feat!: simplify TeslaSync workspaces, navigation, dashboards, and source-aware insights

.github/ARCHITECTURE.md

@@ -221,6 +221,14 @@ DECISION:
       deployments must use one telemetry/FSM owner plus API-only reader pods, or
       remain single-pod for telemetry/FSM.
 
+  Implementation note:
+    - App constructs one L1 + optional L2 LiveSignalStore before optional
+      telemetry initialization and passes it explicitly to RouterOptions.
+    - API-only reader pods use that boundary without subscriber/FSM startup.
+      The telemetry owner reuses the same L1 and boundary; its existing
+      Redis warmup, signal_log hydration, and startup ordering remain intact.
+    - This reader-layer lifetime does not provide active-active FSM ownership.
+
   Rollback/degradation:
     - `LIVE_SIGNAL_STORE_MODE=hybrid|local` is the runtime rollback switch.
     - `hybrid` enables Redis-backed distributed live reads.

.github/scripts/ci_workflows.test.mjs

@@ -38,6 +38,8 @@ test('existing aggregate names reject any required job that did not succeed', ()
       ['contract', 'browser-build', 'chromium-tests']],
     [browser.jobs, 'visual', 'Deliberate visual snapshot gate (Windows baseline)',
       ['contract', 'browser-build', 'visual-tests']],
+    [browser.jobs, 'cross-browser', '${{ matrix.browser }} critical smoke',
+      ['contract', 'browser-build', 'cross-browser-tests']],
   ]) {
     const job = jobs[id];
     assert.equal(job.name, name);
@@ -60,11 +62,16 @@ test('independent validation and Docker builds start together; final gate checks
 test('browser shards reuse one build and retain isolated performance and Windows baselines', () => {
   const shards = browser.jobs['chromium-tests'].strategy.matrix.include;
   assert.deepEqual(shards.filter(shard => shard.suite === 'quality').map(shard => shard.shard),
-    Array.from({ length: 16 }, (_, i) => `${i + 1}/16`));
-  for (const suite of ['a11y', 'performance']) {
-    assert.deepEqual(shards.filter(shard => shard.suite === suite).map(shard => shard.shard), ['1/1']);
+    Array.from({ length: 64 }, (_, i) => `${i + 1}/64`));
+  for (const [suite, count] of [['a11y', 13], ['performance', 1]]) {
+    assert.deepEqual(shards.filter(shard => shard.suite === suite).map(shard => shard.shard),
+      Array.from({ length: count }, (_, i) => `${i + 1}/${count}`));
   }
-  for (const id of ['chromium-tests', 'visual-tests', 'cross-browser']) {
+  assert.deepEqual(browser.jobs['cross-browser-tests'].strategy.matrix,
+    { browser: ['firefox', 'webkit'], shard: [1, 2, 3] });
+  assert.match(commands(browser.jobs['cross-browser-tests']), /--shard=\$\{\{ matrix\.shard \}\}\/3/);
+  assert.match(commands(browser.jobs['visual-tests']), /--shard=\$\{\{ matrix\.shard \}\}\/64 --workers=2/);
+  for (const id of ['chromium-tests', 'visual-tests', 'cross-browser-tests']) {
     const job = browser.jobs[id];
     assert.equal(job.needs, 'browser-build');
     assert.equal(job.strategy['fail-fast'], false);
@@ -73,7 +80,7 @@ test('browser shards reuse one build and retain isolated performance and Windows
   }
   assert.equal(browser.jobs['visual-tests']['runs-on'], 'windows-latest');
   assert.deepEqual(browser.jobs['visual-tests'].strategy.matrix.shard,
-    Array.from({ length: 10 }, (_, i) => i + 1));
+    Array.from({ length: 64 }, (_, i) => i + 1));
   assert.equal(Object.values(browser.jobs).filter(job => commands(job).includes('npm run e2e:build')).length, 1);
 });
 

.github/skills/audit-violations/SKILL.md

@@ -36,6 +36,7 @@ The audit covers these categories:
 
 ## Interpreting Results
 
+- Exit **0** means every check passed; exit **1** means reported violations or TypeScript errors. Other nonzero statuses indicate execution failures.
 - **0 violations** = file is clean
 - Each violation shows: file, line number, rule ID, matched code
 - Files inside `components/ui/`, `components/charts/`, `components/maps/` are EXCLUDED from raw HTML and library import checks (they are the shared components)

