{
  "source": "04880a342078b697004a2fafac8f43322c684b5f",
  "sessionId": "2f126b37-2a1d-42c0-804e-71be1fbf77ff",
  "publicExport": ".context/sep12-ship-pooled-validation-draft/autoplan-timeout-public.json",
  "publicExportSha256": "c370bb6300c917e43cd9c2a700b51100b8ae0c27b9838eda8990fab58a89eb73",
  "originalOutcome": {
    "outcome": "timeout",
    "elapsedMs": 908495.87,
    "phases": []
  },
  "frame": {
    "source": "last-sampled-current-screen",
    "text": "  171 +|---|---|---|---|---|---|                                                                                       \n  172 +| A1 / 0D | Where toggle state lives. Evidence: `src/main.tsx:5-16` App owns all state; `src/pages/Workspace.tsx\n      +` is the only extracted component | no toggle | A: `useState` in `App`; B: extract `SignInForm`; C: `PasswordFie\n      +ld` component | auto-decided C (TASTE) | /autoplan P5+P3; overridable at Final Gate |                           \n  173 +| A2 / 0B | Button placement vs `<label>`. Evidence: `tests/sign-in.test.ts:71,85,101` use `getByLabel('Password\n      +',{exact:true})`; accname includes label descendants | implicit label wraps input | button as sibling; `id`/`htm\n      +lFor` | accepted | Mechanical correctness (P1) |                                                                \n  174 +| A3 / 0D | Button semantics | none | `type=\"button\"`, text is state, `aria-controls`, no `aria-pressed` | accep\n      +ted | Mechanical (P5) |                                                                                         \n  175 +| E1 / 0G | Inline 401 error keeps form mounted. Evidence: `src/main.tsx:14`, test `:98` | 401 → generic error, \n      +form unmounts | inline message, form stays | PENDING GATE | plan excludes login errors; user-visible |          \n  176 +| E2 / 0G | Caps Lock hint | none | hint on `getModifierState('CapsLock')` | PENDING GATE | user-visible |      \n  177 +| E3 / 0G | Re-mask on submit. Evidence: GOV.UK pattern; bfcache/back-nav can restore a `type=text` field with t\n      +he value | stays visible through submit | set `visible=false` in `onSubmit` before fetch | PENDING GATE | securi\n      +ty remedy; user-visible |                                                                                       \n  178 +| E4 / 0G | Live-region announcement | none | visually hidden `aria-live=polite` | PENDING GATE | accessibility \n      +enhancement; SR-perceivable |                                                                                   \n  179 +| E5 / 0G | Edge native reveal | Edge shows its own eye button | `::-ms-reveal{display:none}` | accepted | Mecha\n      +nical correctness (two toggles, two states) |                                                                   \n  180 +| E6 / 0G | Caret after type switch | n/a | preserve selection, keep focus on button | accepted | Mechanical cor\n      +rectness (P1) |                                                                                                 \n  181 +| V1-V7 / 0D | Tests for the accepted behaviour | baseline test asserts no control | see Verification amendments\n      + | accepted | verification choices open to /autoplan |                                                          \n  182 +| X1 / 0D | Checkbox instead of button | n/a | `<input type=checkbox>` \"Show password\" | rejected | conflicts wi\n      +th plan's specified UI |                                                                                        \n  183 +| X2..X5 / scope | Remember visibility, strength meter, password reset, form redesign | excluded by plan | n/a |\n      + NOT in scope | user's stated direction |                                                                       \n  184 +                                                                                                                \n  185 +### 0A. Premise Challenge                                                                                       \n  186 +1. **Right problem?** Yes. Masked-field typos are a real, measured sign-in failure cause and                    \n  187 +   the reveal pattern is the standard remedy. A different framing (fix the 401 path so a                        \n  188 +   typo does not destroy the form) would arguably remove more pain, but the user excluded                       \n  189 +   it; it is recorded as E1 for the gate, not as a rejection of this premise.                                   \n  190 +2. **Outcome:** fewer failed sign-ins and less re-typing; the plan reaches it directly, no                      \n  191 +   proxy metric.                                                                                                \n  192 +3. **Do nothing:** a mistyped password in this app means a 401, a generic error and a page                      \n  193 +   reload. The pain is real, not hypothetical. Premises accepted (P6). No clearly-wrong                         \n  194 +   premise queued.                                                                                              \n  195 +                                                                                                                \n  196 +### 0B. Existing Code Leverage                                                                                  \n  197 +| Sub-problem | Existing code | Reused? |                                                                       \n  198 +|---|---|---|                                                                                                   \n  199 +| Form, password input, autocomplete | `src/main.tsx:15` | yes, edited in place |                               \n  200 +| Local UI state | `useState` already imported in `src/main.tsx:1` | yes |                                      \n  201 +| Text-button styling and focus ring | `src/pages/Workspace.tsx:4` classes | yes |                              \n  202 +| Browser test harness, route doubles, page-error capture | `tests/sign-in.test.ts` `withSignIn` | yes; baseline\n      + assertion at `:76` replaced |                                                                                  \n  203 +| CSS pipeline | `bun run css`, `tailwind.config.cjs` content globs | yes; one rule added to `src/styles.css` (E\n      +5) |                                                                                                            \n  204 +Nothing is rebuilt. No helper exists for reveal toggles; the runtime (`type` attribute)                         \n  205 +provides the mechanism, so no dependency is added.                                                              \n  206 +                                                                                                                \n  207 +### 0C. Dream State Mapping                                                                                     \n  208 +```                                                                                                             \n  209 +  CURRENT STATE                     THIS PLAN                        12-MONTH IDEAL                             \n  210 +  Masked field, no reveal;  --->    Reveal toggle, a11y-correct,  --->  Sign-in that never strands a user:      \n  211 +  wrong password unmounts           tested in the real bundle,           inline errors, reveal, caps-lock       \n  212 +  the form into a generic           Edge-safe, caret-safe                hint, reset flow, passkeys;            \n  213 +  error                                                                  PasswordField reused by reset/sign-up  \n  214 +```                                                                                                             \n  215 +The plan moves toward the ideal. Choosing C (component) leaves a reusable piece for the                         \n  216 +reset and sign-up forms the README implies are coming.                                                          \n  217 +                                                                                                                \n  218 +### 0D. Alternatives (row A1)                                                                                   \n  219 +| | A: state in `App` | B: extract `SignInForm` | C: `PasswordField` component (chosen) |                       \n  220 +|---|---|---|---|                                                                                               \n  221 +| Summary | add `useState` to `App`, toggle inline | move form + submit handler to a new component | new ~25-lin\n      +e component owning label, input, button, state |                                                                \n  222 +| Effort | S (human ~1h / CC ~5min) | M (human ~3h / CC ~15min) | S (human ~1.5h / CC ~10min) |                 \n  223 +| Risk | low | low-medium (moves the submit handler, needs an `onError` prop) | low |                           \n  224 +| Pros | smallest diff | matches `pages/` pattern; untangles the one-line App | state co-located with the field;\n      + reusable; `App` untouched except one tag |                                                                     \n  225 +| Cons | form-local state at app level; `App` line grows | refactor beyond the feature; bigger diff to review | \n      +one more component for a single use today |                                                                     \n  226 +| Reuse / verification | same tests | same tests | same tests |                                                 \n  227 +Completeness: all three cover every listed edge case equally; they differ in kind.                              \n  228 +Decision: C (P5 explicit, P3 pragmatic). B is close; marked TASTE for the gate. A rejected                      \n  229 +(mis-scoped state). X1 (checkbox) rejected: changes the specified UI.                                           \n  230 +                                                                                                                \n  231 +### 0E. Mode Selection                                                                                          \n  232 +Mode: SELECTIVE EXPANSION, selected by the plan text (\"Complete SELECTIVE EXPANSION                             \n  233 +exploration\"). Approved decisions before Step 0: none. No user preference lookup                                \n  234 +(QUESTION_TUNING false). Planned change footprint: `src/main.tsx`, `src/styles.css`,                            \n  235 +`tests/sign-in.test.ts`, `README.md` (baseline note) → 4 files, under the 8-file smell.                         \n  236 +                                                                                                                \n  237 +### 0F/0G. HOLD checks and cherry-pick ceremony                                                                 \n  238 +- Complexity check: 4 files, 1 new component, 0 services. OK.                                                   \n  239 +- Minimum set: `src/main.tsx` + `tests/sign-in.test.ts`. Nothing in the plan can be                             \n  240 +  deferred without losing a stated requirement, so no defer/keep questions were needed.                         \n  241 +- 10x version (recorded, not adopted): a \"never strand the user\" sign-in: reveal + inline                       \n  242 +  401 error + caps-lock hint + reset link + passkey option. Platform potential: a                               \n  243 +  `PasswordField` shared by sign-in, reset and sign-up.                                                         \n  244 +- Delight scan (each ≤30 min CC) and dispositions, following the plan's rule that                               \n  245 +  user-visible behaviours are proposals pending the gate:                                                       \n  246 +                                                                                                                \n  247 +| # | Proposal (user experience first) | Effort | Risk | Disposition |                                          \n  248 +|---|---|---|---|---|                                                                                           \n  249 +| E1 | Mistype your password and see \"Wrong email or password\" under the field instead of losing the form | S (h\n      +uman ~2h / CC ~10min) | low | PENDING GATE (plan excludes login errors) |                                       \n  250 +| E2 | See \"Caps Lock is on\" before you submit | S (human ~1h / CC ~5min) | low | PENDING GATE |                \n  251 +| E3 | Password re-masks the moment you submit, so back-navigation or bfcache never shows it in plain text | S (\n      +human ~30min / CC ~3min) | low | PENDING GATE (security remedy, evidence: GOV.UK pattern) |                     \n  252 +| E4 | Screen-reader users hear \"Password shown\" / \"Password hidden\" | S (human ~30min / CC ~3min) | low | PENDI\n      +NG GATE (accessibility enhancement) |                                                                           \n  253 +| E5 | Edge users see