Pipeliner Client

## Board shipped — PR https://github.com/omdev-tech/PipeLiner-Client/pull/98 (base `dev`)

Branch `feat/1546-kanban-board`, branched off **`origin/dev`** (not `master`): every backend dependency #1541–#1544 is on `dev` and none is on `master` yet. Base verified at the #97 visibility-matrix merge.

### The four risk points

1. **The rail's other inhabitants live.** `New request` and `KnowledgeStrip` are recomposed into the board toolbar (§KB.1a); `KnowledgeStrip` gained `orientation="inline"` (its original §PK.1 horizontal form). A route-level test asserts both are still reachable after the list is gone.
2. **No role logic in `src/`.** `boardContract.test.ts` runs both greps as tests: no `internal_role` in the board tree, and no second status-order array anywhere under `src/`/`app/`.
3. **A client cannot initiate a drag.** Pointer-down + move produces no drag-start — asserted, with the positive case asserted too so the negatives cannot pass vacuously. Same for `can_move_forward: false` and every Backlog card.
4. **Backlog(16)/Blocked(14) fire zero network calls.** The locked-column check runs before the one-card detail read, so a drop on either costs literally nothing. Both still render, with their two different lock reasons.

### New requirement from #1543
On drop, the **real** allowed set for the one card being dropped is fetched and decides the target. The narrowed-workflow case is covered in both directions: the advertised-but-invalid target is refused without a doomed write, and the hidden-but-valid one succeeds. **403 and 409** both roll back identically with the designed localised copy.

### Two bugs found and fixed on the way
- The board rendered ten empty columns while its query was still *disabled* by auth — neither loading nor successful — which reads as "this project has no tickets". Regression test added.
- The keyboard move path dead-ended: choosing a target destroys the row focus was standing on. `TransitionControl` now moves focus to the confirm step.

### Three deliberate deviations from §KB, for review
1. `TransitionControl` gained a compact `variant="card"` trigger. §KB.9 asks for a 24px icon button on the card *and* says the molecule needs no change — both cannot hold, since its own trigger is `h-10 min-w-56`. Menu, confirm, Esc-close and focus-return are shared verbatim.
2. dnd-kit's KeyboardSensor is **not** bound to the card: its Space/Enter would hijack the card's own activation. §KB.9 already names the Move menu the primary path and the sensor a bonus; the Move menu is fully keyboard-operable and asserted with keys alone.
3. No `--board-chrome` variable: a `shrink-0` toolbar over a `min-h-0 flex-1` scroller single-sources the offset by construction, which is what the token existed for.

### Scope
Polling, manual refresh, freshness and the card-move animation (§KB.7/§KB.8) belong to **#1547** and are not in this PR; their i18n keys land with them.

### Gates
`npx vitest run` → 1024 passed / 154 files · `npx tsc --noEmit` clean · `npx eslint .` clean · `npm run build` compiled successfully (the `/admin` `ENVIRONMENT_FALLBACK` prerender log is pre-existing and non-fatal). Node 20.20.2.

## Code review: FAIL — back to In development

PR https://github.com/omdev-tech/PipeLiner-Client/pull/98 is not shippable yet. Four user-visible paths are dead or silent. B1 and B4 independently re-confirmed.

**What is strong and must survive the fix:** the reviewer found **no client-side permission decision anywhere** — no role comparison, no status ordering, no derived capability boolean. `isCardDraggable` reads `can_move_forward` with a closed default, `dragTargets` takes the allowed set as given, `board_read_only` is used as a field and never inferred. The i18n work is real French with mirrored ICU shapes. `New request` and `KnowledgeStrip` genuinely survived the rail's removal, asserted by clicking the real controls.

### B1 — Blocked is unreachable from the Move menu
`useBoardMove.ts:119` puts the locked-column guard at the top of `move()`, which is shared by the drag path *and* the menu. A CTO choosing Blocked gets `"inert"`: no request, no error, no announcement, menu stays open. §KB.4b's argument — blocking is a decision, not a gesture, so it stays reachable through the menu — is dead code.

### B2 — the Move menu renders a stale target list it can never update
`targetsFor()` reads `allowed.peek()`, a non-subscribing `getQueryData`, and nothing mounts a query on that key. In the exact case `useCardAllowedStatuses` was written for — developer, narrowed workflow, canonical and real sets **disjoint** — the menu offers only the target that will fail, and the one that would work is never offered anywhere. Fails silently.

### B3 — focus return on closing a ticket is broken
`lastTaskTrigger` holds a DOM node, but the board now unmounts entirely behind the detail takeover, so the node is detached and focus falls to `<body>`.

