Merge remote-tracking branch 'origin/main' into sync-main

# Conflicts:
#	brand/designer-brand-pack.html

Author: gnick18

docs/audits/2026-05-15-user-list-phantom-leaks-investigation.md

@@ -92,6 +92,13 @@ vi.mock("@/hooks/useAccountType", () => ({
   useAccountType: () => "member",
 }));
 
+// The awaiting-approval chip renders only in lab mode (showApprovalFilter =
+// useIsLabMode() === true). This suite tests the chip in a lab-mode context
+// where a member is waiting on the lab head for approval.
+vi.mock("@/hooks/useIsLabMode", () => ({
+  useIsLabMode: () => true,
+}));
+
 // Purchases UX fix Bug 3 (2026-05-24): the new banner CTA uses
 // `useRouter().push("/lab-overview")`. The misc-filter suite never
 // triggers it (account_type is "member"), but the hook still has to

frontend/src/app/__tests__/purchases-page.misc-filter.test.tsx

@@ -267,6 +267,119 @@ describe("SuppliesPage — Orders & approvals lens (lab-head gating)", () => {
     );
   });
 
+  it("double-clicking Approve fires setPurchaseApproval exactly once (in-flight guard)", async () => {
+    // Simulate the stress-test regression: a rapid double-click on Approve must
+    // not call setPurchaseApproval twice. The inFlightRef guard blocks the second
+    // invocation synchronously before React re-renders with busy=true.
+    let resolveApproval!: () => void;
+    setPurchaseApproval.mockImplementationOnce(
+      () =>
+        new Promise<{ ok: true; value: object }>((res) => {
+          resolveApproval = () => res({ ok: true, value: {} });
+        }),
+    );
+
+    labApi.getAllPurchaseItems.mockResolvedValue([
+      makeItem({ id: 21, task_id: 9, username: "mira", item_name: "Enzyme mix" }),
+    ]);
+    labApi.getTasks.mockResolvedValue([
+      { id: 9, name: "Buffer prep", username: "mira" },
+    ] as never);
+
+    renderPage();
+
+    const chip = await screen.findByRole("tab", { name: /Awaiting approval/i });
+    fireEvent.click(chip);
+    await screen.findByText("Enzyme mix");
+
+    const [approveBtn] = screen.getAllByTestId("lab-head-purchase-approval-toggle");
+
+    // Rapid double-click: both events fire before React can re-render.
+    fireEvent.click(approveBtn);
+    fireEvent.click(approveBtn);
+
+    // Only one call should have been made.
+    expect(setPurchaseApproval).toHaveBeenCalledTimes(1);
+
+    // Let the in-flight promise resolve so the component settles cleanly.
+    resolveApproval();
+    await waitFor(() => expect(setPurchaseApproval).toHaveBeenCalledTimes(1));
+  });
+
+  it("double-clicking Decline fires declinePurchase exactly once (in-flight guard)", async () => {
+    let resolveDecline!: () => void;
+    declinePurchase.mockImplementationOnce(
+      () =>
+        new Promise<{ ok: true; value: object }>((res) => {
+          resolveDecline = () => res({ ok: true, value: {} });
+        }),
+    );
+
+    labApi.getAllPurchaseItems.mockResolvedValue([
+      makeItem({ id: 22, task_id: 9, username: "mira", item_name: "Loading dye" }),
+    ]);
+    labApi.getTasks.mockResolvedValue([
+      { id: 9, name: "Buffer prep", username: "mira" },
+    ] as never);
+
+    renderPage();
+
+    const chip = await screen.findByRole("tab", { name: /Awaiting approval/i });
+    fireEvent.click(chip);
+    await screen.findByText("Loading dye");
+
+    const [declineBtn] = screen.getAllByTestId("lab-head-purchase-decline-button");
+
+    fireEvent.click(declineBtn);
+    fireEvent.click(declineBtn);
+
+    expect(declinePurchase).toHaveBeenCalledTimes(1);
+
+    resolveDecline();
+    await waitFor(() => expect(declinePurchase).toHaveBeenCalledTimes(1));
+  });
+
+  it("approving item A does not disable item B's Approve button (per-item guard)", async () => {
+    // The guard is scoped per-component instance; approving one item must not
+    // block a concurrent approval of a different item in the same order group.
+    let resolveA!: () => void;
+    setPurchaseApproval
+      .mockImplementationOnce(
+        () =>
+          new Promise<{ ok: true; value: object }>((res) => {
+            resolveA = () => res({ ok: true, value: {} });
+          }),
+      )
+      .mockResolvedValueOnce({ ok: true, value: {} });
+
+    labApi.getAllPurchaseItems.mockResolvedValue([
+      makeItem({ id: 31, task_id: 10, username: "mira", item_name: "Item A" }),
+      makeItem({ id: 32, task_id: 10, username: "mira", item_name: "Item B" }),
+    ]);
+    labApi.getTasks.mockResolvedValue([
+      { id: 10, name: "Parallel order", username: "mira" },
+    ] as never);
+
+    renderPage();
+
+    const chip = await screen.findByRole("tab", { name: /Awaiting approval/i });
+    fireEvent.click(chip);
+    await screen.findByText("Item A");
+
+    const [btnA, btnB] = screen.getAllByTestId("lab-head-purchase-approval-toggle");
+
+    // Click A (in-flight, not resolved yet).
+    fireEvent.click(btnA);
+    expect(setPurchaseApproval).toHaveBeenCalledTimes(1);
+
+    // Click B independently — should also fire immediately.
+    fireEvent.click(btnB);
+    expect(setPurchaseApproval).toHaveBeenCalledTimes(2);
+
+    resolveA();
+    await waitFor(() => expect(setPurchaseApproval).toHaveBeenCalledTimes(2));
+  });
+
   it("mounts SpendingDashboard in the drawer when View spending is clicked", async () => {
     renderPage();
 

