{
  "sourceCaptureSHA256": "1988a0af219e86a020ec09bd320f8ff02c7d3685f010927ccf725b79f105c058",
  "projection": "Exact public file-mutation inputs and identity/timestamp/success metadata; result bodies and unrelated tools omitted. Current before and pane are direct retained bytes.",
  "cwd": "/tmp/gstack-paid-shard-uaCq3n/tmp/gstack-autoplan-chain-RnwL2i",
  "config": "/tmp/gstack-paid-shard-uaCq3n/tmp/gstack-hermetic-2101964-HvDZyN/with-skills/.claude",
  "stateRoot": "/tmp/gstack-paid-shard-uaCq3n/tmp/gstack-hermetic-2101964-HvDZyN/skill-home-zgCNxG/.gstack",
  "commandStartedAt": 1789032380903,
  "now": 1789033507687,
  "viewport": "         +o CC figure given). Deferred: needs a ranking service and push infrastructure that do not exist. This p\n         +lan lays the substrate it would build on: the per-panel result envelope, the per-panel state machine (l\n         +oading \u2192 ok / empty / error \u2192 retry), and the instrumentation; all three are in Accepted Scope below.  \n      24  \n      25  ## Scope Decisions\n      26  \n\n\u25cf Update(~/.gstack/projects/gstack-autoplan-chain-RnwL2i/ceo-plans/2026-09-10-user-dashboard.md)\n\n\u25cf Update(~/.gstack/projects/gstack-autoplan-chain-RnwL2i/ceo-plans/2026-09-10-user-dashboard.md)\n\n\u25cf Update(~/.gstack/projects/gstack-autoplan-chain-RnwL2i/ceo-plans/2026-09-10-user-dashboard.md)\n\n\u25cf Update(~/.gstack/projects/gstack-autoplan-chain-RnwL2i/ceo-plans/2026-09-10-user-dashboard.md)\n\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n Edit file\n \u20262101964-HvDZyN/skill-home-zgCNxG/.gstack/projects/gstack-autoplan-chain-RnwL2i/ceo-plans/2026-09-10-user-dashboard.md\n\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\n 26  \n 27  | # | Proposal | Effort | Decision | Reasoning | Revisit when |\n 28  |---|----------|--------|----------|-----------|--------------|\n 29 -| 1 | Pull real login-to-first-task baseline (median/p90) and find-vs-do split from existing analytics before locki\n    -ng 45s | S | ACCEPTED | Data already exists; the 75s walkthrough number is a stand-in | \u2014 |                        \n 29 +| 1 | Pull real login-to-first-task baseline (median/p90) and find-vs-do split from existing analytics before locki\n    +ng 45s | S | ACCEPTED | Data already exists; the 75s walkthrough number is a stand-in | Dashboard owner re-locks th\n    +e target in this document after the pull |                                                                         \n 30  | 2 | Numeric rollback triggers defined before rollout | S | ACCEPTED | Rollout criteria were \"to be specified\"; de\n     pends on #1 | \u2014 |\n 31  | 3 | Relative timestamps with absolute on hover/focus in ActivityFeed | S | ACCEPTED | 1 file, under an hour, in b\n     last radius | \u2014 |\n 32  | 4 | Unread count badge and document.title mirror | S | ACCEPTED | 1 file, under an hour | \u2014 |\n\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\u254c\n Do you want to make this edit to 2026-09-10-user-dashboard.md?\n \u276f 1. Yes\n   2. Yes, and switch to accept edits (auto-approve file edits and common file commands) for this session (shift+tab)\n   3. No\n\n Esc to cancel \u00b7 Tab to amend\n",
  "before": "---\nstatus: ACTIVE\n---\n# CEO Plan: User Dashboard Page\nGenerated by /plan-ceo-review (via /autoplan) on 2026-09-10\nBranch: main | Mode: SELECTIVE EXPANSION (hold the plan's scope as baseline; cherry-pick expansions individually)\nRepo: gstack-autoplan-chain-RnwL2i (no remote)\nSource plan: `.claude/plans/ui-heavy-feature.md` (reviewed copy with full review record: `.claude/plans/starry-riding-otter.md`)\n\n**Primary metric:** median login-to-first-completed-task \u2264 45s (provisional until the baseline in #1 is pulled). Guardrails: completed-task rate and permission-error rate must not regress.\n\n**Glossary.** *Blast radius*: the files this plan creates or modifies plus their direct importers. *Find vs. do*: time from login to starting an action, versus time from starting to completing it. *CC*: Claude Code implementation time, as opposed to human-team time. *Effort scale* (human team): S under 1 day, M 1 to 5 days, L 1 to 3 weeks, XL over 3 weeks. *Previous landing page*: the post-login destination in use before this plan (the existing default route members see today; name it in the flag config when implementing).\n\n**Acceptance principle.** In SELECTIVE EXPANSION, an expansion inside the blast radius that costs under an hour is accepted on cost alone, whether or not it moves the metric (#3, #4, #6). Items outside the blast radius, or that need an audit or new infrastructure, are deferred even when cheap (#7, #8).\n\n**Assumptions.** The feature-flag framework, request/error metrics, and analytics events named in the source plan exist (this repository contains no source, so they are unverified). Item #1 (baseline pull) precedes item #2 (numeric rollback triggers), because the triggers are expressed against the baseline. **Fallback if the analytics events do not exist:** instrument login, action start, and action completion first, collect at least 7 days of data before any cohort rollout, and keep the 75s walkthrough figure as the stand-in with the target widened to \"at least 30% faster than measured baseline\" until the pull succeeds.\n\n**Carried from the source plan (not additions):** the per-panel state machine (loading \u2192 ok / empty / error \u2192 retry) and the instrumentation set (metrics, alerts, structured logs) are already required by the source plan's accepted CEO obligations; this document ratifies them without a proposal row.\n\n## Vision\n\n### 10x Check\nA post-login home that tells the member what to do next instead of showing three things to scan. A ranked \"next up\" card sits above the panels, computed server-side from eligible actions and unread alerts, and updates live over a push channel. The member arrives, sees one thing, and does it. Effort: XL, infrastructure-bound rather than implementation-bound (ranking service and push channel must exist first; no CC figure given). Deferred: needs a ranking service and push infrastructure that do not exist. This plan lays the substrate it would build on: the per-panel result envelope, the per-panel state machine (loading \u2192 ok / empty / error \u2192 retry), and the instrumentation; all three are in Accepted Scope below.\n\n## Scope Decisions\n\n| # | Proposal | Effort | Decision | Reasoning | Revisit when |\n|---|----------|--------|----------|-----------|--------------|\n| 1 | Pull real login-to-first-task baseline (median/p90) and find-vs-do split from existing analytics before locking 45s | S | ACCEPTED | Data already exists; the 75s walkthrough number is a stand-in | \u2014 |\n| 2 | Numeric rollback triggers defined before rollout | S | ACCEPTED | Rollout criteria were \"to be specified\"; depends on #1 | \u2014 |\n| 3 | Relative timestamps with absolute on hover/focus in ActivityFeed | S | ACCEPTED | 1 file, under an hour, in blast radius | \u2014 |\n| 4 | Unread count badge and document.title mirror | S | ACCEPTED | 1 file, under an hour | \u2014 |\n| 5 | \"Back to previous landing page\" link during rollout | S | ACCEPTED | Per-member escape hatch and bounce-back signal | Remove at 100% rollout |\n| 6 | Empty-state copy pointing at the primary action | S | ACCEPTED | Copy only | \u2014 |\n| 7 | Keyboard shortcuts for quick actions | S | DEFERRED | Shortcut conflict audit needed; not on the metric path | Dashboard owner runs the conflict audit after 100% rollout |\n| 8 | Prefetch /api/dashboard during login redirect | S | DEFERRED | Touches login flow, outside blast radius | If client TTFB p95 > 800ms at 100% |\n| 9 | Post-login redirect-to-resume experiment arm | M | DEFERRED, provisional (taste T1) | Skips alerts the plan says members need; touches login flow; attribution needs its own arm | Final Approval Gate may flip to \"run concurrently\" |\n| 10 | Ranked \"next up\" card with live updates | XL | DEFERRED | New ranking + push infrastructure | After dashboard metric data at 100% |\n| 11 | ETag / short TTL cache on the endpoint | S | DEFERRED | Wait for p95 at 100% rollout | Dashboard owner checks endpoint p95 one week after 100% |\n| 12 | Token-only styling: PR review checklist item now, lint rule later | S | ACCEPTED (checklist) / DEFERRED (lint) | Keeps dark mode viable; lint needs design-system owner | Design-system owner adds lint rule |\n| 13 | Approach C: aggregate `GET /api/dashboard` with per-panel `PanelResult` envelope and `serverTime` | M | ACCEPTED, provisional (taste T2) | Only approach that gives per-panel error states in one round trip and a server clock for the read snapshot | Gate may choose B (client composes existing endpoints) |\n| 14 | Shared `PanelFrame` (state chrome) and shared `Toast` primitive | S | ACCEPTED, provisional (taste T4) | Three panels share one state switch; a11y policy requires a live region and no toast exists; shared placement is the same code in a reusable folder | Gate may choose inline status text over toast |\n| 15 | QuickActions as visual primary; fixed column order at sm/md/lg | S | ACCEPTED | Only panel that drives the metric; three equal cards is the generic pattern | \u2014 |\n| 16 | Keep confirmation modal for \"Mark all as read\" | S | ACCEPTED, provisional (taste T3) | No undo/restore API exists and the plan forbids new mutation APIs; confirm is the honest safety net | Gate may choose direct action + undo (needs a new mutation API, breaks a plan constraint) |\n\n## Accepted Scope (added to this plan)\n- Analytics baseline pull and find/do split before target lock (#1)\n- Numeric rollback triggers (#2)\n- Relative timestamps in ActivityFeed (#3)\n- Unread badge + title mirror (#4)\n- Back-to-previous-landing link during rollout (#5)\n- Action-pointing empty-state copy (#6)\n- Token-only styling as a PR review checklist item (#12)\n- Approach C: aggregate endpoint with per-panel `PanelResult` envelope and `serverTime` (#13)\n- Shared `PanelFrame` and shared `Toast` primitive (#14)\n- QuickActions as visual primary; fixed column order at sm/md/lg (#15)\n- Confirmation modal on the existing dialog primitive (#16)\n- Per-panel state machine and instrumentation (metrics, alerts, structured logs) as specified in the source plan's accepted CEO obligations\n\n## Deferred to TODOS.md\n- Keyboard shortcuts for quick actions (#7)\n- Prefetch dashboard payload during login redirect (#8)\n- Redirect-to-resume experiment arm under the same flag framework (#9, taste T1)\n- Ranked \"next up\" card + real-time push (#10)\n- Endpoint caching once p95 data exists (#11)\n- Token-only styling lint enforcement (#12)\n\n## Taste decisions (provisional; confirmed or overridden at the /autoplan Final Approval Gate)\n- T1: **Provisional decision: dashboard is the sole arm; experiment deferred (#9).** Alternative: run a redirect-to-resume arm concurrently.\n- T2: **Provisional decision: Approach C (#13).** Alternative: B, client composition of existing endpoints plus a new quick-actions endpoint.\n- T3: **Provisional decision: keep the confirmation modal (#16).** Alternative: direct action with undo, which needs a new mutation API.\n- T4: **Provisional decision: shared toast primitive (#14).** Alternative: inline status text per panel.\n",
  "hook": {
    "version": 1,
    "cwd": "/tmp/gstack-paid-shard-uaCq3n/tmp/gstack-autoplan-chain-RnwL2i",
    "config": "/tmp/gstack-paid-shard-uaCq3n/tmp/gstack-hermetic-2101964-HvDZyN/with-skills/.claude",
    "stateRoot": "/tmp/gstack-paid-shard-uaCq3n/tmp/gstack-hermetic-2101964-HvDZyN/skill-home-zgCNxG/.gstack",
    "seenIds": [
      "toolu_01BbKwZ7JFFdm2FLFdcNQXPq",
      "toolu_01W9d5F6LgadaG9o9maU8kaT",
      "toolu_01YXZEmM6gthBvGshzGE4zYb"
    ],
    "pending": {
      "source": "pre_tool_use",
      "sessionId": "9b7779e9-18f9-4f8d-84ac-9e8bf4458a8e",
      "toolUseId": "toolu_01YXZEmM6gthBvGshzGE4zYb",
      "tool": "Edit",
      "file": "/tmp/gstack-paid-shard-uaCq3n/tmp/gstack-hermetic-2101964-HvDZyN/skill-home-zgCNxG/.gstack/projects/gstack-autoplan-chain-RnwL2i/ceo-plans/2026-09-10-user-dashboard.md",