.github/skills/audit-violations/audit.sh

@@ -48,7 +48,7 @@ echo ""
 # --- 2. Raw HTML elements ---
 echo "▸ [2/7] Raw HTML elements..."
 # Exclude components/ directories (they ARE the shared components)
-MATCHES=$(grep -rnP '<button\b|<input\b|<textarea\b|<select\b|<table\b' "$TARGET" --include="*.tsx" "${GREP_EXCLUDES[@]}" 2>/dev/null | grep -v 'components/ui/' | grep -v 'components/charts/' | grep -v 'components/maps/' | grep -v 'components/forms/' | grep -vP ':[0-9]+:\s*(//|/\*|\*)' || true)
+MATCHES=$(grep -rHnP '<button\b|<input\b|<textarea\b|<select\b|<table\b' "$TARGET" --include="*.tsx" "${GREP_EXCLUDES[@]}" 2>/dev/null | grep -vE 'components[/\\](ui|charts|maps|forms)[/\\]' | grep -vP ':[0-9]+:\s*(//|/\*|\*)' || true)
 COUNT=$(printf '%s\n' "$MATCHES" | grep -c . || true)
 if [ "$COUNT" -gt 0 ]; then
   echo "  ❌ $COUNT violation(s):"
@@ -61,7 +61,7 @@ echo ""
 
 # --- 3. Direct library imports ---
 echo "▸ [3/7] Direct library imports..."
-MATCHES=$(grep -rn "from 'recharts'\|from 'react-leaflet'\|from 'framer-motion'" "$TARGET" --include="*.tsx" --include="*.ts" "${GREP_EXCLUDES[@]}" 2>/dev/null | grep -v 'components/charts/index' | grep -v 'components/maps/index' | grep -v 'components/motion/' || true)
+MATCHES=$(grep -rHn "from 'recharts'\|from 'react-leaflet'\|from 'framer-motion'" "$TARGET" --include="*.tsx" --include="*.ts" "${GREP_EXCLUDES[@]}" 2>/dev/null | grep -vE 'components[/\\](charts|maps|motion)[/\\]' || true)
 COUNT=$(printf '%s\n' "$MATCHES" | grep -c . || true)
 if [ "$COUNT" -gt 0 ]; then
   echo "  ❌ $COUNT violation(s):"
@@ -136,3 +136,6 @@ else
   echo "  ❌ AUDIT FAILED — $TOTAL total violation(s)"
 fi
 echo "═══════════════════════════════════════════════════════════"
+if [ "$TOTAL" -gt 0 ]; then
+  exit 1
+fi

.github/workflows/ci.yml

@@ -80,7 +80,8 @@ jobs:
       - name: Lint
         if: matrix.check == 'lint'
         run: |
-          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.13.2
+          # v2.13.2 cannot read go1.27 export data (v5 > max v4); v2.15.0 can.
+          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.15.0
           golangci-lint run ./...
       - name: Architecture tests and metrics
         if: matrix.check == 'architecture'

