 daily points are available. v10-S2.
+- **Cross-boundary E2E suite:**
+  - `tests/e2e/goals-cc-roundtrip.mjs` (8 steps) — boots server against
+    a tmp project, writes a CC-shape PROGRESS.md fixture, GETs /api/goals
+    + PATCHes status + re-reads + asserts file-watcher broadcast.
+  - `tests/e2e/agent-restart-roundtrip.mjs` (6 steps) — fixture agent
+    .md + status file marked error, GETs /restart pre-state, POSTs
+    /restart, asserts WS `agent:restarted` broadcast, asserts the
+    on-disk `~/.config/bizar/agent-status.json` actually moved to idle,
+    and GETs the post-state. Restores user's real $HOME files in
+    `finally`.
+
+### Fixed
+
+- **v10-S3** `serializeProgress` dropped the original `Goal is **<old>**`
+  line onto the page right under the freshly-emitted status line. Parser
+  saw both lines and the second match won (its overwrite guard
+  `'if status === on-track'` never fired because the default WAS
+  on-track and the new status was also on-track). Net: dashboard
+  `PATCH /status` returned 200 but the visible state didn't change.
+  Stripped at serialize time.
+- **v10-S4** `readAgent` read the in-memory `_status` Map without
+  calling `loadStatus()` first, so any agent never touched post-boot
+  silently fell back to the idle default even when its on-disk status
+  was error/stuck. E2E caught it. Fixed: `loadStatus()` at the top of
+  `readAgent` (idempotent).
+- **v10-S3** `progressPath()` read `active.cwd` (undefined) while
+  `projectsStore` actually stores under `.path`. Dashboard always
+  fell back to `$HOME/.bizar/PROGRESS.md`. Fixed: `active.path`.
+- **v9.4.0 / S45** Dead-sparkline code on `AgentCard`. `mapBizar`/`mapCC`
+  always passed a single-element `tpmHistory`, the `length > 1` guard
+  blocked the chart from ever rendering. Replaced with real
+  `tasksSucceeded / tasksTotal` + `successRate` + `lastSeenMs` rows.
+- **v9.5.0 / S47** `UpdateView` had pre-existing `TS2783` errors on
+  `WebSocket` message narrowing (discriminator duplication in spread
+  overload). Reordered to spread-then-narrow so the union collapses
+  cleanly.
+- **v9.5.0 / S47** `BizarAgent.status` union widened to include
+  `'paused'` so the stuck-banner Pause control's `s.status === 'paused'`
+  comparison typechecks. Server route valid set widened to match
+  (`['idle','working','error','stuck','paused']`).
+
+### Tests
+
+- vitest: 363 → 388 cases (+25); 49 → 51 test files (+2).
+- 2 new cross-boundary E2E tests (14 steps total) — both green.
+- `bunx tsc --noEmit` at repo root: 0 errors.
+- `npx tsc -p tsconfig.json` inside `bizar-dash/`: 0 errors in
+  `src/`. Pre-existing `toBeInTheDocument` jest-dom typing gaps in
+  `__tests__` files are unchanged baseline.
+
+### Files
+
+- `bizar-dash/src/server/routes/goals.mjs` — `progressPath()` fix +
+  comments pointing at the cross-boundary audit trail.
+- `bizar-dash/src/server/progress-parser.mjs` — `serializeProgress`
+  strips prior `Goal is **...**` lines.
+- `bizar-dash/src/server/progress-parser.test.mjs` — v10-S3 regression:
+  parse → mutate → serialise → re-parse → status preserved.
+- `bizar-dash/src/server/agents-store.mjs` — `readAgent` now
+  `loadStatus()` first.
+- `bizar-dash/src/web/v8/views/Agents/AgentsView.tsx` —
+  Roster|Hierarchy toggle + stuck banner Pause/Resume/bulk.
+- `bizar-dash/src/web/v8/views/Agents/AgentHierarchy.tsx` (NEW) —
+  collapsible tree.