one reveal control, not two fighting each other | S (CC ~1min) | none | ACCEPTED (correctn\n      +ess) |                                                                                                          \n  254 +| E6 | Your cursor stays where it was after toggling | S (CC ~3min) | low | ACCEPTED (correctness) |            \n  255 +| X1 | Checkbox \"Show password\" instead of a button | S | low | REJECTED (conflicts with specified UI) |        \n  256 +| X2-X5 | Remember visibility; strength meter; reset; redesign | — | — | NOT IN SCOPE (plan) |                  \n  257 +                                                                                                                \n  258 +Scope counts: 8 proposals (E1-E6, X1, and the X2-X5 group counted once as excluded),                            \n  259 +2 accepted (E5, E6), 4 pending gate (E1-E4), 1 rejected (X1), 1 excluded by the plan.                           \n  260 +Nothing deferred to TODOS.md yet; gate outcomes for E1-E4 decide that.                                          \n╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌\n Do you want to overwrite autoplan-password-visibility.md?\n ❯ 1. Yes                                                                       \n   2. Yes, and allow Claude to edit its own settings for this session\n   3. No\n\n Esc to cancel · Tab to amend",
    "codeUnits": 13930,
    "truncated": false,
    "sha256": "59ac7fd1e70f8743444e3dd385da9cd55325837f0f5b0a960f82e36a49a439bb",
    "rawEnd": 256316,
    "observedAtMs": 899725,
    "questionSince": 1802,
    "viewportInputSince": 86223
  },
  "pendingRequest": {
    "requestId": "bdedd109-1494-4874-a20f-8c668e3bb068",
    "nativeToolId": null,
    "name": "Write",
    "cwd": "/tmp/gstack-paid-shard-Rv33F1/tmp/gstack-autoplan-chain-eruYyB",
    "input": {
      "content": "<!-- /autoplan restore point: /tmp/gstack-paid-shard-Rv33F1/tmp/gstack-autoplan-chain-eruYyB/.gstack/projects/gstack-autoplan-chain-eruYyB/main-autoplan-restore-20260912-074703.md -->\n# Plan: show or hide the sign-in password\n\n## User goal\nLet a person inspect the password they have typed before signing in, then hide it\nagain. Add a visibility control beside the existing password field.\n\n## Existing behavior\nThe sign-in form is in `src/main.tsx`. Its password input uses `type=\"password\"`,\n`name=\"password\"`, and `autoComplete=\"current-password\"`. Submitting posts email\nand password to `/api/login`; successful login navigates to `/workspace`.\nCredential checking and session creation live in `src/server.ts` and `src/auth.ts`.\n\n## Proposed UI\nStart hidden. A text button changes between “Show password” and “Hide password”\nand switches visibility without submitting the form, changing the value, or\nreplacing the input. Keep the existing autocomplete behavior. The control needs\na clear accessible name, keyboard operation, visible focus, and a layout that\nfits the existing narrow sign-in form on mobile. Visibility is local to the\nmounted form; do not store or log the password or visibility preference.\n\n## Verification to plan\nCover show → hide, unchanged submitted value, normal Enter-to-submit behavior,\nkeyboard focus, and a fresh form returning to hidden. Include a browser check\nthat typing and password-manager autofill still work with the visibility control.\n\n## Scope\nThis proposal does not add an endpoint or change credential validation, session\ncookies, login errors, or the post-login destination. Password reset, strength\nmeters, remembering visibility, and a form redesign are separate product work.\n\nFor this review, product scope is fixed to the show/hide feature above. Keep extra\nuser-visible behaviors as proposals pending the final user gate; do not\nauto-accept them. Ordinary implementation and verification choices remain open\nto /autoplan's normal process. Complete SELECTIVE EXPANSION exploration and all\nrequired phases, outside voices and spec reviews. Address the correctness,\naccessibility and security needed for this feature. If a necessary remedy would\nexpand product scope, retain its evidence and unresolved blocker for the final\ngate rather than assuming approval.\n\nThe control is not implemented; the proposal remains subject to the full review.