OSIT-AE-App-Svelte/documentation/archive/TODO__Agents__ARCHIVE_2026-03.md

✅ Completed (2026-03)

• [Stores] Phase 1 — Dead code cleanup (ae_stores.ts, ae_events_stores.ts, ae_idaa_stores.ts): removed ver_idb, stale comments, console.log lines, Stripe button block (zero consumers), personal Novi UUIDs, dead alternatives. Net: −202 lines across 3 files. svelte-check: 0 errors. (2026-03-16)
• [Stores] Phase 2a — Split defaults into domain sub-files: ae_stores__auth_loc_defaults.ts; ae_events_stores__badges/launcher/leads/pres_mgmt_defaults.ts. Spread-merged back into store structs — zero consumer changes. (2026-03-16)
• [Stores] Phase 2b — TypeScript interfaces for defaults sub-files: SiteCfgJson, AePerson, AeUser, AccessType, AuthLocState; BadgesLocState/SessState; SectionState, LauncherLocState/SessState; LeadsLocState/SessState, TmpLicense; PresMgmtLocState/SessState. svelte-check: 0 errors. (2026-03-16)
• [UI] Style Review Phase 1 & 2 complete — all non-frozen, non-IDAA routes migrated: FA→Lucide (events, pres_mgmt, core, badges, leads, hosted_files), variant-*→preset-* (all modules), code_to_html badge dict refactored to Lucide component map, FA CDN scoped to IDAA layout, global svg.lucide { display: inline } CSS rule added to fix icon inline flow. See documentation/PROJECT__AE_Style_Review.md. (2026-03-16)
• [UI] Pres Mgmt Phase 3 — FA→Lucide icon migration across all 24 pres_mgmt files. (2026-03-16)
• [IDAA] ae_idaa_comp__event_obj_id_edit.svelte — inlined Tailwind utilities, removed <style> block; eliminated all 23 @apply/@reference svelte-check warnings. (2026-03-16)
• [Badges] Badge print page svelte-check fix: extracted print CSS to static/ae-print-badge.css; fixed unclosed <script> tag in print/+page.svelte. (2026-03-16)
• [Svelte/Tests] svelte-check cleanup: fixed select_ref_badge_type $state() declaration; two <svelte:component> deprecations in launcher components; page.evaluate() two-arg pattern in badge_print_layout.test.ts. (2026-03-16)
• [Launcher] Hosted file download button require_auth prop — added require_auth?: boolean (default true) to ae_comp__hosted_files_download_button.svelte; all existing consumers unchanged. Launcher launcher_file_cont.svelte passes require_auth={false} so unauthenticated kiosk users can open/download files without being blocked. (2026-03-16)
• [Security] PUBLIC_AE_API_SECRET_KEY audit complete. Key is PUBLIC_* by design (always in client bundle). Highest-risk anonymous path uses limited-permission PUBLIC_AE_BOOTSTRAP_KEY. Full server-side migration not justified given JWT + account_id auth layers. Current state acceptable. (2026-03-11)
• [UX] Session Expired banner — ae_auth_error store wired to API helpers; root layout sets flag_expired on 401/403; non-blocking dismissible banner rendered. (2026-03-12)
• [UX] Access Denied UI standardized — element_access_denied.svelte created; /core layout, /events/settings, and /events/badges/review updated to use it. (2026-03-12)
• [Build] Rollup/Vite circular dependency warnings eliminated — manualChunks in vite.config.ts colocates all svelte/* internals into a single svelte-vendor chunk, preventing runtime.js / index-client.js split (~35 warnings gone). (2026-03-11)
• [Refactor] try_cache audit + sponsorship/event_file/hosted_file SWR alignment — removed vestigial try_cache params from generate_qr_code, ae_core_functions wrappers; added SWR fast/slow path to sponsorship loaders; changed event_file and hosted_file single-object loader defaults from false → true for consistency. (2026-03-11)
• [DevOps] Frontend + Backend unified into single aether_container_env Docker Compose. ae_app service live with healthcheck, single exposed port (AE_APP_NODE_PORT), internal ae_api networking. Deploy scripts in package.json both target ../aether_container_env/docker-compose.yml. (2026-03-10)
• [DevOps] /health endpoint live at src/routes/health/+server.ts. Docker HEALTHCHECK uses it. (2026-03-10)
• [UI] Dark mode color-scheme fix — html.dark/light { color-scheme } in app.css; all native browser controls now sync to app dark mode. (2026-03-10)
• [Launcher] Location select → session auto-load bug fixed via $derived.by() liveQuery pattern. (2026-03-10)
• [Svelte] state_referenced_locally warning fixes — 10 warnings resolved in IDAA archives/BB. (2026-03-09)
• [TypeScript] Sign In/Out TS errors fixed — user_id / person_id typed as string | null. (2026-03-09)
• [Tests] All badge data integrity and attendee workflow Playwright tests passing. Root causes documented in tests/README.md. (2026-03)
• [Badges] Badge print controls panel, QR code, duplex wiring, review form, print button, multi-word fulltext search, data-testid attributes. (2026-03)
• [UI] Firefly Theme + Pres Mgmt Visual Redesign (5 files). (2026-03-06)
• [Docs] UI Style Guidelines + Component Patterns docs created. (2026-03-06)
• [API] V3 Lookup system integration; Event File V3 mapping; event_session search 400-error fix. (2026-02/03)
• [API] All CRUD helpers on V3 /v3/crud/... paths. (2026-02)
• [Security] Purged x-aether-api-token; fixed misplaced CORS headers; Account ID Scavenging. (2026-02)
• [Security] Playwright integration tests replace verify_jwt_logic.js simulation tests. (2026-03)
• [Framework] AE_Obj_Field_Editor_V3 with Svelte 5 Runes. CRUD v2 fully retired. (2026-03-05)
• [IDAA] Bulletin Board and Recovery Meetings functionality verified. (2026-02)