.github/workflows/frontend-quality.yml

@@ -99,23 +99,86 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - {name: responsive-1, suite: quality, shard: '1/16'}
-          - {name: responsive-2, suite: quality, shard: '2/16'}
-          - {name: responsive-3, suite: quality, shard: '3/16'}
-          - {name: responsive-4, suite: quality, shard: '4/16'}
-          - {name: responsive-5, suite: quality, shard: '5/16'}
-          - {name: responsive-6, suite: quality, shard: '6/16'}
-          - {name: responsive-7, suite: quality, shard: '7/16'}
-          - {name: responsive-8, suite: quality, shard: '8/16'}
-          - {name: responsive-9, suite: quality, shard: '9/16'}
-          - {name: responsive-10, suite: quality, shard: '10/16'}
-          - {name: responsive-11, suite: quality, shard: '11/16'}
-          - {name: responsive-12, suite: quality, shard: '12/16'}
-          - {name: responsive-13, suite: quality, shard: '13/16'}
-          - {name: responsive-14, suite: quality, shard: '14/16'}
-          - {name: responsive-15, suite: quality, shard: '15/16'}
-          - {name: responsive-16, suite: quality, shard: '16/16'}
-          - {name: accessibility, suite: a11y, shard: '1/1'}
+          # Keep every partition required; the aggregate checks the entire matrix.
+          - {name: responsive-1, suite: quality, shard: '1/64'}
+          - {name: responsive-2, suite: quality, shard: '2/64'}
+          - {name: responsive-3, suite: quality, shard: '3/64'}
+          - {name: responsive-4, suite: quality, shard: '4/64'}
+          - {name: responsive-5, suite: quality, shard: '5/64'}
+          - {name: responsive-6, suite: quality, shard: '6/64'}
+          - {name: responsive-7, suite: quality, shard: '7/64'}
+          - {name: responsive-8, suite: quality, shard: '8/64'}
+          - {name: responsive-9, suite: quality, shard: '9/64'}
+          - {name: responsive-10, suite: quality, shard: '10/64'}
+          - {name: responsive-11, suite: quality, shard: '11/64'}
+          - {name: responsive-12, suite: quality, shard: '12/64'}
+          - {name: responsive-13, suite: quality, shard: '13/64'}
+          - {name: responsive-14, suite: quality, shard: '14/64'}
+          - {name: responsive-15, suite: quality, shard: '15/64'}
+          - {name: responsive-16, suite: quality, shard: '16/64'}
+          - {name: responsive-17, suite: quality, shard: '17/64'}
+          - {name: responsive-18, suite: quality, shard: '18/64'}
+          - {name: responsive-19, suite: quality, shard: '19/64'}
+          - {name: responsive-20, suite: quality, shard: '20/64'}
+          - {name: responsive-21, suite: quality, shard: '21/64'}
+          - {name: responsive-22, suite: quality, shard: '22/64'}
+          - {name: responsive-23, suite: quality, shard: '23/64'}
+          - {name: responsive-24, suite: quality, shard: '24/64'}
+          - {name: responsive-25, suite: quality, shard: '25/64'}
+          - {name: responsive-26, suite: quality, shard: '26/64'}
+          - {name: responsive-27, suite: quality, shard: '27/64'}
+          - {name: responsive-28, suite: quality, shard: '28/64'}
+          - {name: responsive-29, suite: quality, shard: '29/64'}
+          - {name: responsive-30, suite: quality, shard: '30/64'}
+          - {name: responsive-31, suite: quality, shard: '31/64'}
+          - {name: responsive-32, suite: quality, shard: '32/64'}
+          - {name: responsive-33, suite: quality, shard: '33/64'}
+          - {name: responsive-34, suite: quality, shard: '34/64'}
+          - {name: responsive-35, suite: quality, shard: '35/64'}
+          - {name: responsive-36, suite: quality, shard: '36/64'}
+          - {name: responsive-37, suite: quality, shard: '37/64'}
+          - {name: responsive-38, suite: quality, shard: '38/64'}
+          - {name: responsive-39, suite: quality, shard: '39/64'}
+          - {name: responsive-40, suite: quality, shard: '40/64'}
+          - {name: responsive-41, suite: quality, shard: '41/64'}
+          - {name: responsive-42, suite: quality, shard: '42/64'}
+          - {name: responsive-43, suite: quality, shard: '43/64'}
+          - {name: responsive-44, suite: quality, shard: '44/64'}
+          - {name: responsive-45, suite: quality, shard: '45/64'}
+          - {name: responsive-46, suite: quality, shard: '46/64'}
+          - {name: responsive-47, suite: quality, shard: '47/64'}
+          - {name: responsive-48, suite: quality, shard: '48/64'}
+          - {name: responsive-49, suite: quality, shard: '49/64'}
+          - {name: responsive-50, suite: quality, shard: '50/64'}
+          - {name: responsive-51, suite: quality, shard: '51/64'}
+          - {name: responsive-52, suite: quality, shard: '52/64'}
+          - {name: responsive-53, suite: quality, shard: '53/64'}
+          - {name: responsive-54, suite: quality, shard: '54/64'}
+          - {name: responsive-55, suite: quality, shard: '55/64'}
+          - {name: responsive-56, suite: quality, shard: '56/64'}
+          - {name: responsive-57, suite: quality, shard: '57/64'}
+          - {name: responsive-58, suite: quality, shard: '58/64'}
+          - {name: responsive-59, suite: quality, shard: '59/64'}
+          - {name: responsive-60, suite: quality, shard: '60/64'}
+          - {name: responsive-61, suite: quality, shard: '61/64'}
+          - {name: responsive-62, suite: quality, shard: '62/64'}
+          - {name: responsive-63, suite: quality, shard: '63/64'}
+          - {name: responsive-64, suite: quality, shard: '64/64'}
+          # Thirteen independent audits; don't create 51 empty runners.
+          - {name: accessibility, suite: a11y, shard: '1/13'}
+          - {name: accessibility-2, suite: a11y, shard: '2/13'}
+          - {name: accessibility-3, suite: a11y, shard: '3/13'}
+          - {name: accessibility-4, suite: a11y, shard: '4/13'}
+          - {name: accessibility-5, suite: a11y, shard: '5/13'}
+          - {name: accessibility-6, suite: a11y, shard: '6/13'}
+          - {name: accessibility-7, suite: a11y, shard: '7/13'}
+          - {name: accessibility-8, suite: a11y, shard: '8/13'}
+          - {name: accessibility-9, suite: a11y, shard: '9/13'}
+          - {name: accessibility-10, suite: a11y, shard: '10/13'}
+          - {name: accessibility-11, suite: a11y, shard: '11/13'}
+          - {name: accessibility-12, suite: a11y, shard: '12/13'}
+          - {name: accessibility-13, suite: a11y, shard: '13/13'}
+          # One explicit serial group: retain its performance measurement isolation.
           - {name: performance, suite: performance, shard: '1/1'}
     steps:
       - uses: actions/checkout@v7
@@ -134,7 +197,8 @@ jobs:
         env:
           E2E_MOCKS: '1'
           E2E_REUSE_BUILD: '1'
-        run: npm run e2e:${{ matrix.suite }} -- --shard=${{ matrix.shard }}
+          GUARD_RUN_ID: ${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.name }}
+        run: npm run e2e:${{ matrix.suite }} -- --shard=${{ matrix.shard }} ${{ matrix.suite == 'a11y' && '--fully-parallel' || '' }}
       - name: Upload Chromium failure evidence
         if: always()
         uses: actions/upload-artifact@v7.0.1
@@ -144,6 +208,7 @@ jobs:
           retention-days: 14
           path: |
             web/test-results/
+            web/test-results-guard/
             web/playwright-report/
 