frontend/src/app/__tests__/supplies-page.approvals-lens.test.tsx

@@ -0,0 +1,64 @@
+// Operator-only CLEAR CLOUD SETTINGS (POST /api/admin/accounts/clear-settings).
+//
+// Body: { ownerKey?, email?, confirm: true }. Deletes ONE identity's
+// account_settings row (the E2E account-scoped settings blob). A plain
+// server-side row delete keyed by owner_key, no E2E key needed, the row is just
+// ciphertext we cannot read anyway. After this the user falls back to
+// folder-local settings, exactly as if they had never lifted, which un-sticks an
+// account whose blob got polluted (the Owen lift misfire). Unlike the full wipe
+// this touches ONLY account_settings, nothing else. Gated on ADMIN_EMAILS.
+// Idempotent (0 rows when the user had none).
+//
+// House style: no em-dashes, no emojis, no mid-sentence colons.
+
+import { requireOperator } from "@/lib/sharing/operator-access";
+import { isSharingEnabled, json } from "@/lib/sharing/directory/guard";
+import { ownerKeyForEmailSafe } from "@/lib/billing/owner";
+import {
+  deleteAccountSettings,
+  ensureAccountSettingsSchema,
+} from "@/lib/account/account-settings-db";
+
+export const runtime = "nodejs";
+
+export async function POST(req: Request): Promise<Response> {
+  if (!isSharingEnabled()) {
+    return json(404, { error: "not found" });
+  }
+
+  const blocked = await requireOperator();
+  if (blocked) return blocked;
+
+  let body: unknown;
+  try {
+    body = await req.json();
+  } catch {
+    return json(400, { error: "invalid json body" });
+  }
+  const input = (body ?? {}) as Record<string, unknown>;
+
+  if (input.confirm !== true) {
+    return json(400, { error: "confirm must be true to clear cloud settings" });
+  }
+
+  // Resolve the target identity. An explicit ownerKey wins, otherwise hash the
+  // email with the same key billing + the directory use.
+  let ownerKey: string | null =
+    typeof input.ownerKey === "string" && input.ownerKey.trim()
+      ? input.ownerKey.trim()
+      : null;
+  if (!ownerKey && typeof input.email === "string" && input.email.trim()) {
+    ownerKey = ownerKeyForEmailSafe(input.email.trim());
+  }
+  if (!ownerKey) {
+    return json(400, { error: "an ownerKey or email is required" });
+  }
+
+  try {
+    await ensureAccountSettingsSchema();
+    const cleared = await deleteAccountSettings(ownerKey);
+    return json(200, { ok: true, ownerKey, cleared });
+  } catch {
+    return json(500, { error: "clear failed" });
+  }
+}

