feat(web): add durable Weekly Review workspace

[seonghobae]

Advances #209 as the dependency-ordered child of the durable Habits workspace. This slice exposes the authenticated Review BFF as a first-party /review workspace without moving workspace authority or Review persistence into the browser.

RED → GREEN

• RED 8940bec0d70c0f8863ea6c692b408ae951960dd8 establishes the focused state contract: no invented durable evidence, bounded immutable history, fail-closed malformed/duplicate evidence, explicit active submission before completion evidence, mutation-lock release, and durable-history preservation on failure. GREEN a1ed8b708cd2e9098b5165faa78bb5a39030097e adds the minimal reducer/validators.
• 257cf4be51867ac278b5e0c4731f223b4e44d0b2 adds /review; ef028ab5bb26d37944cbb3c3841568b49d3a9b90 adds explicit Weekly Review completion with strict BFF evidence parsing; af17025fa3b77e1211133205a1147c6b427e6bad adds responsive/loading/empty/error/auth/offline/conflict/focus/reduced-motion styling; cd940361e2c6a8d87fcf5849905de3c5c83ac47b adds Playwright buyer-path contracts; da8a18ca4316565c0bd8bf05ae5ad2e03e146569 wires the state contract into the web suite.
• Self-review found that the mixed completion-history endpoint also returns daily-planning and daily-shutdown records while the UI rendered every record as Week of …. RED ad892f35d37fb846010d3b28fa6b8e9ecbc54247 captures the defect; GREEN 6db6845bb8197d7eb4d246eaae7e0cc31122b9e3 adds ritual-aware headings and removes copy that implied authoritative Planning/Habit projections before those projections exist.
• Self-review then found that two distinct UUIDv4 weekly-review records for the same Monday could enter browser state. RED abbc4766d050e25018f9571e044f77db70617027, GREEN 2a39afffb1bb80ff594afdf0f6d21168f42a5320, and coverage cc1cb0079e23ce03d2eeb744240163d4b0c8bc62 reject duplicate weekly periods during history ingestion and active completion. The focused Node 22 state suite passed 7/7; the standalone TypeScript compiler lacked repository @types/node, so this is runtime state evidence rather than a repository typecheck or hosted CI claim.
• A second review against protected-main persistence found the invariant is broader: guided_review.review_completions has UNIQUE (workspace_id, ritual_kind, period_start_date), so duplicate daily-planning/daily-shutdown periods are impossible durable evidence too. RED e22fb7acce0e164ad8270e9abac9cf5672113e08 adds a distinct-ID duplicate daily-planning history case and reproduces the defect (ready instead of fail-closed). GREEN 35e8172a4e1112c19a8831112230d245f8c38919 replaces weekly-only duplicate detection with (ritualKind, periodStartDate) uniqueness while preserving different rituals on the same local date. Focused Node 22 execution rejects the duplicate daily period and accepts a daily-planning/daily-shutdown pair for the same date.

Exact current head: 35e8172a4e1112c19a8831112230d245f8c38919. Exact live base re-read before this PR-state update: feat/web-habits-workspace-v1@8073991893cd98e87118960ec1f9f410121f5d5c. Protected main remained 232a53fce43291ce19414c56e0ab5e46e653eaf7 during this repair.

Durable acceptance and domain boundary

The page consumes only browser-safe immutable Review completion evidence from /api/reviews/completions?limit=50 and records weekly completion through /api/reviews/weekly-review/completions. Identity-derived workspace authority and Review-service persistence remain server-side. The browser never invents a Review record identity. BFF history is accepted only when UUIDv4/ritual/date/count/reflection/timestamp evidence is valid, IDs are unique, and the protected-main persistence invariant of at most one completion per workspace+ritual+period is respected. A 409 never overwrites prior history.

The canonical product contract still requires Weekly Review to consume authoritative read-only Planning/Habit projections for stalled goals, inactive projects, overdue tasks, schedule realism, and adherence. The currently merged Review service deferred those adapters. This UI therefore does not claim user-entered aggregate counts are authoritative projections, and #209 remains open.

Design / delivery gate

Issue #209 records Figma authority LifeOS Design System — Product Shell v1 (7NUoFkOgZEjOOOCcCqjU1D). Direct Figma-node inspection was not available in this non-interactive run, so this PR does not claim Figma parity or Storybook completion. It retains the existing protected-stack tokens and explicit responsive/a11y contracts; no material visual design was changed by the period-uniqueness repair.

This PR remains Draft. Its base is a non-default stacked feature branch, and the repository currently emits no pull-request workflow runs for this exact head. After prerequisites integrate, this child must be non-force restacked onto protected-main lineage and reacquire exact-head repository/central CI, security, coverage, provenance and review gates. It does not claim Settings, KO/EN/JA/ZH/VI/ES/DE/FR translation-ledger parity, authoritative Review projections, p95 release evidence, release readiness, or #209 closure.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}