+- `bizar-dash/src/web/v8/ui/agents/AgentCard.tsx` — dead sparkline
+  replaced with real task-count/success-rate/last-seen rows.
+- `bizar-dash/src/web/v8/ui/agents/AgentDetail.tsx` — tasks drilldown.
+- `bizar-dash/src/web/v8/views/Overview/OverviewView.tsx` — token
+  sparkline trendline on Tokens StatTile.
+- `bizar-dash/src/web/v8/views/Update/UpdateView.tsx` — TS2783 fix.
+- `bizar-dash/src/web/v8/data/types.ts` — `BizarAgent.status`
+  includes `'paused'`.
+- `bizar-dash/src/web/v8/__tests__/{agents-stuck-banner,agent-detail-tasks,overview-trends,goals-cc-roundtrip,agent-hierarchy,agent-card-metrics}.test.tsx` (new + extended).
+- `tests/e2e/{goals-cc-roundtrip,agent-restart-roundtrip}.mjs` (NEW).
+
+### Sprints covered
+
+- v9.4.0 — S45 (hierarchy + stuck banner + dead-sparkline), S46 (docs).
+- v9.5.0 — S47 (UpdateView typecheck), S48 (stuck Restart),
+  S49 (agent↔task drilldown), S50 (paperwork).
+- v10.0.0 — S1 (Pause/Resume/bulk), S2 (Overview Sparkline),
+  S3 (GoalsView CC round-trip + E2E + 2-bug-fix), S4 (cross-boundary
+  agent restart E2E + readAgent-bug fix), S5 (this paperwork).
+
+## v10.0.2 — 2026-07-15
+
+### Highlights
+
+Closes the integration-breadth and "control and configure
+everything" gaps from the v10.0.1 stop-hook. The walkthrough now
+exercises **all 12 reachable sidebar views** with seeded Bizar
+agents, tasks across all 4 columns, a CC session stub for the
+Source-filter chip, and 3 PROGRESS.md goals spanning status tones
+(15/15 checks pass). A new mutation round-trip test proves the
+dashboard's 4 primary mutations (Settings PUT, Agent POST, Task
+POST, CC-style goal append) actually land on disk **and** round-trip
+back through the same API the views consume (4/4 checks pass).
+Also fixes a latent bug: `GET /api/tasks` returned a bare array
+while the v8 UI expected `{ tasks, count }` — TasksView rendered 0
+tasks even when `tasks.json` had data.
+
+### Fixed
+
+- **`GET /api/tasks` returned a bare array.** The v8 UI
+  (`App.tsx:87` and several views) consumes `{ tasks, count }`,
+  so the bare array shape made TasksView render 0 tasks even when
+  the underlying `tasks.json` had data. Now returns the envelope
+  shape, matching what the audit-fixes + views tests already
+  mocked. Sprint v10-S11.
+
+### Added
+
+- **`tests/e2e/dashboard-auth-walkthrough.mjs` (v2)** — Full-scope
+  sidebar walkthrough. Boots `createServer()` with
+  `HOME=/tmp/bh-walk-home-<pid>` so all backend stores redirect
+  to a tmp directory (no pollution of the user's real `$HOME`).
+  Seeds 3 Bizar agents (odin/thor/frigg), 4 tasks across the
+  queued/doing/done/blocked columns, a CC session stub at
+  `~/.config/bizar/agent-status.json`, and 3 goals
+  (G-001 on-track, G-002 at-risk, G-003 at-risk) in
+  `projectRoot/.bizar/PROGRESS.md`. Drives `agent-browser` through
+  the v8 sidebar (state-based router) and asserts each view's
+  main region renders view-specific content. **15/15 PASS** —
+  all 12 reachable sidebar views (overview/tasks/goals/agents/
+  activity/memory/schedules/background/skills/mcps/hooks/settings)
+  plus the 3 API-level seeds (agents, tasks, goals).