      "timestamp": "2026-09-10T09:42:01.132Z",
      "transcriptPath": "/tmp/gstack-paid-shard-uaCq3n/tmp/gstack-hermetic-2101964-HvDZyN/with-skills/.claude/projects/-tmp-gstack-paid-shard-uaCq3n-tmp-gstack-autoplan-chain-RnwL2i/9b7779e9-18f9-4f8d-84ac-9e8bf4458a8e.jsonl",
      "editDigest": {
        "version": 1,
        "beforeSHA256": "87ba6c184db192a85eb4fa0771dc59d6f3e12311f73a5bccc3497fd3138899ec",
        "requestSHA256": "0b2f9bd8a462279cfd3845b2200c448072a8efb68287b75aa95dcf0b38eb0efd",
        "oldLineHashes": [
          "0e0dffc87c4190d31ee08629994526b6d12fb120ffb7a88ff1011d4f385f3923"
        ],
        "newLineHashes": [
          "36e18b0e5881093948120902c19482cf1eafbf4716500ed739cabaa8064287e3"
        ]
      }
    },
    "sessionId": "9b7779e9-18f9-4f8d-84ac-9e8bf4458a8e"
  },
  "publicTools": [
    {
      "sessionId": "9b7779e9-18f9-4f8d-84ac-9e8bf4458a8e",
      "timestamp": "2026-09-10T09:36:51.205Z",
      "toolUseId": "toolu_01EMZc2Hum5xqWxGHi3dddtJ",
      "kind": "use",
      "name": "Edit",
      "input": {
        "replace_all": false,
        "file_path": "/tmp/gstack-paid-shard-uaCq3n/tmp/gstack-hermetic-2101964-HvDZyN/with-skills/.claude/plans/starry-riding-otter.md",
        "old_string": "## Review record\n",
        "new_string": "## Review record\n\n<!-- /autoplan run autoplan-20260910-092822-5a343286 | base branch: main (no remote; git-native fallback) | Codex: disabled (codex_reviews=disabled) | UI scope: yes | DX scope: yes (21 term matches, threshold 2) -->\n\n### Phase 0: Intake\n\n- SOURCE_PLAN: `.claude/plans/ui-heavy-feature.md` (sha256 2fdf0ece\u2026fddbc, 4607 bytes). Restore point written by `init`.\n- Context read: no CLAUDE.md, no TODOS.md, no design doc, one commit (`28730e6 init UI-heavy fixture`), no diff vs main, no stash, no TODO/FIXME markers.\n- **System audit key finding:** the repository contains only `README.md` and the plan file. None of the \"existing contracts\" the plan cites (repository methods, dialog primitive, action registry, HTTP clients, Vitest/RTL/Playwright, feature flags) exist in this repo. Every reuse claim is unverifiable here and is treated as a stated premise, not a checked fact.\n- Prerequisite /office-hours offer: auto-decided **skip** (P6, one-gate rule). Cross-project learnings config prompt: left unset (user preference, not a plan decision; LEARNINGS: 0 so no effect this run).\n- CLAUDE.md routing rules: user accepted (D1). Deferred until plan mode exits: write CLAUDE.md routing section and commit.\n- CEO methodology read log: `methodology.md` (2260 lines, sha256 cbb64d50\u20269a28) read at offsets 1/601/1201/1801, all four ranges successful through EOF.\n\n### Phase 1: CEO Review (SELECTIVE EXPANSION)\n\n**Mode selection (0F):** SELECTIVE EXPANSION per /autoplan override. Context default agrees: this is a feature on an existing system (consolidates three existing pages), not greenfield.\n\n**Landscape check:** Aside not installed, WebSearch not used in plan mode for this fixture. Proceeding with in-distribution knowledge. Layer 1 (tried and true): post-login \"home\" dashboards with a primary action rail, an alerts panel, and a recent-activity feed are the standard shape (Linear, GitHub, Notion, Asana home). Layer 2: the current trend is \"next up\" surfaces that rank one action above the fold rather than three equal panels. Layer 3 (first principles): the plan's metric is login-to-first-completed-task. Only QuickActions directly drives that metric; notifications and activity are context. Hierarchy should follow the metric.\n\n#### 0A. Premise Challenge\n\n| # | Premise | Stated or assumed | Assessment | Decision |\n|---|---------|-------------------|------------|----------|\n| P1 | Members spend a median 75s finding the next item after login | Stated, sourced from a team walkthrough, not the analytics the plan says already record login/action start/completion | Reasonable but weakly sourced. Real member data exists and is cheaper than a walkthrough. | Accept the problem; **add requirement**: pull real median/p90 login-to-first-task from existing analytics before locking the 45s target (auto-approved, in blast radius, <1h). |\n| P2 | A three-panel dashboard is the right shape to hit 45s | Assumed | Consolidation of three pages does move navigation time. But only one panel (QuickActions) drives task completion. A redirect-to-resume experiment could bank part of the win cheaper, though it skips alerts, which the plan says members need. | Accept dashboard shape. **Amend**: QuickActions is the visual primary. Redirect-to-resume experiment \u2192 **TASTE DECISION T1** (surfaced at gate) and deferred to TODOS.md. |\n| P3 | One aggregate `GET /api/dashboard` is better than the client calling existing endpoints | Assumed | No justification in plan. Quick actions have no existing list endpoint (registry + server predicates), so a new endpoint exists either way. | Resolved in 0C-bis: aggregate with per-panel result envelope (Approach C). B vs C close \u2192 **TASTE DECISION T2**. |\n| P4 | \"Mark all as read\" needs a confirmation modal | Stated | The bulk-read API is idempotent and snapshot-bounded, but there is no restore/undo API and the plan forbids new mutation APIs. Without undo, a confirm is the honest safety net. | Keep modal. Direct-action+undo would need a new mutation API (plan constraint). **TASTE DECISION T3** (recommend keep). |\n| P5 | A toast system is needed for action feedback | Stated | Accessibility policy requires a live region for nonblocking feedback; nothing exists. Building it as a one-page component would be regretted; building it as a shared primitive is the same code in a different folder. | Build toast as a shared UI primitive (P1, P4). Inline-text alternative \u2192 **TASTE DECISION T4** (recommend shared toast). |\n| P6 | No schema changes needed | Stated | Consistent with read composition + existing bulk-read API. | Accept. |\n| P7 | Existing fixtures/flags/metrics exist and are reusable | Stated | Cannot verify in this repo (see system audit). | Accept as premise; **flag at gate** as an unverified dependency, not a challenge. |\n\nNo premise is clearly wrong. No User Challenge queued from 0A.\n\n#### 0B. Existing Code Leverage Map\n\n| Sub-problem | Existing code (per plan) | Reused? |\n|---|---|---|\n| Auth + workspace scoping | Cookie sessions, membership middleware, request context member/workspace IDs | Yes: handler reads IDs from request context only |\n| Activity list | Repository list method (latest 20 + cursor, indexed) | Yes: called by aggregate handler |\n| Notifications list | Repository list method (latest 20 + cursor, indexed) | Yes |\n| Mark all as read | Member-scoped idempotent bulk-read API, snapshot-time bounded, CSRF | Yes: modal confirm calls it with server-issued snapshot time |\n| Quick actions | Action registry (3 actions, IDs, labels, routes, server eligibility predicates) | Yes: handler evaluates predicates, returns eligible set |\n| Typed client errors | Existing HTTP clients (unauthenticated/forbidden/validation/retryable/network) | Yes: each panel maps typed errors to states |\n| Dialog | Dialog primitive (focus trap, Escape, focus return) | Yes: modal composes it |\n| Toast | None | **New shared primitive** |\n| Layout tokens | Tailwind tokens, responsive page shell, buttons, links | Yes; **constraint added**: token-only values in dashboard components |\n| Tests | Vitest, RTL, Playwright, fixtures (member, other workspace, empty, failures) | Yes; dashboard specs new |\n| Rollout | Feature flags, request/error metrics | Yes; flag `dashboard_landing` |\n| Analytics | login, action start/completion, permission errors | Yes; add `dashboard_view`, `dashboard_panel_state`, `quick_action_click`, `mark_all_read` |\n\nNothing is rebuilt that already exists.\n\n#### 0C. Dream State\n\n```\n  CURRENT STATE                    THIS PLAN                          12-MONTH IDEAL\n  Login \u2192 generic landing          Login \u2192 /dashboard (flagged        Login \u2192 \"next up\" home that\n  Member visits 3 pages to         cohort). One round trip, three     ranks the single best action,\n  resume / check alerts /          panels, QuickActions primary,      streams notification updates,\n  inspect changes. ~75s (walk-     per-panel failure isolation,       personal layout, dark mode,\n  through) to first task.   --->   shared toast + modal, a11y,  --->  cross-workspace view.\n  No dashboard telemetry.          telemetry on every state,          Dashboard is the platform\n                                   rollback = flag off.               surface other teams add to.\n```\n**Dream state delta:** this plan lands the substrate (aggregate envelope, panel state machine, shared toast, instrumentation) that the ideal builds on. It does not do ranking, streaming, personalization, or dark mode. It moves toward the ideal; nothing here blocks it.\n\n#### 0C-bis. Implementation Alternatives\n\n```\nAPPROACH A: Minimal aggregate (all-or-nothing)\n  Summary: GET /api/dashboard runs three repository calls; any failure \u2192 5xx; client shows one page-level error. Dialog primitive for confirm; inline status text instead of toast.\n  Effort:  S (human ~3 days / CC ~1h)     Risk: Med (one slow panel blanks the page)\n  Pros:    fewest files; no new primitive; simplest handler\n  Cons:    violates \"error state for each panel\"; one repo timeout hides everything; no live region for feedback\n  Reuses:  repos, middleware, dialog, tokens\n  Completeness: 5/10\n\nAPPROACH B: Client composes existing endpoints\n  Summary: Page calls existing activity + notifications list endpoints in parallel plus a NEW /api/quick-actions endpoint. Panel isolation for free. Shared toast primitive.\n  Effort:  M (human ~5 days / CC ~1.5h)   Risk: Low-Med (3 round trips on mobile; still one new endpoint)\n  Pros:    reuses two endpoints verbatim; per-panel failure isolation is structural; no partial-failure design\n  Cons:    3 requests per landing on mobile; snapshot time for mark-all-read has no single server clock source; new endpoint needed anyway\n  Reuses:  existing list endpoints, clients, dialog\n  Completeness: 8/10\n\nAPPROACH C: Aggregate with per-panel result envelope (RECOMMENDED)\n  Summary: GET /api/dashboard runs three repository calls concurrently, returns\n           { serverTime, activity: PanelResult, notifications: PanelResult, quickActions: PanelResult }\n           where PanelResult = { status:\"ok\", data, cursor? } | { status:\"error\", code }.\n           HTTP 200 whenever auth passes; per-panel errors are data. Shared toast primitive.\n  Effort:  M (human ~6 days / CC ~2h)     Risk: Low\n  Pros:    one round trip; per-panel isolation matches the plan's own state requirement; serverTime gives the mark-all-read snapshot; envelope pattern is reusable\n  Cons:    new composition + partial-failure code; 200-with-errors needs its own metric (not HTTP status alerts)\n  Reuses:  repos, middleware, action registry, dialog, tokens, clients\n  Completeness: 9/10\n```\n**RECOMMENDATION:** C, because it is the only approach that satisfies the plan's stated per-panel state requirement in one round trip and yields a server clock for the read snapshot (P1 completeness, P5 explicit). B is close (8/10) \u2192 **TASTE DECISION T2**.\n\n#### 0D. Mode-Specific Analysis (SELECTIVE EXPANSION)\n\n**Complexity check:** ~12 new files (page, 3 panels, hook, modal, toast primitive + provider, handler, envelope type, 3 test files, Playwright spec). Over the 8-file smell threshold, but each file is a distinct concern with no shared mutable state beyond the dashboard hook. Not reducible without merging panels into one component, which would defeat per-panel states. Accepted.\n\n**Minimum set achieving the goal:** page + QuickActions + endpoint + flag. Notifications and Activity could ship later without blocking the metric. Mechanical decision: do not reduce scope on a complete plan (P1). All three panels stay.