   chromium-quality:
@@ -161,14 +226,15 @@ jobs:
         run: |
           python3 -c 'import json, os; results = json.loads(os.environ["RESULTS"]); print(results); assert all(job["result"] == "success" for job in results.values()), "A required browser job failed, was cancelled, or was skipped"'
 
-  cross-browser:
-    name: ${{ matrix.browser }} critical smoke
+  cross-browser-tests:
+    name: ${{ matrix.browser }} critical smoke (${{ matrix.shard }}/3)
     runs-on: ubuntu-latest
     needs: browser-build
     strategy:
       fail-fast: false
       matrix:
         browser: [firefox, webkit]
+        shard: [1, 2, 3]
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v5
@@ -186,26 +252,51 @@ jobs:
         env:
           E2E_MOCKS: '1'
           E2E_REUSE_BUILD: '1'
-        run: npm run e2e -- --project=${{ matrix.browser }}-smoke
+        run: npm run e2e -- --project=${{ matrix.browser }}-smoke --shard=${{ matrix.shard }}/3
       - name: Upload engine failure evidence
         if: always()
         uses: actions/upload-artifact@v7.0.1
         with:
-          name: ${{ matrix.browser }}-smoke-report
+          name: ${{ matrix.browser }}-smoke-report-${{ matrix.shard }}
           if-no-files-found: ignore
           retention-days: 14
           path: |
             web/test-results/
             web/playwright-report/
 
+  cross-browser:
+    # Preserve existing engine check names; neither can pass with a missing shard.
+    name: ${{ matrix.browser }} critical smoke
+    if: always()
+    needs: [contract, browser-build, cross-browser-tests]
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        browser: [firefox, webkit]
+    defaults:
+      run:
+        working-directory: .
+    steps:
+      - name: Require every engine smoke shard
+        env:
+          RESULTS: ${{ toJSON(needs) }}
+        run: |
+          python3 -c 'import json, os; results = json.loads(os.environ["RESULTS"]); print(results); assert all(job["result"] == "success" for job in results.values()), "A required engine job failed, was cancelled, or was skipped"'
+
   visual-tests:
-    name: Windows visual snapshots (${{ matrix.shard }}/10)
+    name: Windows visual snapshots (${{ matrix.shard }}/64)
     runs-on: windows-latest
     needs: browser-build
     strategy:
       fail-fast: false
       matrix:
-        shard: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10]
+        shard: [
+          1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16,
+          17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32,
+          33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48,
+          49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64
+        ]
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v5
@@ -223,7 +314,7 @@ jobs:
         env:
           E2E_MOCKS: '1'
           E2E_REUSE_BUILD: '1'
-        run: npm run e2e:visual -- --shard=${{ matrix.shard }}/10 --workers=2
+        run: npm run e2e:visual -- --shard=${{ matrix.shard }}/64 --workers=2
       - name: Upload visual diffs
         if: always()
         uses: actions/upload-artifact@v7.0.1