\n\n## Amendments accepted during /autoplan (implementation and verification choices only)\n\nProduct scope above is unchanged. Each item below traces to a ledger row in the\nreview record; items marked PENDING GATE are proposals, not accepted scope.\n\n### Implementation (accepted)\n- **A1 (TASTE, auto-decided C, overridable at gate):** implement the field as a small\n  `PasswordField` component inside `src/main.tsx` that owns `const [visible, setVisible] = useState(false)`\n  and renders the label, the input and the toggle button. State dies with the form, so\n  \"a fresh form starts hidden\" holds by construction. Alternatives B (extract a whole\n  `SignInForm` page component) and A (state in `App`) are recorded in ledger row A1.\n- **A2 (accepted, correctness):** the toggle button is a sibling of the `<label>`, never a\n  descendant. Give the input `id=\"password\"` and switch the label to `htmlFor=\"password\"`.\n  Reason: a button inside the label joins the input's accessible name\n  (\"Password Show password\"), which breaks screen-reader naming and the existing\n  `getByLabel('Password', { exact: true })` assertions in `tests/sign-in.test.ts:71,85,101`.\n- **A3 (accepted, correctness):** `<button type=\"button\">`. Visible text is the state\n  (\"Show password\" / \"Hide password\"); do not also add `aria-pressed` (double-announced\n  state). Add `aria-controls=\"password\"`. Use `type={visible ? 'text' : 'password'}` on the\n  same element so React updates the attribute without remounting; `name`, `required`,\n  `autoComplete=\"current-password\"` stay untouched.\n- **E5 (accepted, correctness):** add `input::-ms-reveal { display: none; }` to\n  `src/styles.css` so Edge's built-in reveal button does not sit beside ours with its own\n  independent state.\n- **E6 (accepted, correctness):** preserve caret/selection across the type switch (read\n  `selectionStart`/`selectionEnd` before toggling, restore after render) and keep focus on\n  the toggle button. Firefox moves the caret to the end when `type` changes.\n- **Style:** reuse the existing text-link treatment from `src/pages/Workspace.tsx:4`\n  (`text-blue-700 underline focus-visible:outline`) plus `py-3` for a 44px touch target;\n  no new dependency, no new CSS beyond E5. Rebuild CSS with `bun run css` (Tailwind scans\n  `src/**/*.tsx`; `public/styles.css` is gitignored and built at deploy).\n\n### Verification (accepted additions to the existing Bun + Playwright harness)\n- Replace the baseline assertion at `tests/sign-in.test.ts:76` (no visibility control) with\n  the toggle checks below, reusing `withSignIn`.\n- V1 show → hide: click \"Show password\" → input `type` is `text`, button name is\n  \"Hide password\"; click again → `type` is `password`, name is \"Show password\".\n- V2 value unchanged: fill, toggle twice, `inputValue()` still equals the typed value; then\n  Enter posts `{ email, password }` unchanged (extend the existing Enter test).\n- V3 toggle does not submit: after clicking the toggle, no `POST /api/login` was observed\n  (assert via the route interceptor; `unexpected` stays empty and no response fired).\n- V4 keyboard: Tab from the password input lands on the toggle; Space/Enter toggles; focus\n  stays on the button; `:focus-visible` outline present (`toHaveCSS` on outline-style).\n- V5 accessible name: `getByLabel('Password', { exact: true })` still resolves to the input\n  after the control exists (guards A2).\n- V6 fresh form hidden: navigate to `/` again in a new context → `type` is `password`.\n- V7 caret preserved: set caret mid-value, toggle, assert `selectionStart` unchanged (E6).\n- Manual browser checklist (not automatable in the Chromium harness): password-manager\n  autofill still offered on load (field is `type=password` at load); Edge shows a single\n  reveal control (E5); mobile 375px width layout; back-button behaviour after a successful\n  sign-in (see gate item E3).\n\n### PENDING GATE (proposals, not accepted; the user decides at the Final Approval Gate)\n- **E3** Re-mask the password when the form submits (security remedy, evidence in ledger).\n- **E4** Visually hidden `aria-live=\"polite\"` announcement \"Password shown\" / \"Password hidden\".\n- **E1** Keep the form mounted on a 401 and show an inline \"Wrong email or password\" message\n  (changes login errors, which the plan excludes; surfaced because the toggle's stated pain\n  is typos and the current 401 path unmounts the form).