\n\n**Expansion scan**\n- 10x: a ranked \"next up\" card above the panels, updated in real time, that turns the dashboard from a place you check into a place that tells you what to do. Concrete shape: server ranking over eligible actions + unread notifications, SSE channel for updates. Effort human ~3 weeks / CC ~1 day. **Deferred**: new infra (ranking service, push), outside blast radius.\n- Delight opportunities (\u22655), each decided by the blast-radius rule (in radius + <1d \u2192 accept; else defer):\n  1. Relative timestamps (\"3 min ago\") with absolute time on hover/focus in ActivityFeed. **ACCEPT** (1 file, <1h).\n  2. Unread count badge in NotificationsPanel header, mirrored into `document.title` while unread > 0. **ACCEPT** (1 file, <1h).\n  3. \"Back to the previous landing page\" link in the dashboard header during rollout, removed when flag reaches 100%. **ACCEPT** (1 file, <1h). Gives per-member escape hatch and a bounce-back metric.\n  4. Empty-state copy that points at the primary action (\"Nothing to resume. Create an item or invite a teammate.\") **ACCEPT** (copy only).\n  5. Keyboard shortcuts for the three quick actions. **DEFER** to TODOS.md: shortcut conflicts with existing pages need an audit; not on the metric path.\n  6. Prefetch `/api/dashboard` during the login redirect. **DEFER**: touches login flow, outside radius.\n  7. Post-login redirect-to-resume experiment arm under the same flag framework. **DEFER** + TASTE T1.\n- Platform potential: the `PanelResult` envelope and the toast primitive are reusable by any future composite page. Accepted as part of C.\n\n**Cherry-pick ceremony (auto-decided, neutral posture, logged in audit trail):** Accepted 1-4; deferred 5-7 and 10x.\n\n**Additional accepted hardening (from premise challenge and outside voice, all in blast radius):**\n- Baseline pull: real median/p90 login-to-first-task and find-vs-do split from existing analytics before locking 45s.\n- Numeric rollback triggers defined before rollout (see Section 9).\n- Token-only styling constraint for dashboard components (review checklist now; lint enforcement \u2192 TODOS.md).\n\n#### 0E. Temporal Interrogation (human hours; CC \u2248 10-20x faster)\n\n```\nHOUR 1 (foundations):   PanelResult type + serverTime in the envelope; flag name dashboard_landing;\n                        route /dashboard gated by flag; toast primitive API (show({kind, message, persistent?})).\nHOUR 2-3 (core logic):  Handler: Promise.allSettled over three repo calls; map rejections to {status:\"error\", code}\n                        by typed error class; never leak internal messages. Client hook maps 401\u2192login redirect,\n                        403\u2192forbidden state, validation\u2192error state with log, retryable\u2192auto-retry once then\n                        error+Retry button, network\u2192error+Retry.\nHOUR 4-5 (integration): Mark-all-read uses envelope.serverTime as snapshot, POST via existing bulk-read API with\n                        CSRF; button disabled while in flight; on success optimistic clear + toast; on 401/403/CSRF\n                        failure toast \"Session expired, refresh\"; on retryable error retry once then persistent toast.\n                        Old landing page stays reachable at its route.\nHOUR 6+ (polish/tests): Skeleton fixed heights (no layout shift); reduced-motion disables skeleton shimmer and toast\n                        slide; toast max 3 stacked, 5s auto-dismiss, pause on hover/focus, role=\"status\" for\n                        success and role=\"alert\" for errors (persistent until dismissed); Playwright: flag on/off,\n                        each panel state, keyboard-only modal flow, screen reader names.\n```\nDecisions above are resolved now and recorded as accepted obligations.\n\n#### Section 1: Architecture Review\n\n```\n  Browser (React)                                     Server\n  \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510            \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n  \u2502 /dashboard (flag: dashboard_landing) \u2502            \u2502 GET /api/dashboard                  \u2502\n  \u2502  UserDashboard.tsx                   \u2502  1 fetch   \u2502  DashboardHandler                   \u2502\n  \u2502   \u251c\u2500 useDashboard()  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u25b6 \u2502   \u251c\u2500 session + membership middleware\u2502\n  \u2502   \u251c\u2500 QuickActions   (primary)        \u2502            \u2502   \u251c\u2500 Promise.allSettled([           \u2502\n  \u2502   \u251c\u2500 NotificationsPanel              \u2502            \u2502   \u2502    activityRepo.list(ws, 20)    \u2502\n  \u2502   \u2502    \u2514\u2500 MarkAllReadModal \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 POST \u2500\u2500\u2500\u25b6 \u2502   \u2502    notificationRepo.list(m,ws,20)\u2502\n  \u2502   \u2502         (dialog primitive)       \u2502  existing  \u2502   \u2502    actionRegistry.eligible(m,ws)])\u2502\n  \u2502   \u2514\u2500 ActivityFeed                    \u2502  bulk-read \u2502   \u2514\u2500 envelope {serverTime, 3\u00d7PanelResult}\n  \u2502  ToastProvider (shared ui primitive) \u2502            \u2502 POST /api/notifications/read-all (existing)\n  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518            \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n                                                         \u2502            \u2502             \u2502\n                                                     PostgreSQL   PostgreSQL   registry predicates\n```\n- **Data flow, four paths (GET /api/dashboard):** happy \u2192 200 envelope, all `ok`. Nil (no session) \u2192 middleware 401 before handler; client redirects to login. Empty (member with zero activity/notifications/eligible actions) \u2192 200, `ok` with `data: []`, each panel renders its empty state; QuickActions empty state must never occur in practice (create-item is always eligible for a member) but is still rendered and tested. Error (one repo throws) \u2192 that panel `{status:\"error\", code}`, others `ok`; page renders; metric emitted.\n- **State machine (per panel):** `idle \u2192 loading \u2192 (ok|empty|error) ; error \u2192 loading (retry)`. Invalid: `loading \u2192 loading` (prevented by in-flight guard), `ok \u2192 error` without a new request (impossible; state only changes on response).\n- **Mark-all-read state machine:** `closed \u2192 open (button) \u2192 submitting (confirm) \u2192 (closed+success toast | open+error toast)`. Double confirm prevented by disabling the confirm button while submitting. Escape during submitting is ignored (dialog stays until response) to avoid orphaned toasts.\n- **Coupling:** handler now depends on three repositories and the action registry; that fan-in is the point of the endpoint and is bounded by the envelope contract. No new coupling between panels; each consumes its own `PanelResult`.\n- **Scaling:** 10x load \u2192 three indexed LIMIT 20 queries per landing; DB connection use triples per request vs a single-page load. First to break: pool saturation under a login storm. Mitigation: concurrent calls share the request's pool budget; flag-gated cohort rollout observes p95. 100x \u2192 add short TTL cache per member (deferred, Section 7).\n- **SPOF:** PostgreSQL (existing). The endpoint adds none.\n- **Security architecture:** endpoint is read-only, scoped by request-context member/workspace; no IDs from query string. Mutation reuses existing CSRF-protected bulk-read API. See Section 3.\n- **Production failure scenario:** notifications table lock during a bulk job \u2192 `notificationRepo.list` times out \u2192 `notifications: {status:\"error\", code:\"retryable\"}`; page still shows actions and activity; panel shows Retry; `dashboard_panel_error{panel=notifications}` spikes \u2192 alert. Plan (as amended) accounts for it.\n- **Rollback:** flag `dashboard_landing` off \u2192 login lands on the previous page; under 1 minute; no migration; endpoint can stay deployed dark.\n- **Beauty / platform:** `PanelResult<T>` as a typed discriminated union is the one abstraction; a new engineer reads it in 30 seconds. It makes any future composite page a two-line addition.\n\nFindings: (1) HTTP 200 with per-panel errors hides failures from status-code alerts \u2192 **decided**: emit `dashboard_panel_error` metric and alert on it (Section 8). (2) Old/new client mismatch during deploy \u2192 **decided**: page route gated by flag; endpoint deploys first (Section 9). Both auto-decided (mechanical, P5).\n\n#### Section 2: Error & Rescue Map\n\n```\n  METHOD/CODEPATH                 | WHAT CAN GO WRONG                   | ERROR CLASS\n  --------------------------------|-------------------------------------|---------------------------\n  membership middleware            | no/expired session                  | UnauthenticatedError (401)\n                                   | member not in workspace             | ForbiddenError (403)\n  DashboardHandler                 | activityRepo.list timeout/DB error  | RetryableServiceError\n                                   | notificationRepo.list timeout/DB    | RetryableServiceError\n                                   | actionRegistry.eligible throws      | RegistryEvaluationError\n                                   | envelope serialization bug          | TypeError (programmer)\n  useDashboard (client)            | network down                        | NetworkError\n                                   | 401                                 | UnauthenticatedError\n                                   | 403                                 | ForbiddenError\n                                   | response fails schema check         | ValidationError\n                                   | 5xx / retryable                     | RetryableServiceError\n  MarkAllRead submit               | CSRF token stale                    | ForbiddenError (CSRF)\n                                   | 401/403                             | Unauthenticated/Forbidden\n                                   | bulk-read API 5xx                   | RetryableServiceError\n                                   | network                             | NetworkError\n                                   | double submit                       | (prevented) in-flight guard\n  ToastProvider                    | toast fires after unmount           | (prevented) timer cleared on unmount\n                                   | >3 toasts                           | (prevented) queue, oldest dropped\n\n  ERROR CLASS                 | RESCUED? | RESCUE ACTION                                   | USER SEES\n  ----------------------------|----------|-------------------------------------------------|----------------------------------\n  UnauthenticatedError        | Y        | client redirects to /login?next=/dashboard      | login page\n  ForbiddenError (endpoint)   | Y        | forbidden state, log warn with member/ws ids     | \"You don't have access to this workspace\"\n  RetryableServiceError (panel)| Y       | handler maps to PanelResult error; client auto-retries once, then Retry button; log error with panel, ids, duration; metric | panel error state + Retry\n  RegistryEvaluationError     | Y        | quickActions PanelResult error; log error         | actions panel error + Retry\n  TypeError (envelope)        | Y        | existing 500 handler; log with request id         | page-level error + Retry (rare)\n  ValidationError (client)    | Y        | error state, log to client error reporter        | panel/page error + Retry\n  NetworkError                | Y        | error state with Retry; no auto-retry             | \"Can't reach the server\" + Retry\n  ForbiddenError (CSRF)       | Y        | persistent error toast; keep modal open           | \"Session expired. Refresh and try again.\"\n  RetryableServiceError (POST)| Y        | retry once, then persistent error toast           | \"Couldn't mark all as read. Try again.