frontend/src/app/api/admin/accounts/clear-settings/route.ts

@@ -966,10 +966,7 @@ function CreateEventModal({
       setError("new-event-start-date", "Start date is required.");
       ok = false;
     }
-    if (!endDate) {
-      setError("new-event-end-date", "End date is required.");
-      ok = false;
-    } else if (startDate && endDate < startDate) {
+    if (endDate && startDate && endDate < startDate) {
       setError("new-event-end-date", "End date must be on or after the start date.");
       ok = false;
     }
@@ -981,11 +978,13 @@ function CreateEventModal({
       focusFirstError();
       return;
     }
+    // If the user left end date blank, default it to the start date (single-day event).
+    const effectiveEndDate = endDate || startDate;
     onCreate({
       title,
       event_type: eventType,
       start_date: startDate,
-      end_date: endDate || null,
+      end_date: effectiveEndDate || null,
       start_time: startTime || null,
       end_time: endTime || null,
       location: location || null,

frontend/src/app/calendar/page.tsx

@@ -30,6 +30,12 @@ import {
 } from "@/lib/datahub/bigtable";
 import { ingestToDatasetLane } from "@/lib/datahub/bigtable/ingest";
 import { init as initBigTableEngine } from "@/lib/datahub/bigtable/duckdb-client";
+import {
+  getViewModePref,
+  setViewModePref,
+  getLinkedDatasetId,
+  setLinkedDatasetId,
+} from "@/lib/datahub/bigtable/view-mode-pref";
 import DatasetView from "@/components/datahub/bigtable/DatasetView";
 import TransformBuilder from "@/components/datahub/bigtable/TransformBuilder";
 import ManualSwitchControl from "@/components/datahub/bigtable/ManualSwitchControl";
@@ -531,6 +537,47 @@ export default function DataHubPage() {
     setConfirmDeleteTableId(null);
   }, [selectedTableId]);
 
+  // Restore the last-viewed mode when a table is opened. If the user previously
+  // converted this table to a dataset and was last viewing the dataset, reopen
+  // the dataset view automatically. The preference is stored in localStorage
+  // keyed by owner+tableId, so it persists across nav-away and back without any
+  // on-disk data-shape change. A missing or "editable" preference is a no-op.
+  // This runs after the table-switch clear above so it is not overwritten.
+  //
+  // Tracking: restorePendingId captures a tableId that has a "dataset" pref but
+  // whose catalog entry has not loaded yet. A follow-up datasets-change fires the
+  // restore once the linked dataset appears. Cleared as soon as we act on it.
+  const restorePendingId = useRef<string | null>(null);
+  useEffect(() => {
+    if (!bigTableOn || !currentUser || selectedTableId == null) return;
+    const pref = getViewModePref(currentUser, selectedTableId);
+    if (pref !== "dataset") return;
+    const linkedId = getLinkedDatasetId(currentUser, selectedTableId);
+    if (!linkedId) return;
+    if (datasets.some((d) => d.id === linkedId)) {
+      // Dataset catalog is already loaded: restore now.
+      setSelectedTableId(null);
+      setSelectedDatasetId(linkedId);
+      restorePendingId.current = null;
+    } else {
+      // Dataset catalog not yet loaded: park the request so the datasets effect
+      // below can complete the restore once the catalog arrives.
+      restorePendingId.current = selectedTableId;
+    }
+  }, [selectedTableId, currentUser, bigTableOn, datasets]);
+
+  // Complete a deferred mode restore once the dataset catalog has loaded.
+  useEffect(() => {
+    const tableId = restorePendingId.current;
+    if (!tableId || !currentUser || !bigTableOn || datasets.length === 0) return;
+    const linkedId = getLinkedDatasetId(currentUser, tableId);
+    if (!linkedId) return;
+    if (!datasets.some((d) => d.id === linkedId)) return;
+    restorePendingId.current = null;
+    setSelectedTableId(null);
+    setSelectedDatasetId(linkedId);
+  }, [datasets, currentUser, bigTableOn]);
+
   // Apply a pending `?analysis=<id>` deep link once the deep-linked doc's content
   // has loaded. This runs after the table-switch clear above, so the analysis the
   // run navigated to is what wins, and the user lands on its result sheet rather
@@ -1441,7 +1488,13 @@ export default function DataHubPage() {
       // Success: flip to the dataset view and clear the loader.
       setConvertBoot(null);
       setSelectedTableId(null);
-      if (newId) setSelectedDatasetId(newId);
+      if (newId) {
+        // Persist both the table->dataset link and the view-mode preference so
+        // that nav-back reopens the dataset view rather than the editable grid.
+        setLinkedDatasetId(owner, meta.id, newId);
+        setViewModePref(owner, meta.id, "dataset");
+        setSelectedDatasetId(newId);
+      }
     } catch {
       // The error phase was already emitted to convertBoot; the loader shows a
       // retry. Leave convertBoot set so the user sees it (cleared on retry/cancel).
@@ -1450,6 +1503,33 @@ export default function DataHubPage() {
     }
   }, [bigTableOn, currentUser, openContent, selectedMeta, queryClient]);
 