\n- **E2** \"Caps Lock is on\" hint under the password field.\n\n---\n\n# /autoplan Review Record\n\nBranch `main`, commit `c71ee3b`, base branch `main` (no remote; git-native fallback).\nSession `3097831-1789199175-149d9dc9`. Codex `codex-cli 0.153.4` model `gpt-6-astra` ready.\n\n## Phase 0 — Intake\n\n- Plan under review: this file. Design doc: `DESIGN.md` (repo-local, read; problem\n  statement, interaction and boundary match this plan). No TODOS.md. No handoff note.\n- Context read: `CLAUDE.md`, `README.md`, `src/main.tsx`, `src/server.ts`, `src/auth.ts`,\n  `src/pages/Workspace.tsx`, `tests/sign-in.test.ts`, `db/schema.sql`, `package.json`,\n  `index.html`, `src/styles.css`, `tailwind.config.cjs`. Git: one commit, clean tree, no\n  stash, no TODO/FIXME markers.\n- **UI scope: YES** (grep: form ×6, button ×1, layout ×1; plus mobile layout language).\n  Phase 2 (design review) runs.\n- **DX scope: NO.** Grep hits were `api` (the existing `/api/login` URL) and `endpoint`\n  inside \"does not add an endpoint\". No developer-facing surface, no SDK/CLI/API change,\n  end users are people signing in. Phase 2.5 skipped.\n- Learnings: none stored. Brain digests: none. Aside: not installed; WebSearch used for the\n  landscape check.\n- Storage policy: review documents via native Write/Edit to this plan file and\n  `.gstack/projects/gstack-autoplan-chain-eruYyB/` (CLAUDE.md); logs via their skill\n  writers; no Bash rewrites of review documents; no application source edits.\n\n## Phase 1 — CEO Review (mode: SELECTIVE EXPANSION, set by the plan)\n\n### Pre-review system audit\n- Current system: Bun server (`src/server.ts`) serving one React entry (`src/main.tsx`) with\n  a login state machine `loading → login | workspace | error`; login POSTs JSON to\n  `/api/login`; sessions are hashed tokens in PostgreSQL (`db/schema.sql`), 1h cookie.\n- In flight: nothing (single commit, clean tree). Retrospective: no prior review cycles.\n- Known pain point relevant to this plan: `src/main.tsx:14` maps every non-OK login\n  response (including 401 wrong password) to `setState('error')`, which unmounts the form\n  and shows \"Workspace unavailable. Reload to retry.\" The existing test at\n  `tests/sign-in.test.ts:98` pins this. Pre-existing, outside this plan's product scope\n  (plan excludes login errors). Flagged, not fixed (REPO_MODE unknown). See E1.\n\n### Taste calibration\n- Style references: `src/auth.ts` (session lookup injected as a function, strict cookie\n  regex, never trusts a body user id); `tests/sign-in.test.ts` `withSignIn` (builds the real\n  bundle, intercepts every request, aborts foreign origins, collects page errors).\n- Anti-patterns to avoid repeating: `src/main.tsx:11-15` puts the whole form on one JSX\n  line inside `App`, and `fetch(...).catch(() => null)` folds network failure and wrong\n  password into one generic error.\n\n### Landscape check (Layer 1 / 2 / 3)\n- **Layer 1:** a text-button reveal that starts masked is the established pattern\n  (GOV.UK, NHS, ONS design systems). One field per page means one \"Show/Hide\" name is\n  enough; the two-field naming issue (GOV.UK #2795) does not apply.\n- **Layer 2 (WebSearch):**\n  - GOV.UK password input: hide by default; on submit while visible, switch the type back to\n    `password` so browsers never store the value as plain-text autofill history.\n    Sources: https://design-system.service.gov.uk/patterns/passwords/ ,\n    https://technology.blog.gov.uk/2021/04/19/simple-things-are-complicated-making-a-show-password-option/ ,\n    https://service-manual.nhs.uk/design-system/components/password-input\n  - Edge renders a native reveal button on `type=password`; hide with\n    `input::-ms-reveal { display: none; }` when shipping a custom toggle.\n    Sources: https://learn.microsoft.com/en-us/microsoft-edge/web-platform/password-reveal ,\n    https://www.stefanjudis.com/snippets/how-to-hide-microsoft-edges-password-reveal-button/\n- **Layer 3:** the toggle only helps *before* submit. In this app the post-submit typo path\n  is worse than average (form disappears). The bigger lever for \"I mistyped\" is E1, which\n  the user has explicitly excluded; recorded as a proposal, not a premise rejection.