\"\n  NetworkError (POST)         | Y        | persistent error toast                           | same as above\n```\nNo catch-all rescues. Every rescued error logs member id, workspace id, request id, panel, and duration. No GAP rows. Finding: none unrescued. \"No issues, moving on\" after mapping 14 error paths.\n\n#### Section 3: Security & Threat Model\n\n| Threat | Likelihood | Impact | Mitigated? |\n|---|---|---|---|\n| IDOR: member reads another workspace's activity via query param | Low | High | Yes: handler takes IDs from request context only; test with \"another workspace\" fixture asserts 403/empty |\n| Ineligible action leaked to client | Med | Med | Yes: eligibility predicates evaluated server-side in handler; client never receives ineligible actions; clicking still hits existing server checks |\n| Open redirect via action route targets | Low | Med | Yes: routes come from the server registry, never from user input; client only renders registry routes |\n| XSS via activity descriptions / notification text | Med | High | Yes: render as text nodes, never `dangerouslySetInnerHTML`; RTL test asserts a `<script>` string renders escaped |\n| CSRF on mark-all-read | Low | Med | Yes: existing POST with CSRF token; stale token \u2192 explicit error toast |\n| Client-supplied snapshot time marks future notifications read | Low | Low | Yes: snapshot = `serverTime` from envelope; server still clamps to now |\n| Info leak in error codes | Low | Low | Yes: PanelResult `code` is an enum, never an exception message |\n| New dependency risk | \u2014 | \u2014 | None added (toast built on existing React + tokens) |\n| PII | \u2014 | \u2014 | Notification text and actor names already exist in the system; no new classification |\n| Audit logging | \u2014 | \u2014 | Mark-all-read already audited by existing API; dashboard views are analytics, not audit |\n\nFinding: \"ineligible action leaked\" was implicit in the plan \u2192 **decided**: explicit requirement that eligibility runs in the handler and is tested (P5). One finding, auto-decided.\n\n#### Section 4: Data Flow & Interaction Edge Cases\n\n```\n  request \u2500\u2500\u25b6 middleware \u2500\u2500\u25b6 allSettled(3) \u2500\u2500\u25b6 envelope \u2500\u2500\u25b6 client hook \u2500\u2500\u25b6 panel state\n    \u2502             \u2502              \u2502                \u2502             \u2502              \u2502\n  [no cookie]  [not member]  [one rejects]     [serialize]   [schema fail]  [stale after\n   \u2192 401        \u2192 403        \u2192 error panel      \u2192 500         \u2192 error        mark-all-read]\n                              [all reject]                    [network]       \u2192 optimistic\n                               \u2192 200, 3 errors,                \u2192 error+Retry    clear + refetch\n                               page-level notice\n```\n**Async ordering (mark-all-read vs refetch):** shared state = `notifications` panel data.\n```\n  t  | MarkAllRead POST        | useDashboard refetch (Retry/focus) | notifications state\n  1  | submitting (snapshot S) |                                    | unread list\n  2  |                         | GET starts                         | unread list\n  3  | 200 \u2192 optimistic clear  |                                    | []\n  4  |                         | GET returns pre-read data          | unread list  \u2190 STALE\n```\nOrder 3-then-4 reverts the optimistic clear. Mechanism to prevent: refetch triggered on mutation success (after 3), and any in-flight GET started before the POST resolved is discarded by a request sequence counter. Test both orders with controlled promise resolution.\n\n| Interaction | Edge case | Handled | How |\n|---|---|---|---|\n| Mark all as read | double-click confirm | Y | button disabled while submitting |\n| | stale CSRF | Y | persistent error toast, modal stays open |\n| | navigate away mid-submit | Y | request completes server-side; toast suppressed if provider unmounted |\n| | new notification arrives between open and confirm | Y | snapshot time bounds the marking; new one stays unread after refetch |\n| Quick action click | ineligible since page load | Y | destination's existing server check; permission-error metric already exists |\n| | double-click | Y | it is a link navigation; second click is a no-op |\n| Panel list | zero results | Y | empty state with copy |\n| | 10,000 results | Y | latest 20 + \"View all\" link to existing full page |\n| | results change mid-view | Y | no live update in v1; refetch on window focus |\n| Page load | slow connection | Y | fixed-height skeletons, no layout shift |\n| | back button from an action | Y | refetch on focus/visibility |\n| Toast | 4th toast | Y | oldest dropped |\n| | reduced motion | Y | no slide animation |\n\nFindings: stale refetch race \u2192 **decided**: sequence counter + refetch-after-mutation + ordered tests (P1). \"View all\" links for overflow \u2192 **decided** (P1). Two findings, auto-decided.\n\n#### Section 5: Code Quality Review\n\n- Organization: `src/pages/UserDashboard.tsx`, `src/features/dashboard/{ActivityFeed,NotificationsPanel,QuickActions,MarkAllReadModal,useDashboard}.tsx`, `src/components/ui/Toast.tsx` (+ provider), `server/routes/dashboard.ts`, `shared/types/dashboard.ts` (envelope). Fits the stated existing pattern (pages + primitives).\n- DRY: the three panels share loading/empty/error chrome \u2192 one `PanelFrame` component takes `PanelResult` and renders state chrome, children render the ok state. Prevents three copies of the same state switch. **Decided** (P4).\n- Naming: `PanelResult`, `PanelFrame`, `useDashboard`, `MarkAllReadModal` describe what, not how.\n- Error handling patterns: typed discriminated union; no `catch (e) {}`.\n- Missing edge cases now explicit: nil session, empty panels, one panel error, all three errors, CSRF stale, race on refetch.\n- Over-engineering check: no generic \"widget framework\"; `PanelResult` + `PanelFrame` only.\n- Under-engineering check: the original plan's \"error state for each panel\" without an envelope was under-engineered; fixed by C.\n- Complexity: handler has one branch per panel (3) plus auth; under 5. Client hook maps 5 error classes \u2192 a lookup table, not a branch chain.\n\nOne finding (PanelFrame extraction), auto-decided.\n\n#### Section 6: Test Review\n\n```\n  NEW UX FLOWS:      land on /dashboard (flag on/off); panel loading\u2192ok/empty/error; Retry; open modal;\n                     confirm mark-all-read; cancel/Escape; quick action click; toast show/dismiss;\n                     \"back to previous landing page\" link; unread badge + title.\n  NEW DATA FLOWS:    GET /api/dashboard envelope (4 paths); POST bulk-read with serverTime snapshot.\n  NEW CODEPATHS:     allSettled mapping per rejection class; eligibility filtering; client error\u2192state table;\n                     request sequence counter; toast queue cap; reduced-motion branch.\n  NEW ASYNC WORK:    concurrent repo calls; optimistic clear + refetch; toast timers.\n  NEW INTEGRATIONS:  none external.\n  NEW ERROR PATHS:   14 rows in Section 2.\n```\n| Item | Test type | Happy | Failure | Edge |\n|---|---|---|---|---|\n| DashboardHandler | integration (Vitest + test DB) | 200 envelope all ok, exactly 20 items per list | one repo rejects \u2192 that panel error, others ok, 200 | all reject \u2192 200 with 3 errors; another-workspace fixture \u2192 403; no session \u2192 401 |\n| eligibility filtering | unit | eligible 3 \u2192 3 returned | predicate throws \u2192 quickActions error | ineligible action never in response (exact count) |\n| useDashboard | unit (RTL) | maps envelope to states | each of 5 error classes \u2192 expected state | sequence counter discards stale response (both orders) |\n| PanelFrame | unit | ok renders children | error renders Retry, calls onRetry once | empty renders copy; skeleton has fixed height |\n| MarkAllReadModal | unit + E2E | confirm \u2192 POST with serverTime, optimistic clear, success toast | CSRF 403 \u2192 persistent toast, modal open | double-click \u2192 single POST; Escape while submitting ignored |\n| Toast | unit | show \u2192 role=status text | error \u2192 role=alert persistent | 4th drops oldest; unmount clears timers; reduced-motion no animation |\n| QuickActions | unit | renders 3 links with registry routes | error state | empty state copy |\n| XSS | unit | \u2014 | `<script>` text renders escaped | \u2014 |\n| Playwright | E2E | flag on \u2192 /dashboard after login; keyboard-only mark-all-read | flag off \u2192 old landing | axe scan zero violations at sm/md/lg; focus returns to trigger after modal |\n| Perf check | integration | p95 handler < 300ms on seeded 10k rows | \u2014 | \u2014 |\n\nAssertions are exact where the requirement is exact (20 items, single POST, zero ineligible actions). 2am Friday test: Playwright flag-on login \u2192 mark all read \u2192 reload \u2192 unread count 0 and a notification created after serverTime is still unread. Hostile QA: reject one repo with a 3s delay and assert the other panels render before it resolves. Chaos: kill DB connection mid-request \u2192 all three error panels, no 500, metric emitted. Pyramid: ~25 unit, ~6 integration, ~4 E2E. Flakiness: toast timers use fake timers; serverTime injected. Load: seeded 10k rows perf assertion above.\n\nFindings: the plan had \"interaction tests must be specified\" with none specified \u2192 **decided**: the table above is the spec (P1). Auto-decided.\n\n#### Section 7: Performance Review\n\n- N+1: activity rows need actor names \u2192 repository must batch-load actors (one IN query). **Decided** requirement. Notifications are flat.\n- Memory: 3 \u00d7 20 rows per request; trivial.\n- Indexes: existing workspace/member + created_at indexes cover `ORDER BY created_at DESC LIMIT 20`.\n- Caching: none in v1; ETag/short TTL \u2192 TODOS.md if p95 exceeds budget at 100% rollout.\n- Slow paths: handler p99 \u2248 max of three queries (~50-150ms) + eligibility predicates; target p95 < 300ms server, < 800ms TTFB at client.\n- Connection pool: 3 concurrent connections per landing; cohort rollout watches pool wait time.\n\nOne finding (actor batch-load), auto-decided.\n\n#### Section 8: Observability & Debuggability\n\n- Logs: handler entry/exit structured with request id, member id, workspace id, per-panel status and duration. Client error reporter receives ValidationError/NetworkError with panel.\n- Metrics: `dashboard_request_duration_ms` (histogram), `dashboard_panel_error_total{panel,code}`, `dashboard_view_total`, `quick_action_click_total{action_id}`, `mark_all_read_total{result}`, `dashboard_back_link_click_total`. Existing: login, action start/complete, permission errors \u2192 compute login-to-first-task per cohort.\n- Tracing: request id propagated into all three repo calls (existing pattern).\n- Alerts: `dashboard_panel_error_total` rate > 2% over 5m; p95 request duration > 800ms over 10m; `mark_all_read_total{result=error}` > 5% over 15m.\n- Dashboard panels day 1: request p50/p95, panel error rate by panel, cohort login-to-first-task median/p90 vs control, back-link click rate, completed-task rate, permission-error rate.\n- Debuggability: a 3-week-old report reproduces from request id \u2192 per-panel status/duration \u2192 repo logs.\n- Runbook: panel error spike \u2192 check repo/DB health; if page-level, flag off. Latency \u2192 flag to smaller cohort.\n- Joy to operate: the cohort comparison panel shows the metric moving in real time.\n\nFindings: instrumentation was \"still needs\" in the plan \u2192 **decided**: the list above is the requirement. Auto-decided.\n\n#### Section 9: Deployment & Rollout\n\n- No migration.\n- Flag `dashboard_landing`: gates both the post-login redirect and the `/dashboard` route. Endpoint is not flag-gated (harmless read).\n- Order: (1) deploy server with endpoint + client with route behind flag (dark); (2) flag on for internal members; (3) 10% cohort \u2265 3 days; (4) 50%; (5) 100%; (6) remove back-link.