### B4 — dnd-kit's a11y layer left at English defaults, documenting a sensor that is not bound
`announcements` is not overridden, so dnd-kit announces *"Picked up draggable item 501."* in English, **assertively** — a third live region where §KB.9 allows two. And `board.dragInstructions` is `aria-describedby`'d onto every card saying *"Press Space to pick up the ticket"* while only `PointerSensor` is registered: a screen-reader user presses Space and the card's `onClick` replaces the board with the detail.

### Also required
**S1** §KB.4c optimism is not implemented — `pending` only restyles the card in its *origin* column, producing exactly the "reads as rejected, then a spurious second animation" §KB.4c departed from §IR.5 to avoid. **S2** two quick moves clobber each other's pending marker and error. **S3** counts are wrong under the tab filter and the cap — a Bug pill can read 0 while bugs exist below the cap. **S4** `useCardAllowedStatuses` never revalidates. **S5** the contract greps are weaker than their names claim, and #1547's new files would escape them silently.

### Accepted deviations
`variant="card"` and the dropped `--board-chrome` are both accepted — the latter verified to single-source the offset with no compensating magic number. Dropping `KeyboardSensor` is accepted **once B4's copy is fixed**.

### Two §KB self-contradictions to resolve later
Toolbar DOM order: §KB.1a says tabs → knowledge → Columns → New request; §KB.9's tab-order sentence says New request first. And the priority scale keys on `position` 1–5, assuming the stock five-entry Redmine enumeration.

Fix in progress on the same branch and PR.

## Merged — review passed on round 2

PR https://github.com/omdev-tech/PipeLiner-Client/pull/98 merged to `dev` (`449a83f`, +5733/−1213, 38 files). Gates: vitest **1065 passed** / 156 files, tsc, eslint, build all clean; Jenkins PR-98 green.

All four blockers fixed, each with a test the reviewer could trace back to the original defect rather than to a restatement of the new code:

- **B1** — the locked-column guard moved out of the shared `move()` into `boardDrop.ts`, on the drag path only. Paired tests: a *drag* onto Blocked never reaches `move()`; the same card via the *Move menu* does POST `{status_id: 14}`. §KB.4b's escape hatch is live again.
- **B2** — `useCardAllowedStatuses.peek` deleted; `useBoardMove` holds a real `useQuery` on the engaged card, so an already-open menu re-renders when the real set lands. The disjoint narrowed-workflow case now completes.
- **B3** — remembers the issue id and refocuses the re-mounted card via `data-issue-id`. Verified to fail against the old implementation.
- **B4** — `announcements` silenced across all four phases (dnd-kit calls them unconditionally); `dragInstructions` rewritten in both catalogs to describe the Move button, which is the control that actually exists. The test drives a real pointer drag and asserts every `[aria-live="assertive"]` node stays empty.

Plus S1 (optimism now drawn from `applyPendingMoves`, with tests that render a board and assert both position and column counts), S2 (`pending` keyed by issue id, three independent guards against a stale-`status_id` third drag), S3 second half, S4, S5, and the mirrored Cancel focus bug.

### Two improvements beyond the review

**The frontend's Backlog strip was removed** — a second copy of the credit gate, which §IR.3 warns against. The reviewer checked the server rather than taking it on faith and confirmed the guarantee got *stronger*: Backlog is unreachable by three independent server facts (`may_set_status` refuses it for every role including admin; `FORWARD_ORDER` cannot even enumerate it; `TransitionTask` re-checks on write). One implementation, three readers, instead of two implementations that could drift.

**The contract greps went from decoration to teeth.** The sweep is now discovered by pattern with a canary asserting its own anchors, so a regex that stops matching fails loudly instead of passing vacuously. It also disproved the review's claim that `internal_role` appears nowhere under `src/` — there are six legitimate readers, including §IR's documented rendering hint in `TaskDetailPane`. The pin is an exact sorted `toEqual`, so a seventh appears in the diff as a named failure.

### Known, accepted, not blocking
Three cosmetic residuals: a lift-and-drop inside the allowed-set RTT loses the disjoint benefit on the drag path (self-consistent — the column never lit up); concurrent menu moves on different cards share one `errorKey` slot; the `internal_role` allowlist is per file rather than per occurrence.

### Carried elsewhere
The tab-pill undercount is **#1554** (per-category counts must come from the server — not fixable client-side, tickets below the cap are not in the response at all). The priority scale's assumption of a five-entry Redmine enumeration is commented in place.

Shipped to production in master build #109 (`c784f95`). PR #98. QA passed on prod — proof attached above.