\n\n### Decision ledger (Step 0 → spec review → outside voices)\n\n| ID and owner | Contract and evidence | Current | Proposed | Status | Exact approval and scope |\n|---|---|---|---|---|---|\n| A1 / 0D | Where toggle state lives. Evidence: `src/main.tsx:5-16` App owns all state; `src/pages/Workspace.tsx` is the only extracted component | no toggle | A: `useState` in `App`; B: extract `SignInForm`; C: `PasswordField` component | auto-decided C (TASTE) | /autoplan P5+P3; overridable at Final Gate |\n| A2 / 0B | Button placement vs `<label>`. Evidence: `tests/sign-in.test.ts:71,85,101` use `getByLabel('Password',{exact:true})`; accname includes label descendants | implicit label wraps input | button as sibling; `id`/`htmlFor` | accepted | Mechanical correctness (P1) |\n| A3 / 0D | Button semantics | none | `type=\"button\"`, text is state, `aria-controls`, no `aria-pressed` | accepted | Mechanical (P5) |\n| E1 / 0G | Inline 401 error keeps form mounted. Evidence: `src/main.tsx:14`, test `:98` | 401 → generic error, form unmounts | inline message, form stays | PENDING GATE | plan excludes login errors; user-visible |\n| E2 / 0G | Caps Lock hint | none | hint on `getModifierState('CapsLock')` | PENDING GATE | user-visible |\n| E3 / 0G | Re-mask on submit. Evidence: GOV.UK pattern; bfcache/back-nav can restore a `type=text` field with the value | stays visible through submit | set `visible=false` in `onSubmit` before fetch | PENDING GATE | security remedy; user-visible |\n| E4 / 0G | Live-region announcement | none | visually hidden `aria-live=polite` | PENDING GATE | accessibility enhancement; SR-perceivable |\n| E5 / 0G | Edge native reveal | Edge shows its own eye button | `::-ms-reveal{display:none}` | accepted | Mechanical correctness (two toggles, two states) |\n| E6 / 0G | Caret after type switch | n/a | preserve selection, keep focus on button | accepted | Mechanical correctness (P1) |\n| V1-V7 / 0D | Tests for the accepted behaviour | baseline test asserts no control | see Verification amendments | accepted | verification choices open to /autoplan |\n| X1 / 0D | Checkbox instead of button | n/a | `<input type=checkbox>` \"Show password\" | rejected | conflicts with plan's specified UI |\n| X2..X5 / scope | Remember visibility, strength meter, password reset, form redesign | excluded by plan | n/a | NOT in scope | user's stated direction |\n\n### 0A. Premise Challenge\n1. **Right problem?** Yes. Masked-field typos are a real, measured sign-in failure cause and\n   the reveal pattern is the standard remedy. A different framing (fix the 401 path so a\n   typo does not destroy the form) would arguably remove more pain, but the user excluded\n   it; it is recorded as E1 for the gate, not as a rejection of this premise.\n2. **Outcome:** fewer failed sign-ins and less re-typing; the plan reaches it directly, no\n   proxy metric.\n3. **Do nothing:** a mistyped password in this app means a 401, a generic error and a page\n   reload. The pain is real, not hypothetical. Premises accepted (P6). No clearly-wrong\n   premise queued.\n\n### 0B. Existing Code Leverage\n| Sub-problem | Existing code | Reused? |\n|---|---|---|\n| Form, password input, autocomplete | `src/main.tsx:15` | yes, edited in place |\n| Local UI state | `useState` already imported in `src/main.tsx:1` | yes |\n| Text-button styling and focus ring | `src/pages/Workspace.tsx:4` classes | yes |\n| Browser test harness, route doubles, page-error capture | `tests/sign-in.test.ts` `withSignIn` | yes; baseline assertion at `:76` replaced |\n| CSS pipeline | `bun run css`, `tailwind.config.cjs` content globs | yes; one rule added to `src/styles.css` (E5) |\nNothing is rebuilt. No helper exists for reveal toggles; the runtime (`type` attribute)\nprovides the mechanism, so no dependency is added.\n\n### 0C. Dream State Mapping\n```\n  CURRENT STATE                     THIS PLAN                        12-MONTH IDEAL\n  Masked field, no reveal;  --->    Reveal toggle, a11y-correct,  --->  Sign-in that never strands a user:\n  wrong password unmounts           tested in the real bundle,           inline errors, reveal, caps-lock\n  the form into a generic           Edge-safe, caret-safe                hint, reset flow, passkeys;\n  error                                                                  PasswordField reused by reset/sign-up\n```\nThe plan moves toward the ideal. Choosing C (component) leaves a reusable piece for the\nreset and sign-up forms the README implies are coming.