\n- Rollback: flag off. Under 1 minute. Old landing page untouched.\n- Deploy-time window: old client + new server \u2192 nothing changes (no route). New client + old server \u2192 prevented by deploying server first and gating the route by flag.\n- Staging: full flow with flag on, seeded fixtures, axe scan.\n- Post-deploy 5 min: GET /api/dashboard returns 200 for a test member; panel error rate ~0; 1 hour: p95 within budget, no alert.\n- **Rollback triggers (numeric, defined now):** cohort completed-task rate down > 5% vs control; permission-error rate up > 2 points; p95 endpoint > 800ms for 10m; panel error rate > 2%; back-link click rate > 20% of cohort views.\n- Smoke: synthetic login \u2192 GET /api/dashboard 200 with three `ok` panels.\n\nFinding: rollback triggers absent \u2192 **decided** as above (P1). Auto-decided.\n\n#### Section 10: Long-Term Trajectory\n\n- Debt: shared toast primitive needs an owner (design system); ADR for the envelope pattern; token-only lint rule deferred.\n- Path dependency: the envelope makes adding a fourth panel trivial; ranking/streaming layer on top later.\n- Knowledge: `shared/types/dashboard.ts` docblock with the ASCII architecture diagram; README section for the flag.\n- Reversibility: 4/5 (flag off; endpoint removable; toast primitive stays useful).\n- Ecosystem: discriminated unions + RTL + Playwright are current React practice.\n- 1-year question: a new engineer reads the envelope type and the handler and understands the page.\n- What comes after: ranking \"next up\", live updates, personalization, dark mode; architecture supports each.\n- Retrospective on cherry-picks: deferred redirect experiment is not load-bearing for accepted items; accepted items are independent of each other.\n\nNo new findings beyond debt items listed.\n\n#### Section 11: Design & UX Review (UI scope)\n\n- Information architecture (hierarchy as service): first QuickActions (drives the metric), second Notifications (unread count), third ActivityFeed (context). On sm: single column in that order; md: actions full-width row + two columns; lg: three columns with actions widest.\n- State coverage:\n\n| Feature | LOADING | EMPTY | ERROR | SUCCESS | PARTIAL |\n|---|---|---|---|---|---|\n| QuickActions | skeleton 3 buttons | copy pointing to create | Retry | 1-3 action buttons | n/a |\n| NotificationsPanel | skeleton 5 rows | \"You're all caught up\" | Retry | list + badge + mark-all | some panels errored: page still renders |\n| ActivityFeed | skeleton 5 rows | \"No changes yet\" | Retry | list + View all | same |\n| Mark-all modal | confirm disabled | n/a | persistent toast | success toast + cleared | n/a |\n\n```\n  login \u2500\u2500\u25b6 [flag off] \u2500\u2500\u25b6 previous landing\n        \u2514\u2500\u25b6 [flag on]  \u2500\u2500\u25b6 /dashboard: loading \u2500\u2500\u25b6 ok/empty/error per panel\n                              \u251c\u2500 quick action click \u2500\u2500\u25b6 existing workflow\n                              \u251c\u2500 Mark all as read \u2500\u2500\u25b6 modal \u2500\u2500\u25b6 confirm \u2500\u2500\u25b6 toast \u2500\u2500\u25b6 list cleared\n                              \u2502                            \u2514\u2500\u25b6 cancel/Escape \u2500\u2500\u25b6 focus returns to trigger\n                              \u251c\u2500 View all \u2500\u2500\u25b6 existing full pages\n                              \u2514\u2500 Back to previous landing page \u2500\u2500\u25b6 old route\n```\n- Emotional arc: arrive \u2192 see the one thing to do \u2192 do it. Alerts and history support, never compete.\n- AI slop risk: \"three equal cards\" is the generic pattern; the plan is amended to make actions primary and to write state-specific copy. Non-token values banned.\n- DESIGN.md: none exists in repo; token constraint stands in.\n- Responsive: mobile-first stated; column order defined above.\n- Accessibility: named controls, `role=status`/`alert` live regions, focus-visible, dialog focus trap and return, reduced motion, 44px touch targets on sm, contrast via tokens.\n- Inevitable touches (30-min): unread badge in title; relative timestamps; empty copy pointing to action (all accepted above).\n\nFindings: hierarchy and column order were unspecified \u2192 **decided** as above (P5, P1). Phase 2 (/plan-design-review) runs next because UI scope is detected.\n\n#### Dual voices (CEO)\n\n**Codex SAYS (CEO \u2014 strategy challenge):** disabled (`codex_reviews=disabled`). No outside process started; outside_status: disabled.\n\n**Claude SUBAGENT (CEO \u2014 strategic independence):** completed, INPUT `ceo 2fdf0ece\u2026fddbc` matched the snapshot. 12 findings: redirect-to-resume experiment first (high); 75s baseline from walkthrough not analytics (high); no alternatives section (high); aggregate endpoint unjustified (med); bespoke toast (med); modal on non-destructive action (med); ActivityFeed weighted equal to actions (med); find vs do not decomposed (med); no rollback triggers (med); no effort estimate/kill criterion (med); non-token values creep (low-med); single-role justification and per-member opt-out (low).\n\nDisposition: accepted into plan \u2192 baseline pull + find/do split, rollback triggers, QuickActions primary, alternatives table, token constraint, back-to-previous link. Taste (surfaced at gate) \u2192 T1 redirect experiment, T2 aggregate vs client composition, T3 keep modal, T4 shared toast vs inline text. Rejected \u2192 cut ActivityFeed (scope reduction on a complete plan; P1).\n\n```\nCEO DUAL VOICES \u2014 CONSENSUS TABLE:\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n  Dimension                           Claude  Codex  Consensus\n  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 \u2500\u2500\u2500\u2500\u2500\u2500\u2500 \u2500\u2500\u2500\u2500\u2500\u2500\u2500 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  1. Premises valid?                   partly  \u2014      N/A (outside disabled)\n  2. Right problem to solve?           partly  \u2014      N/A\n  3. Scope calibration correct?        no      \u2014      N/A\n  4. Alternatives sufficiently explored? no    \u2014      N/A\n  5. Competitive/market risks covered? yes     \u2014      N/A\n  6. 6-month trajectory sound?         partly  \u2014      N/A\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\nConsensus N/A on all six: outside voice disabled. [subagent-only]\nSingle-voice items promoted to taste decisions, none to critical.\n```\n\n#### NOT in scope (CEO)\n\n- Dark mode: separate plan (user-stated); token-only constraint keeps the door open.\n- Personalization/customization: separate plan (user-stated); single role makes a fixed layout acceptable for v1.\n- Cutting ActivityFeed: rejected; complete plan, P1.\n- Redirect-to-resume experiment: deferred to TODOS.md; touches login flow; TASTE T1.\n- Keyboard shortcuts for quick actions: deferred; shortcut audit needed.\n- Prefetch during login redirect: deferred; outside blast radius.\n- Ranked \"next up\" + real-time push: deferred; new infra.\n- ETag/short TTL cache: deferred until p95 data at 100%.\n- Token-only lint rule: deferred; review-checklist constraint now.\n\n#### What already exists (CEO)\n\nSee 0B table. Reused: middleware, request context, two repository list methods, bulk-read API, action registry, typed clients, dialog primitive, tokens, page shell, test stack, flags, metrics, analytics events. New: aggregate handler + envelope, dashboard page and panels, PanelFrame, MarkAllReadModal, shared Toast primitive, tests, instrumentation. **Unverified in this repo** (no source present): every \"existing\" item above.\n\n#### Error & Rescue Registry\n\nThe two tables in Section 2 (14 error paths, 0 GAPS).\n\n#### Failure Modes Registry\n\n```\n  CODEPATH                 | FAILURE MODE                  | RESCUED? | TEST? | USER SEES?            | LOGGED?\n  -------------------------|-------------------------------|----------|-------|-----------------------|--------\n  middleware               | no session                    | Y        | Y     | login page            | Y\n  middleware               | not a member                  | Y        | Y     | forbidden state       | Y\n  handler                  | one repo rejects              | Y        | Y     | panel error + Retry   | Y\n  handler                  | all repos reject              | Y        | Y     | 3 panel errors        | Y\n  handler                  | registry predicate throws     | Y        | Y     | actions error + Retry | Y\n  handler                  | envelope serialization bug    | Y        | Y     | page error + Retry    | Y\n  client hook              | schema mismatch               | Y        | Y     | error + Retry         | Y\n  client hook              | network                       | Y        | Y     | error + Retry         | Y (client)\n  client hook              | stale response after mutation | Y        | Y     | nothing (discarded)   | Y (debug)\n  mark-all-read            | CSRF stale                    | Y        | Y     | persistent toast      | Y\n  mark-all-read            | 5xx                           | Y        | Y     | persistent toast      | Y\n  mark-all-read            | double submit                 | Y        | Y     | nothing (prevented)   | n/a\n  toast                    | timer after unmount           | Y        | Y     | nothing (prevented)   | n/a\n  rollout                  | metric regression             | Y (flag) | Y (smoke) | previous landing  | Y (alert)\n```\nCRITICAL GAPS: 0.\n\n#### Decision Audit Trail (Phase 1)\n\n<!-- AUTONOMOUS DECISION LOG -->\n## Decision Audit Trail\n\n| # | Phase | Decision | Classification | Principle | Rationale | Rejected |\n|---|-------|----------|----------------|-----------|-----------|----------|\n| 1 | 0 | Skip /office-hours offer | Mechanical | P6 | One-gate rule; plan already has problem statement and metric | Run /office-hours |\n| 2 | 0 | Leave cross-project learnings config unset | Mechanical | \u2014 | User preference, no learnings exist this run | Enable/disable config |\n| 3 | CEO | Mode = SELECTIVE EXPANSION | Mechanical | override | Feature on existing system | other modes |\n| 4 | CEO | Approach C (aggregate + per-panel envelope) | **Taste T2** | P1, P5 | Only approach satisfying per-panel states in one round trip; B close | A, B |\n| 5 | CEO | Keep dashboard; defer redirect-to-resume experiment | **Taste T1** | P6, P1 | Redirect skips alerts; experiment touches login flow | Run experiment first |\n| 6 | CEO | Keep confirmation modal | **Taste T3** | P5 | No undo API; plan forbids new mutation API | Direct action + undo |\n| 7 | CEO | Build toast as shared UI primitive | **Taste T4** | P1, P4 | Live region required by a11y policy; shared beats one-off | Inline status text |\n| 8 | CEO | QuickActions is visual primary; column order fixed | Mechanical | P5 | Only panel that drives the metric | Three equal cards |\n| 9 | CEO | Reject cutting ActivityFeed | Mechanical | P1 | No scope reduction on a complete plan | Cut to two panels |\n| 10 | CEO | Accept baseline pull + find/do split from analytics | Mechanical | P2 | In blast radius, <1h, strengthens target | Keep walkthrough number |\n| 11 | CEO | Accept numeric rollback triggers | Mechanical | P1 | Rollout criteria were \"to be specified\" | Decide at rollout |\n| 12 | CEO | Accept relative timestamps, unread badge/title, back-to-previous link, action-pointing empty copy | Mechanical | P2 | Each in blast radius, <1h | Skip |\n| 13 | CEO | Defer keyboard shortcuts, prefetch, redirect arm, ranking/push, cache, lint rule | Mechanical | P3 | Outside blast radius or new infra | Add now |\n| 14 | CEO | PanelFrame shared state chrome | Mechanical | P4 | Avoid three copies of the state switch | Per-panel switches |\n| 15 | CEO | Sequence counter + refetch after mutation + ordered tests | Mechanical | P1 | Stale refetch race reverts optimistic clear | Ignore race |\n| 16 | CEO | Eligibility evaluated server-side, tested | Mechanical | P5 | Prevent ineligible