+  // Switch back from the dataset view to the editable grid for the table that was
+  // previously converted. Reads the linked tableId from localStorage and restores
+  // it. Sets the view-mode preference to "editable" so nav-back stays on the grid.
+  // The editable cell store was never touched, so switching back is non-destructive.
+  const handleSwitchBack = useCallback(() => {
+    if (!currentUser || !selectedDatasetId) return;
+    // Find the editable tableId that links to this dataset.
+    const table = allTables.find(
+      (t) => getLinkedDatasetId(currentUser, t.id) === selectedDatasetId,
+    );
+    if (!table) return;
+    setViewModePref(currentUser, table.id, "editable");
+    setSelectedDatasetId(null);
+    setSelectedTableId(table.id);
+  }, [currentUser, selectedDatasetId, allTables]);
+
+  // Whether the currently-open dataset has a linked editable table (i.e. the user
+  // can switch back). Used to show/hide the switch-back affordance.
+  const linkedEditableTable = useMemo(() => {
+    if (!currentUser || !selectedDatasetId) return null;
+    return (
+      allTables.find(
+        (t) => getLinkedDatasetId(currentUser, t.id) === selectedDatasetId,
+      ) ?? null
+    );
+  }, [currentUser, selectedDatasetId, allTables]);
+
   // The derived-table banner inputs. When the open table is derived, resolve its
   // source meta from the catalog so the banner can name it and offer a jump to
   // it. isDerived comes from the open content's link (the recompute path sets it),
@@ -2371,6 +2451,9 @@ export default function DataHubPage() {
                   });
                   setSelectedDatasetId(null);
                 }}
+                onSwitchToEditable={
+                  linkedEditableTable ? handleSwitchBack : undefined
+                }
               />
             )
           ) : tablesInCollection.length === 0 && datasets.length === 0 ? (

frontend/src/app/datahub/page.tsx

@@ -28,7 +28,7 @@
   --surface-raised: #ffffff; /* cards, panels */
   --surface-overlay: #ffffff; /* popups, modals */
   --surface-sunken: #f1f5f9; /* input wells, insets (slate-100) */
-  --foreground-muted: #6b7280; /* secondary text, gray-500 */
+  --foreground-muted: #6b7080; /* secondary text — nudged 2 pts blue from gray-500 to clear WCAG AA on --surface-sunken */
   --border-subtle: #e5e7eb; /* hairlines, gray-200 */
 
   /* Interactive accent (links, active nav, selected states). brand-action on

frontend/src/app/globals.css

@@ -483,6 +483,9 @@ export default function AppNavBar({
                     onPointerDown={(e) =>
                       onTabPointerDown(e, item.href, "inline")
                     }
+                    {...(item.newTab
+                      ? { target: "_blank", rel: "noopener noreferrer" }
+                      : {})}
                     className={tabClass(item, active)}
                   >
                     {item.label}
@@ -597,6 +600,9 @@ export default function AppNavBar({
                       href={item.href}
                       onClick={() => setMoreOpen(false)}
                       role="menuitem"
+                      {...(item.newTab
+                        ? { target: "_blank", rel: "noopener noreferrer" }
+                        : {})}
                       className={`flex items-center gap-2 px-2.5 py-2 text-[13px] font-semibold rounded-lg ${
                         active
                           ? "text-accent bg-accent-soft"