\n\n### 0D. Alternatives (row A1)\n| | A: state in `App` | B: extract `SignInForm` | C: `PasswordField` component (chosen) |\n|---|---|---|---|\n| Summary | add `useState` to `App`, toggle inline | move form + submit handler to a new component | new ~25-line component owning label, input, button, state |\n| Effort | S (human ~1h / CC ~5min) | M (human ~3h / CC ~15min) | S (human ~1.5h / CC ~10min) |\n| Risk | low | low-medium (moves the submit handler, needs an `onError` prop) | low |\n| Pros | smallest diff | matches `pages/` pattern; untangles the one-line App | state co-located with the field; reusable; `App` untouched except one tag |\n| Cons | form-local state at app level; `App` line grows | refactor beyond the feature; bigger diff to review | one more component for a single use today |\n| Reuse / verification | same tests | same tests | same tests |\nCompleteness: all three cover every listed edge case equally; they differ in kind.\nDecision: C (P5 explicit, P3 pragmatic). B is close; marked TASTE for the gate. A rejected\n(mis-scoped state). X1 (checkbox) rejected: changes the specified UI.\n\n### 0E. Mode Selection\nMode: SELECTIVE EXPANSION, selected by the plan text (\"Complete SELECTIVE EXPANSION\nexploration\"). Approved decisions before Step 0: none. No user preference lookup\n(QUESTION_TUNING false). Planned change footprint: `src/main.tsx`, `src/styles.css`,\n`tests/sign-in.test.ts`, `README.md` (baseline note) → 4 files, under the 8-file smell.\n\n### 0F/0G. HOLD checks and cherry-pick ceremony\n- Complexity check: 4 files, 1 new component, 0 services. OK.\n- Minimum set: `src/main.tsx` + `tests/sign-in.test.ts`. Nothing in the plan can be\n  deferred without losing a stated requirement, so no defer/keep questions were needed.\n- 10x version (recorded, not adopted): a \"never strand the user\" sign-in: reveal + inline\n  401 error + caps-lock hint + reset link + passkey option. Platform potential: a\n  `PasswordField` shared by sign-in, reset and sign-up.\n- Delight scan (each ≤30 min CC) and dispositions, following the plan's rule that\n  user-visible behaviours are proposals pending the gate:\n\n| # | Proposal (user experience first) | Effort | Risk | Disposition |\n|---|---|---|---|---|\n| E1 | Mistype your password and see \"Wrong email or password\" under the field instead of losing the form | S (human ~2h / CC ~10min) | low | PENDING GATE (plan excludes login errors) |\n| E2 | See \"Caps Lock is on\" before you submit | S (human ~1h / CC ~5min) | low | PENDING GATE |\n| E3 | Password re-masks the moment you submit, so back-navigation or bfcache never shows it in plain text | S (human ~30min / CC ~3min) | low | PENDING GATE (security remedy, evidence: GOV.UK pattern) |\n| E4 | Screen-reader users hear \"Password shown\" / \"Password hidden\" | S (human ~30min / CC ~3min) | low | PENDING GATE (accessibility enhancement) |\n| E5 | Edge users see one reveal control, not two fighting each other | S (CC ~1min) | none | ACCEPTED (correctness) |\n| E6 | Your cursor stays where it was after toggling | S (CC ~3min) | low | ACCEPTED (correctness) |\n| X1 | Checkbox \"Show password\" instead of a button | S | low | REJECTED (conflicts with specified UI) |\n| X2-X5 | Remember visibility; strength meter; reset; redesign | — | — | NOT IN SCOPE (plan) |\n\nScope counts: 8 proposals (E1-E6, X1, and the X2-X5 group counted once as excluded),\n2 accepted (E5, E6), 4 pending gate (E1-E4), 1 rejected (X1), 1 excluded by the plan.\nNothing deferred to TODOS.md yet; gate outcomes for E1-E4 decide that.\n",
      "file_path": "/tmp/gstack-paid-shard-Rv33F1/tmp/gstack-autoplan-chain-eruYyB/.claude/plans/autoplan-password-visibility.md"
    },
    "capturedAtMs": 1789199616109,
    "result": "pending"
  },
  "hookEvidence": {
    "path": ".context/sep12-ship-pooled-validation-draft/retained/pool/skill-e2e-autoplan-chain/tmp/gstack-hermetic-3097469-t39mvg/question-events-95Xv96/events/ed17acee4b24bd0c128b44d54758bb208204132b7c13b5fa5b56d605941f0ca5.json",
    "sha256": "547847e655f1e2ec869554bf1e919c22fc7a0f60461ec84a1a24b0bce5b04d54"
  },
  "limits": "Exact retained decoded frame and public PermissionRequest input. No later complete frame or successful Write ACK was captured. Free continuations are controlled, not a repaired native outcome."
}