action leak | Client-side filter |\n| 17 | CEO | Actor batch-load in activity repo | Mechanical | P1 | Avoid N+1 | Per-row lookup |\n| 18 | CEO | Metric/alert set as listed in Section 8 | Mechanical | P1 | 200-with-errors invisible to status alerts | HTTP-status alerts only |\n| 19 | CEO | Endpoint deploys first; route flag-gated | Mechanical | P5 | Old/new mismatch window | Single deploy |\n| 20 | CEO | Token-only styling constraint (checklist) | Mechanical | P2 | Keeps dark mode viable | Unconstrained |\n\n#### Completion Summary (CEO)\n\n```\n  +====================================================================+\n  |            MEGA PLAN REVIEW \u2014 COMPLETION SUMMARY                   |\n  +====================================================================+\n  | Mode selected        | SELECTIVE EXPANSION                          |\n  | System Audit         | repo has no source; all reuse claims unverified |\n  | Step 0               | 7 premises assessed, 0 clearly wrong; approach C |\n  | Section 1  (Arch)    | 2 issues found (both decided)               |\n  | Section 2  (Errors)  | 14 error paths mapped, 0 GAPS               |\n  | Section 3  (Security)| 1 issue found, 0 High severity open         |\n  | Section 4  (Data/UX) | 13 edge cases mapped, 0 unhandled           |\n  | Section 5  (Quality) | 1 issue found                               |\n  | Section 6  (Tests)   | Diagram produced, 1 gap (spec now written)  |\n  | Section 7  (Perf)    | 1 issue found                               |\n  | Section 8  (Observ)  | 1 gap found (instrumentation specified)     |\n  | Section 9  (Deploy)  | 1 risk flagged (triggers defined)           |\n  | Section 10 (Future)  | Reversibility: 4/5, debt items: 3           |\n  | Section 11 (Design)  | 1 issue (hierarchy fixed)                   |\n  +--------------------------------------------------------------------+\n  | NOT in scope         | written (9 items)                           |\n  | What already exists  | written                                     |\n  | Dream state delta    | written                                     |\n  | Error/rescue registry| 6 methods, 0 CRITICAL GAPS                  |\n  | Failure modes        | 14 total, 0 CRITICAL GAPS                   |\n  | TODOS.md updates     | 7 items proposed (deferred list)            |\n  | Scope proposals      | 8 proposed, 4 accepted (SEL)                |\n  | CEO plan             | written (ceo-plans/2026-09-10-user-dashboard.md) |\n  | Outside voice        | codex disabled; Claude subagent completed   |\n  | Lake Score           | 4/4 recommendations chose complete option   |\n  | Diagrams produced    | 6 (arch, data flow, 2 state machines, schedule, user flow) |\n  | Stale diagrams found | 0 (no diagrams exist in repo)               |\n  | Unresolved decisions | 0 (4 taste decisions queued for gate)       |\n  +====================================================================+\n```\n\n<!-- autoplan-accepted:ceo -->\n- Approach C: `GET /api/dashboard` runs the activity list, notifications list, and action-registry eligibility concurrently with `Promise.allSettled`, and returns `{ serverTime, activity, notifications, quickActions }` where each panel is `PanelResult<T> = { status: \"ok\", data: T[], cursor?: string } | { status: \"error\", code: \"retryable\" | \"registry\" | \"unknown\" }`. Return HTTP 200 whenever session and membership checks pass, even if all three panels are errors. Error `code` is an enum; never include exception messages. Test: integration tests for all-ok, one-rejects, all-reject, another-workspace (403), no-session (401); assert exactly 20 items per list.\n- Handler reads member and workspace IDs from the request context only; never from query or body. Eligibility predicates run server-side in the handler; ineligible actions are never returned. Test asserts zero ineligible actions in the response.\n- Activity repository batch-loads actor names in one query (no N+1). Test asserts query count.\n- Client `useDashboard` maps typed errors: unauthenticated \u2192 redirect to `/login?next=/dashboard`; forbidden \u2192 forbidden state; validation (schema mismatch) \u2192 error state and client error report; retryable \u2192 one automatic retry then error state with Retry; network \u2192 error state with Retry. A request sequence counter discards responses from requests started before the latest mutation or refetch. Refetch runs after a successful mark-all-read and on window focus. Test both completion orders of POST vs in-flight GET with controlled promise resolution.\n- Shared `PanelFrame` component renders loading skeleton (fixed heights, no layout shift, shimmer disabled under `prefers-reduced-motion`), empty state, error state with Retry, and children for ok. All three panels use it.\n- Layout hierarchy: QuickActions first (visual primary), NotificationsPanel second, ActivityFeed third. sm: single column in that order; md: actions full-width row above two columns; lg: three columns with actions widest. Touch targets \u2265 44px on sm. Only Tailwind tokens for color, spacing, and type in dashboard components; no raw values.\n- Empty-state copy: QuickActions \"Nothing to resume. Create an item or invite a teammate.\"; Notifications \"You're all caught up\"; Activity \"No changes yet\". Lists show the latest 20 with a \"View all\" link to the existing full page. ActivityFeed shows relative timestamps with absolute time on hover and focus. NotificationsPanel shows an unread count badge and mirrors it into `document.title` while unread > 0.\n- Mark all as read: modal composed from the existing dialog primitive; confirm posts to the existing bulk-read API with `serverTime` from the envelope as the snapshot and the CSRF token; confirm button disabled while submitting; Escape ignored while submitting; success \u2192 optimistic clear, refetch, success toast; CSRF/401/403 \u2192 persistent error toast \"Session expired. Refresh and try again.\" with modal kept open; retryable 5xx \u2192 one retry then persistent error toast \"Couldn't mark all as read. Try again.\"; network \u2192 same persistent toast. Focus returns to the trigger on close. E2E: notification created after `serverTime` remains unread after confirm.\n- Shared Toast primitive at `src/components/ui/Toast` with provider: `show({ kind: \"success\" | \"error\" | \"info\", message, persistent? })`; success/info use `role=\"status\"`, auto-dismiss after 5s, pause on hover and focus; errors use `role=\"alert\"` and persist until dismissed; maximum 3 stacked, oldest dropped; timers cleared on unmount; no slide animation under reduced motion. Unit tests for each rule with fake timers.\n- Security: activity and notification text render as text nodes only (never `dangerouslySetInnerHTML`); action routes come only from the server registry. Unit test asserts a `<script>` string renders escaped.\n- Instrumentation: structured handler logs with request id, member id, workspace id, per-panel status and duration; metrics `dashboard_request_duration_ms`, `dashboard_panel_error_total{panel,code}`, `dashboard_view_total`, `quick_action_click_total{action_id}`, `mark_all_read_total{result}`, `dashboard_back_link_click_total`; client error reporter receives validation and network errors with panel name. Alerts: panel error rate > 2% over 5m; p95 request duration > 800ms over 10m; mark-all-read error rate > 5% over 15m. Day-1 dashboard: request p50/p95, panel error rate by panel, cohort login-to-first-task median/p90 vs control, back-link click rate, completed-task rate, permission-error rate.\n- Rollout: feature flag `dashboard_landing` gates the post-login redirect and the `/dashboard` route; the endpoint is not flag-gated. Order: deploy dark \u2192 internal members \u2192 10% cohort for at least 3 days \u2192 50% \u2192 100% \u2192 remove back-link. Rollback is flag off. Rollback triggers: cohort completed-task rate down > 5% vs control; permission-error rate up > 2 points; p95 endpoint > 800ms for 10m; panel error rate > 2%; back-link click rate > 20% of cohort views. Smoke: synthetic login then `GET /api/dashboard` returns 200 with three ok panels.\n- Before locking the 45s target: pull real login-to-first-completed-task median and p90 from existing analytics and split login\u2192action-start (find) from action-start\u2192completion (do). Record both in the plan's Context section.\n- \"Back to the previous landing page\" link in the dashboard header while the flag is below 100%; clicks emit `dashboard_back_link_click_total`.\n- Tests: Vitest unit and integration per the Section 6 table; Playwright: flag on \u2192 `/dashboard` after login, flag off \u2192 previous landing, keyboard-only mark-all-read flow, focus return, axe scan with zero violations at sm/md/lg; perf assertion p95 handler < 300ms on 10k seeded rows.\n- Documentation: `shared/types/dashboard.ts` docblock carries the architecture diagram; README section for the `dashboard_landing` flag; short ADR for the PanelResult envelope pattern.\n<!-- /autoplan-accepted:ceo -->\n"
      },
      "messageId": "msg_011CeuXYEmvrSEJx8miwvE4G",
      "requestId": "req_011CeuXYCocRXsuD5UYiXLqh"
    },
    {
      "sessionId": "9b7779e9-18f9-4f8d-84ac-9e8bf4458a8e",
      "timestamp": "2026-09-10T09:36:51.425Z",
      "toolUseId": "toolu_01EMZc2Hum5xqWxGHi3dddtJ",
      "kind": "result",
      "isError": false
    },
    {
      "sessionId": "9b7779e9-18f9-4f8d-84ac-9e8bf4458a8e",
      "timestamp": "2026-09-10T09:37:17.410Z",
      "toolUseId": "toolu_01SePuStrHVH7BetMTo8VAig",
      "kind": "use",
      "name": "Write",
      "input": {
        "file_path": "/tmp/gstack-paid-shard-uaCq3n/tmp/gstack-hermetic-2101964-HvDZyN/skill-home-zgCNxG/.gstack/projects/gstack-autoplan-chain-RnwL2i/ceo-plans/2026-09-10-user-dashboard.md",
        "content": "---\nstatus: ACTIVE\n---\n# CEO Plan: User Dashboard Page\nGenerated by /plan-ceo-review (via /autoplan) on 2026-09-10\nBranch: main | Mode: SELECTIVE EXPANSION\nRepo: gstack-autoplan-chain-RnwL2i (no remote)\n\n## Vision\n\n### 10x Check\nA post-login home that tells the member what to do next instead of showing three things to scan. A ranked \"next up\" card sits above the panels, computed server-side from eligible actions and unread alerts, and updates live over a push channel. The member arrives, sees one thing, and does it. Effort: human ~3 weeks / CC ~1 day. Deferred: needs a ranking service and push infrastructure that do not exist. This plan lays the substrate (envelope, panel state machine, instrumentation) it would build on.\n\n## Scope Decisions\n\n| # | Proposal | Effort | Decision | Reasoning |\n|---|----------|--------|----------|-----------|\n| 1 | Pull real login-to-first-task baseline (median/p90) and find-vs-do split from existing analytics before locking 45s | S | ACCEPTED | Data already exists; walkthrough number is a stand-in |\n| 2 | Numeric rollback triggers defined before rollout | S | ACCEPTED | Rollout criteria were \"to be specified\" |\n| 3 | Relative timestamps with absolute on hover/focus in ActivityFeed | S | ACCEPTED | 1 file, under an hour, in blast radius |\n| 4 | Unread count badge and document.title mirror | S | ACCEPTED | 1 file, under an hour |\n| 5 | \"Back to previous landing page\" link during rollout | S | ACCEPTED | Per-member escape hatch and bounce-back signal |\n| 6 | Empty-state copy pointing at the primary action | S | ACCEPTED | Copy only |\n| 7 | Keyboard shortcuts for quick actions | S | DEFERRED | Shortcut conflict audit needed; not on the metric path |\n| 8 | Prefetch /api/dashboard during login redirect | S | DEFERRED | Touches login flow, outside blast radius |\n| 9 | Post-login redirect-to-resume experiment arm | M | DEFERRED (taste T1 at gate) | Skips alerts; separate flag arm; attribution matters |\n| 10 | Ranked \"next up\" card with live updates | XL | DEFERRED | New ranking + push infrastructure |\n| 11 | ETag / short TTL cache on the endpoint | S | DEFERRED | Wait for p95 at 100% rollout |\n| 12 | Token-only styling lint rule | S | DEFERRED | Review-checklist constraint now |\n\n## Accepted Scope (added to this plan)\n- Analytics baseline pull and find/do split before target lock\n- Numeric rollback triggers\n- Relative timestamps in ActivityFeed\n- Unread badge + title mirror\n- Back-to-previous-landing link during rollout\n- Action-pointing empty-state copy\n- Approach C: aggregate endpoint with per-panel `PanelResult` envelope and `serverTime`\n- Shared `PanelFrame` and shared `Toast` primitive\n- QuickActions as visual primary; fixed column order at sm/md/lg\n\n## Deferred to TODOS.md\n- Keyboard shortcuts for quick actions (audit conflicts first)\n- Prefetch dashboard payload during login redirect\n- Redirect-to-resume experiment arm under the same flag framework (taste decision T1)\n- Ranked \"next up\" card + real-time push\n- Endpoint caching once p95 data exists\n- Token-only styling lint enforcement\n\n## Taste decisions surfaced at the /autoplan gate\n- T1: keep dashboard as the sole arm vs. run a redirect-to-resume experiment arm concurrently\n- T2: aggregate endpoint with envelope (C) vs. client composition of existing endpoints (B)\n- T3: keep confirmation modal vs. direct action with undo (would need a new mutation API)\n- T4: shared toast primitive vs. inline status text\n"
