# Task 6 report

## RED baseline

`pnpm audit:platform` initially exited with code 1. The audit reported missing API declarations, route entries, and view files for the resource contract catalogue.

## Implementation

- Added `src/api/resources.ts` as the single front-end catalogue for all 46 backend resource contracts, including path, title, mode, page kind, and fields.
- Added route modules and declarative list/tree pages for each resource.
- Added reusable read-only and tree pages; read-only definitions do not render create, edit, status, or archive controls.
- Updated the shared CRUD page with server-side keyword filters, identity-based details, typed form data, archive confirmation, and API error messages.
- Removed platform UI use of internal numeric identifiers in favour of `identity` and `parent_identity`.

## Verification

- `pnpm type:check` — pass
- `pnpm audit:platform` — pass
- `pnpm build` — pass

## Notes

The tree page consumes `parent_identity`; the corresponding menu API must expose that identity relation rather than an internal numeric parent key.

## Fix round 1

- Replaced inferred front-end paths with an explicit 46-path catalogue: it includes the dashboard endpoint, adds `/ec/ec_order_item`, and removes the non-list safety disposal action from the menu catalogue.
- Corrected the safety, e-commerce, staff, and user API paths to match the registered backend routes exactly.
- Added audit assertions for exact path/mode/page-kind contracts, separate read-only UI surfaces, identifier leakage, and tree semantics.
- Detail drawers now filter `id` and `*_id` fields before rendering.

## Fix round 2

- The resource catalogue now contains exactly the 46 backend `ExpectedResources` names, including the append-only `saf_event_disposal` contract rather than a synthetic dashboard entry.
- Every definition has its own backend write allowlist and required `*_identity` fields; no resource inherits a generic `name/status` schema.
- Safety disposal is a detail action on `saf_event` (`/safety/saf_event/:identity/disposals`) and has no standalone menu or page.
- `ec_category` and `platform_menu` use tree pages. The shared tree preserves identity-first behavior and uses backend `parent_id` only for in-memory hierarchy adaptation when `parent_identity` is unavailable.
- The audit transpiles and evaluates `resources.ts`, then compares the resulting definitions, allowlists, required identities, modes, page types, tree semantics, and identifier-safety rules to the complete expected contract.

## Fix round 3

- Added tested backend identity-to-key resolution for public account and relationship requests; clients send `*_identity`, while numeric keys remain internal persistence details.
- Platform-menu and e-commerce-category tree responses now expose `parent_identity` and omit `parent_id`; the front-end tree no longer falls back to numeric keys.
- Settlement input accepts `subject_identity` with supported gas, delivery, and staff subject types.
- The platform audit now cross-checks every front-end definition against the backend resource catalogue and registered route source.