.gitignore

@@ -63,6 +63,7 @@ docs/.vitepress/dist/
 test-results/
 web/test-results/
 web/test-results-pwa-assets/
+web/test-results-guard/
 web/playwright-report/
 web/blob-report/
 web/e2e/.auth-state.json
@@ -75,6 +76,10 @@ coverage.txt
 coverage-by-package.txt
 web/coverage/
 *.test.log
+.agent-status/
+qa-screenshots/
+logs/
+report.*.json
 
 PROMPT_COMMANDS.txt
 
@@ -122,3 +127,23 @@ REDESIGN-NOTES.md
 # transient commit-message files used by R-phase recipe
 commit_msg.txt
 commit_msg*.txt
+
+state/
+
+.runner/
+
+# Worktree-local side navigation preview dependency cache.
+/.sidenav-vite-cache/
+
+# Local agent source copies and browser-session captures.
+/.agents/artifacts/
+/.agents/atomic-*/
+/.agents/state.md
+/.copilot-artifacts/
+/files/atomic-*/
+/files/page-source-cycle*-operationalbrief-*/
+/files/parallel-statistics-page-live/
+/.playwright-mcp/
+/web/.playwright-mcp/
+/web/precision-admin-analytics-*.log
+/web/precision-admin-analytics-bounded.json

.gitleaks.toml

@@ -148,3 +148,42 @@ condition = "AND"
 regexTarget = "line"
 paths = ['''(^|/)web/src/components/ui/__tests__/MaskedValue\.test\.tsx$''']
 regexes = ['''sk_live_abcdef1234''']
+
+[[allowlists]]
+description = "Generated frontend audit evidence (SHA fingerprints, command transcripts, prose) — docs only, no maintained source or credentials."
+paths = ['''(^|/)docs/frontend-audits/''']
+
+[[allowlists]]
+description = "Design-contract doc: file fingerprint and prose mentioning keys"
+condition = "AND"
+regexTarget = "line"
+paths = ['''(^|/)docs/frontend-design-contract\.md$''']
+regexes = ['''`[0-9a-f]{64}`''', '''keys, invalidation/broadcast and toast''']
+
+[[allowlists]]
+description = "Migration queue rows: phase-token list names and tokens test reference"
+condition = "AND"
+regexTarget = "line"
+paths = ['''(^|/)migration-queue\.md$''']
+regexes = ['''phase3-font-inheritance-tokens,phase3-''', '''phase3-side-panel-geometry-tokens''']
+
+[[allowlists]]
+description = "Work-items queue: task prose mentioning keys"
+condition = "AND"
+regexTarget = "line"
+paths = ['''(^|/)work-items\.json$''']
+regexes = ['''Continue the existing modernization, not a new page migration''']
+
+[[allowlists]]
+description = "Trio registry palette guard compares a route key name, not a credential"
+condition = "AND"
+regexTarget = "line"
+paths = ['''(^|/)web/scripts/i18n-trio-registries\.mjs$''']
+regexes = ['''key === 'route\.i18nKey'''']
+
+[[allowlists]]
+description = "Trio producer test pins per-file SHA fingerprints (frozen evidence, not secrets)"
+condition = "AND"
+regexTarget = "line"
+paths = ['''(^|/)web/src/i18n/excluded-feature-owned-producers\.test\.ts$''']
+regexes = ['''\["web/src/[^"]+", "[0-9a-f]{64}"\]''']

Dockerfile

@@ -52,6 +52,7 @@ COPY --from=go-builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
 COPY --from=go-builder /bin/teslasync /usr/local/bin/teslasync
 COPY migrations /migrations
 COPY docs/public/openapi.yaml /docs/public/openapi.yaml
+COPY slo/catalog.yaml /slo/catalog.yaml
 COPY --from=web-builder /app/dist /web/dist
 
 USER nonroot:nonroot