      },
      "messageId": "msg_011CeuXtM6jr7UmCW4ACpkFj",
      "requestId": "req_011CeuXtK3xqXgAGXD4r9pic"
    },
    {
      "sessionId": "9b7779e9-18f9-4f8d-84ac-9e8bf4458a8e",
      "timestamp": "2026-09-10T09:37:19.272Z",
      "toolUseId": "toolu_01SePuStrHVH7BetMTo8VAig",
      "kind": "result",
      "isError": false
    },
    {
      "sessionId": "9b7779e9-18f9-4f8d-84ac-9e8bf4458a8e",
      "timestamp": "2026-09-10T09:39:40.070Z",
      "toolUseId": "toolu_015XKfdk4d1H8xZ8uVSKe1to",
      "kind": "use",
      "name": "Write",
      "input": {
        "file_path": "/tmp/gstack-paid-shard-uaCq3n/tmp/gstack-hermetic-2101964-HvDZyN/skill-home-zgCNxG/.gstack/projects/gstack-autoplan-chain-RnwL2i/ceo-plans/2026-09-10-user-dashboard.md",
        "content": "---\nstatus: ACTIVE\n---\n# CEO Plan: User Dashboard Page\nGenerated by /plan-ceo-review (via /autoplan) on 2026-09-10\nBranch: main | Mode: SELECTIVE EXPANSION (hold the plan's scope as baseline; cherry-pick expansions individually)\nRepo: gstack-autoplan-chain-RnwL2i (no remote)\nSource plan: `.claude/plans/ui-heavy-feature.md` (reviewed copy with full review record: `.claude/plans/starry-riding-otter.md`)\n\n**Primary metric:** median login-to-first-completed-task \u2264 45s (provisional until the baseline in #1 is pulled). Guardrails: completed-task rate and permission-error rate must not regress.\n\n**Glossary.** *Blast radius*: the files this plan creates or modifies plus their direct importers. *Find vs. do*: time from login to starting an action, versus time from starting to completing it. *CC*: Claude Code implementation time, as opposed to human-team time.\n\n**Assumptions.** The feature-flag framework, request/error metrics, and analytics events named in the source plan exist (this repository contains no source, so they are unverified). Item #1 (baseline pull) precedes item #2 (numeric rollback triggers), because the triggers are expressed against the baseline.\n\n## Vision\n\n### 10x Check\nA post-login home that tells the member what to do next instead of showing three things to scan. A ranked \"next up\" card sits above the panels, computed server-side from eligible actions and unread alerts, and updates live over a push channel. The member arrives, sees one thing, and does it. Effort: human ~3 weeks / CC ~1 day. Deferred: needs a ranking service and push infrastructure that do not exist. This plan lays the substrate it would build on: the per-panel result envelope, the per-panel state machine (loading \u2192 ok / empty / error \u2192 retry), and the instrumentation; all three are in Accepted Scope below.\n\n## Scope Decisions\n\n| # | Proposal | Effort | Decision | Reasoning | Revisit when |\n|---|----------|--------|----------|-----------|--------------|\n| 1 | Pull real login-to-first-task baseline (median/p90) and find-vs-do split from existing analytics before locking 45s | S | ACCEPTED | Data already exists; the 75s walkthrough number is a stand-in | \u2014 |\n| 2 | Numeric rollback triggers defined before rollout | S | ACCEPTED | Rollout criteria were \"to be specified\"; depends on #1 | \u2014 |\n| 3 | Relative timestamps with absolute on hover/focus in ActivityFeed | S | ACCEPTED | 1 file, under an hour, in blast radius | \u2014 |\n| 4 | Unread count badge and document.title mirror | S | ACCEPTED | 1 file, under an hour | \u2014 |\n| 5 | \"Back to previous landing page\" link during rollout | S | ACCEPTED | Per-member escape hatch and bounce-back signal | Remove at 100% rollout |\n| 6 | Empty-state copy pointing at the primary action | S | ACCEPTED | Copy only | \u2014 |\n| 7 | Keyboard shortcuts for quick actions | S | DEFERRED | Shortcut conflict audit needed; not on the metric path | Dashboard owner runs the conflict audit after 100% rollout |\n| 8 | Prefetch /api/dashboard during login redirect | S | DEFERRED | Touches login flow, outside blast radius | If client TTFB p95 > 800ms at 100% |\n| 9 | Post-login redirect-to-resume experiment arm | M | DEFERRED, provisional (taste T1) | Skips alerts the plan says members need; touches login flow; attribution needs its own arm | Final Approval Gate may flip to \"run concurrently\" |\n| 10 | Ranked \"next up\" card with live updates | XL | DEFERRED | New ranking + push infrastructure | After dashboard metric data at 100% |\n| 11 | ETag / short TTL cache on the endpoint | S | DEFERRED | Wait for p95 at 100% rollout | Dashboard owner checks endpoint p95 one week after 100% |\n| 12 | Token-only styling: PR review checklist item now, lint rule later | S | ACCEPTED (checklist) / DEFERRED (lint) | Keeps dark mode viable; lint needs design-system owner | Design-system owner adds lint rule |\n| 13 | Approach C: aggregate `GET /api/dashboard` with per-panel `PanelResult` envelope and `serverTime` | M | ACCEPTED, provisional (taste T2) | Only approach that gives per-panel error states in one round trip and a server clock for the read snapshot | Gate may choose B (client composes existing endpoints) |\n| 14 | Shared `PanelFrame` (state chrome) and shared `Toast` primitive | S | ACCEPTED, provisional (taste T4) | Three panels share one state switch; a11y policy requires a live region and no toast exists; shared placement is the same code in a reusable folder | Gate may choose inline status text over toast |\n| 15 | QuickActions as visual primary; fixed column order at sm/md/lg | S | ACCEPTED | Only panel that drives the metric; three equal cards is the generic pattern | \u2014 |\n| 16 | Keep confirmation modal for \"Mark all as read\" | S | ACCEPTED, provisional (taste T3) | No undo/restore API exists and the plan forbids new mutation APIs; confirm is the honest safety net | Gate may choose direct action + undo (needs a new mutation API, breaks a plan constraint) |\n\n## Accepted Scope (added to this plan)\n- Analytics baseline pull and find/do split before target lock (#1)\n- Numeric rollback triggers (#2)\n- Relative timestamps in ActivityFeed (#3)\n- Unread badge + title mirror (#4)\n- Back-to-previous-landing link during rollout (#5)\n- Action-pointing empty-state copy (#6)\n- Token-only styling as a PR review checklist item (#12)\n- Approach C: aggregate endpoint with per-panel `PanelResult` envelope and `serverTime` (#13)\n- Shared `PanelFrame` and shared `Toast` primitive (#14)\n- QuickActions as visual primary; fixed column order at sm/md/lg (#15)\n- Confirmation modal on the existing dialog primitive (#16)\n- Per-panel state machine and instrumentation (metrics, alerts, structured logs) as specified in the source plan's accepted CEO obligations\n\n## Deferred to TODOS.md\n- Keyboard shortcuts for quick actions (#7)\n- Prefetch dashboard payload during login redirect (#8)\n- Redirect-to-resume experiment arm under the same flag framework (#9, taste T1)\n- Ranked \"next up\" card + real-time push (#10)\n- Endpoint caching once p95 data exists (#11)\n- Token-only styling lint enforcement (#12)\n\n## Taste decisions (provisional; confirmed or overridden at the /autoplan Final Approval Gate)\n- T1: **Provisional decision: dashboard is the sole arm; experiment deferred (#9).** Alternative: run a redirect-to-resume arm concurrently.\n- T2: **Provisional decision: Approach C (#13).** Alternative: B, client composition of existing endpoints plus a new quick-actions endpoint.\n- T3: **Provisional decision: keep the confirmation modal (#16).** Alternative: direct action with undo, which needs a new mutation API.\n- T4: **Provisional decision: shared toast primitive (#14).** Alternative: inline status text per panel.\n"
      },
      "messageId": "msg_011CeuY3xtntQ4z7XESaBmS7",
      "requestId": "req_011CeuY3vfLs9WfLbPDaQsYb"
    },
    {
      "sessionId": "9b7779e9-18f9-4f8d-84ac-9e8bf4458a8e",
      "timestamp": "2026-09-10T09:39:41.652Z",
      "toolUseId": "toolu_015XKfdk4d1H8xZ8uVSKe1to",
      "kind": "result",
      "isError": false
    },
    {
      "sessionId": "9b7779e9-18f9-4f8d-84ac-9e8bf4458a8e",
      "timestamp": "2026-09-10T09:41:37.413Z",
      "toolUseId": "toolu_01BbKwZ7JFFdm2FLFdcNQXPq",
      "kind": "use",
      "name": "Edit",
      "input": {
        "replace_all": false,
        "file_path": "/tmp/gstack-paid-shard-uaCq3n/tmp/gstack-hermetic-2101964-HvDZyN/skill-home-zgCNxG/.gstack/projects/gstack-autoplan-chain-RnwL2i/ceo-plans/2026-09-10-user-dashboard.md",
        "old_string": "**Glossary.** *Blast radius*: the files this plan creates or modifies plus their direct importers. *Find vs. do*: time from login to starting an action, versus time from starting to completing it. *CC*: Claude Code implementation time, as opposed to human-team time.\n\n**Assumptions.** The feature-flag framework, request/error metrics, and analytics events named in the source plan exist (this repository contains no source, so they are unverified). Item #1 (baseline pull) precedes item #2 (numeric rollback triggers), because the triggers are expressed against the baseline.",
        "new_string": "**Glossary.** *Blast radius*: the files this plan creates or modifies plus their direct importers. *Find vs. do*: time from login to starting an action, versus time from starting to completing it. *CC*: Claude Code implementation time, as opposed to human-team time. *Effort scale* (human team): S under 1 day, M 1 to 5 days, L 1 to 3 weeks, XL over 3 weeks. *Previous landing page*: the post-login destination in use before this plan (the existing default route members see today; name it in the flag config when implementing).\n\n**Acceptance principle.** In SELECTIVE EXPANSION, an expansion inside the blast radius that costs under an hour is accepted on cost alone, whether or not it moves the metric (#3, #4, #6). Items outside the blast radius, or that need an audit or new infrastructure, are deferred even when cheap (#7, #8).\n\n**Assumptions.** The feature-flag framework, request/error metrics, and analytics events named in the source plan exist (this repository contains no source, so they are unverified). Item #1 (baseline pull) precedes item #2 (numeric rollback triggers), because the triggers are expressed against the baseline. **Fallback if the analytics events do not exist:** instrument login, action start, and action completion first, collect at least 7 days of data before any cohort rollout, and keep the 75s walkthrough figure as the stand-in with the target widened to \"at least 30% faster than measured baseline\" until the pull succeeds.\n\n**Carried from the source plan (not additions):** the per-panel state machine (loading \u2192 ok / empty / error \u2192 retry) and the instrumentation set (metrics, alerts, structured logs) are already required by the source plan's accepted CEO obligations; this document ratifies them without a proposal row."