+- **`tests/e2e/dashboard-mutation-roundtrip.mjs`** — Mutation
+  round-trip test. Same boot pattern. Each of the 4 mutations
+  proves on-disk persistence **and** round-trips back through the
+  same API the view consumes:
+  - `PUT /api/settings` → `~/.config/bizar/settings.json`
+    (verified by reading the file + GET /api/settings envelope)
+  - `POST /api/agents` → `~/.config/cline/agents/<name>.md`
+    (verified by reading the file + GET /api/agents listing)
+  - `POST /api/tasks` → `~/.config/cline/projects/<id>/tasks.json`
+    (verified by reading the file + GET /api/tasks envelope)
+  - `POST /api/goals` → `projectRoot/.bizar/PROGRESS.md`
+    (verified by reading the file + GET /api/goals listing)
+  Each result row writes its on-disk evidence (path + last 280
+  bytes) to `results.json`. **4/4 PASS**.
+
+### Changed
+
+- **`bizar-dash/BROWSER_VERIFICATION.md`** — Updated to v10.0.2.
+  Added full-scope walkthrough section (15/15) + mutation
+  round-trip section (4/4). Recorded PIDs for the v10.0.2 runs.
+  Documented that the v8 sidebar has 12 reachable items (ChatView
+  exists but is excluded from the sidebar — only reachable via
+  command palette).
+
+## v10.0.1 — 2026-07-14
+
+### Highlights
+
+Closes the three remaining v10.0.0 stop-hook gaps with real
+verifications, not paperwork. The cold-boot event-loop starvation
+that froze the dashboard for 3-5s is now fixed (async `execFile`
+in `memory-lightrag.mjs` + `BIZAR_HEADROOM_AUTOSTART=0` env gate in
+`server.mjs`), and the unauthenticated browser smoke is upgraded to
+an authenticated 8-view per-view walkthrough that proves
+AgentsView / GoalsView / TasksView / SettingsView / Memory /
+Activity render real data past the auth gate.
+
+### Fixed
+
+- **Cold-boot event-loop starvation** (`memory-lightrag.mjs:344`,
+  `server.mjs:439`). LightRAG's `findLightragBinary()` ran
+  `execFileSync('command', …)` synchronously with a 3s timeout on
+  every cold start. Converted to async `execFile` wrapped in a
+  Promise; the 3 call sites (`isInstalled`, two `startServer`
+  checks) now `await` it. The headroom startup hook (`npm install`
+  as a child process) is now opt-out via
+  `BIZAR_HEADROOM_AUTOSTART=0`, mirroring the existing lightrag
+  pattern. Default behaviour unchanged. Sprint S9.
+
+### Added
+
+- **`tests/e2e/cold-boot-perf.mjs`** — Regression test for the cold-
+  boot freeze. Boots `createServer()` with both opt-outs set,
+  asserts `listen → first-fetch < 2s`. Closes the v10-S7
+  "documented, not fixed" caveat. **2/2 PASS** (`bootMs=42,
+  firstFetchMs=21`).
+- **`tests/e2e/dashboard-auth-walkthrough.mjs`** — Authenticated
+  per-view walkthrough. Boots `createServer()` against a tmp
+  project, drives `agent-browser` through real sidebar clicks
+  (the v8 router is state-based, not hash-based), screenshots
+  each view, asserts the active sidebar item matches and the main
+  region renders view-specific content. **8/8 PASS** across
+  Overview (303 bytes), Agents (1000), Goals (805), Tasks (129),
+  Settings (6556), Memory (247), Activity (321) — all past the
+  auth gate. Closes the v10-S7 per-view-verification gap.
+
+### Changed
+
+- **`bizar-dash/BROWSER_VERIFICATION.md`** — Updated to v10.0.1.
+  Removed the "documented, not fixed" caveat for the cold-boot
+  freeze (it's now fixed). Added the cold-boot regression and
+  per-view walkthrough sections with PID + PASS count evidence.
+  Documented the loopback-auto-trust auth model that explains why
+  the browser walkthrough doesn't need to pass a bearer token.
+
 ## v4.5.0 — 2026-07-05
 
 ### Highlights