      },
      "messageId": "msg_011CeuYDnRH9L1Qoom8gBVdc",
      "requestId": "req_011CeuYDk9cAd6Yozh8QnH62"
    },
    {
      "sessionId": "9b7779e9-18f9-4f8d-84ac-9e8bf4458a8e",
      "timestamp": "2026-09-10T09:41:38.993Z",
      "toolUseId": "toolu_01BbKwZ7JFFdm2FLFdcNQXPq",
      "kind": "result",
      "isError": false
    },
    {
      "sessionId": "9b7779e9-18f9-4f8d-84ac-9e8bf4458a8e",
      "timestamp": "2026-09-10T09:41:40.421Z",
      "toolUseId": "toolu_01W9d5F6LgadaG9o9maU8kaT",
      "kind": "use",
      "name": "Edit",
      "input": {
        "replace_all": false,
        "file_path": "/tmp/gstack-paid-shard-uaCq3n/tmp/gstack-hermetic-2101964-HvDZyN/skill-home-zgCNxG/.gstack/projects/gstack-autoplan-chain-RnwL2i/ceo-plans/2026-09-10-user-dashboard.md",
        "old_string": "The member arrives, sees one thing, and does it. Effort: human ~3 weeks / CC ~1 day. Deferred: needs a ranking service and push infrastructure that do not exist.",
        "new_string": "The member arrives, sees one thing, and does it. Effort: XL, infrastructure-bound rather than implementation-bound (ranking service and push channel must exist first; no CC figure given). Deferred: needs a ranking service and push infrastructure that do not exist."
      },
      "messageId": "msg_011CeuYDnRH9L1Qoom8gBVdc",
      "requestId": "req_011CeuYDk9cAd6Yozh8QnH62"
    },
    {
      "sessionId": "9b7779e9-18f9-4f8d-84ac-9e8bf4458a8e",
      "timestamp": "2026-09-10T09:41:43.424Z",
      "toolUseId": "toolu_01YXZEmM6gthBvGshzGE4zYb",
      "kind": "use",
      "name": "Edit",
      "input": {
        "replace_all": false,
        "file_path": "/tmp/gstack-paid-shard-uaCq3n/tmp/gstack-hermetic-2101964-HvDZyN/skill-home-zgCNxG/.gstack/projects/gstack-autoplan-chain-RnwL2i/ceo-plans/2026-09-10-user-dashboard.md",
        "old_string": "| 1 | Pull real login-to-first-task baseline (median/p90) and find-vs-do split from existing analytics before locking 45s | S | ACCEPTED | Data already exists; the 75s walkthrough number is a stand-in | \u2014 |",
        "new_string": "| 1 | Pull real login-to-first-task baseline (median/p90) and find-vs-do split from existing analytics before locking 45s | S | ACCEPTED | Data already exists; the 75s walkthrough number is a stand-in | Dashboard owner re-locks the target in this document after the pull |"
      },
      "messageId": "msg_011CeuYDnRH9L1Qoom8gBVdc",
      "requestId": "req_011CeuYDk9cAd6Yozh8QnH62"
    },
    {
      "sessionId": "9b7779e9-18f9-4f8d-84ac-9e8bf4458a8e",
      "timestamp": "2026-09-10T09:41:47.171Z",
      "toolUseId": "toolu_01SYiANcdq3hLqGxEhDQVNJf",
      "kind": "use",
      "name": "Edit",
      "input": {
        "replace_all": false,
        "file_path": "/tmp/gstack-paid-shard-uaCq3n/tmp/gstack-hermetic-2101964-HvDZyN/skill-home-zgCNxG/.gstack/projects/gstack-autoplan-chain-RnwL2i/ceo-plans/2026-09-10-user-dashboard.md",
        "old_string": "| 3 | Relative timestamps with absolute on hover/focus in ActivityFeed | S | ACCEPTED | 1 file, under an hour, in blast radius | \u2014 |\n| 4 | Unread count badge and document.title mirror | S | ACCEPTED | 1 file, under an hour | \u2014 |",
        "new_string": "| 3 | Relative timestamps with absolute on hover/focus in ActivityFeed | S | ACCEPTED | 1 file, under an hour, in blast radius (cost-alone acceptance) | \u2014 |\n| 4 | Unread count badge and document.title mirror | S | ACCEPTED | 1 file, under an hour, in blast radius; also shortens the \"find\" half of find-vs-do | \u2014 |"
      },
      "messageId": "msg_011CeuYDnRH9L1Qoom8gBVdc",
      "requestId": "req_011CeuYDk9cAd6Yozh8QnH62"
    },
    {
      "sessionId": "9b7779e9-18f9-4f8d-84ac-9e8bf4458a8e",
      "timestamp": "2026-09-10T09:41:57.679Z",
      "toolUseId": "toolu_01LgaibBToDfuxGNFBKew9PS",
      "kind": "use",
      "name": "Edit",
      "input": {
        "replace_all": false,
        "file_path": "/tmp/gstack-paid-shard-uaCq3n/tmp/gstack-hermetic-2101964-HvDZyN/skill-home-zgCNxG/.gstack/projects/gstack-autoplan-chain-RnwL2i/ceo-plans/2026-09-10-user-dashboard.md",
        "old_string": "| 12 | Token-only styling: PR review checklist item now, lint rule later | S | ACCEPTED (checklist) / DEFERRED (lint) | Keeps dark mode viable; lint needs design-system owner | Design-system owner adds lint rule |\n| 13 | Approach C: aggregate `GET /api/dashboard` with per-panel `PanelResult` envelope and `serverTime` | M | ACCEPTED, provisional (taste T2) | Only approach that gives per-panel error states in one round trip and a server clock for the read snapshot | Gate may choose B (client composes existing endpoints) |\n| 14 | Shared `PanelFrame` (state chrome) and shared `Toast` primitive | S | ACCEPTED, provisional (taste T4) | Three panels share one state switch; a11y policy requires a live region and no toast exists; shared placement is the same code in a reusable folder | Gate may choose inline status text over toast |\n| 15 | QuickActions as visual primary; fixed column order at sm/md/lg | S | ACCEPTED | Only panel that drives the metric; three equal cards is the generic pattern | \u2014 |",
        "new_string": "| 12 | Token-only styling: PR review checklist item now, lint rule later | S | ACCEPTED (checklist) / DEFERRED (lint) | Keeps dark mode viable; lint needs design-system owner | Design-system owner adds the lint rule before the dark-mode plan starts, or when a second token-only consumer appears, whichever is first |\n| 13 | Approach C: aggregate `GET /api/dashboard` with per-panel `PanelResult` envelope and `serverTime` | M | ACCEPTED, provisional (taste T2) | Only approach that gives per-panel error states in one round trip and a server clock for the read snapshot. Cost: the endpoint owns per-panel timeout budgets and a partial-success contract (HTTP 200 with per-panel error codes), which is the main reason B could win at the Gate | Gate may choose B (client composes existing endpoints) |\n| 14 | Shared `PanelFrame` (state chrome) and shared `Toast` primitive | S | ACCEPTED, provisional (taste T4) | The three panels would otherwise duplicate identical loading/empty/error chrome; extracting it is the same code in one place. A11y policy requires a live region for nonblocking feedback and no toast exists | Gate may choose inline status text over toast |\n| 15 | QuickActions as visual primary; fixed panel order | S | ACCEPTED | Only panel that drives the metric; three equal cards is the generic pattern. Order: QuickActions, NotificationsPanel, ActivityFeed, left to right at lg; at md QuickActions spans the top row above Notifications and Activity; at sm the same order stacked | \u2014 |"
      },
      "messageId": "msg_011CeuYDnRH9L1Qoom8gBVdc",
      "requestId": "req_011CeuYDk9cAd6Yozh8QnH62"
    },
    {
      "sessionId": "9b7779e9-18f9-4f8d-84ac-9e8bf4458a8e",
      "timestamp": "2026-09-10T09:42:00.503Z",
      "toolUseId": "toolu_01VqJFXfD5cfdjiar1gAjpkV",
      "kind": "use",
      "name": "Edit",
      "input": {
        "replace_all": false,
        "file_path": "/tmp/gstack-paid-shard-uaCq3n/tmp/gstack-hermetic-2101964-HvDZyN/skill-home-zgCNxG/.gstack/projects/gstack-autoplan-chain-RnwL2i/ceo-plans/2026-09-10-user-dashboard.md",
        "old_string": "- Confirmation modal on the existing dialog primitive (#16)\n- Per-panel state machine and instrumentation (metrics, alerts, structured logs) as specified in the source plan's accepted CEO obligations",
        "new_string": "- Confirmation modal on the existing dialog primitive (#16)"
      },
      "messageId": "msg_011CeuYDnRH9L1Qoom8gBVdc",
      "requestId": "req_011CeuYDk9cAd6Yozh8QnH62"
    },
    {
      "sessionId": "9b7779e9-18f9-4f8d-84ac-9e8bf4458a8e",
      "timestamp": "2026-09-10T09:42:01.075Z",
      "toolUseId": "toolu_01W9d5F6LgadaG9o9maU8kaT",
      "kind": "result",
      "isError": false
    }
  ]
}