Fix feedback regressions and beta schema gate

[steve8708]

Summary

• keep share dialogs readable when an additive notified_at migration has not reached a site yet
• make the beta schema gate fail loudly when its matcher cannot run instead of treating the failure as "no schema changes"
• reserve COEP isolation for validated MCP embed sessions so ordinary iframe previews can load cross-origin Builder assets
• retry another microphone when the selected Clips desktop input cannot start, and reuse that fallback in the setup meter
• make first-run setup fail clearly below Node 22.22, ignore generated PGlite lock files, and clarify the pnpm and React-route instructions
• remove contradictory account-only copy from the local-development sign-in path
• give failed Slack identity checks a direct recovery path
• keep Cloudflare Workers _headers below the 100-rule platform limit without dropping required static security headers
• allow loopback Ollama endpoints in non-production and show provider-save failures in Settings
• correct standalone deployment commands and clarify local versus deployed configuration across the deployment docs and translations
• preserve one local PGlite client across Vite reload realms so edits do not lock the database or hide persisted settings
• repair the Docker install layer and clarify the local source path, Vite plugin alias, and account-free Vercel preview limits

Feedback disposition

• fixed here: Clips desktop headset capture
• fixed here: iframe preview blocked by COEP
• fixed here: fresh Analytics and Design list-resource-shares Sentry failures caused by reads of the not-yet-migrated notified_at column
• fixed here: exact Node minimum, missing pnpm command, generated PGlite lock, local-dev sign-in copy, and React route wording
• fixed here: Slack DM identity recovery guidance
• fixed here: Cloudflare header-rule overflow and local Ollama endpoint rejection
• fixed here: deployed auth setup, Vercel without a global CLI, deployment environment wording, Dockerfile prerequisite, and email-provider prerequisites
• fixed here: Chat next step, dynamic local port, Getting Started navigation, standalone Netlify deploy, and local versus deployed auth
• fixed here: PGlite lock failures during dev reloads, which also explains the reported local settings disconnects
• fixed here: Docker frozen-lockfile mismatch, local actions/hello.ts location, temporary Vercel preview guidance, and agentNativePlugins naming
• fixed here: fresh cloud scaffolds skipping the optional terminal native build
• mitigated here: the first npx run now suppresses npm's confirmation prompt; the published package has no postinstall script and the reporter's cached retry was immediate
• clarification requested: Analytics API fallback
• needs follow-up: Analytics run timeout did not correlate to a captured JavaScript error and needs a server-side run trace
• resolved elsewhere or recovered: current Clips owner/auth reports, missing post-recording popup, and erroneous Clips emails
• owned elsewhere: Design, Slides, and Dispatch-to-Design authentication reports
• informational: Calendar suggestion, Analytics product-principle discussion, and automated availability-monitor duplicates
• informational or needs product follow-up: deployment-link rendering, view-screen discovery, local auth-env warnings, docs-link latency, Builder file-storage setup, prompt-copy scope, deployment-provider grouping, absent MCP tooling, Builder credit reconnection, and chooser density
• needs follow-up from the newest sweep: Dispatch setup behavior, repeated Resend approval, standalone Netlify database injection, local workspace scoping/invitations, first production migration latency, one unclear provider chooser screenshot, and deployed signup reports without enough configuration detail

Verification

• corepack pnpm guards - 71/71 passed
• corepack pnpm --filter @agent-native/core typecheck
• corepack pnpm --filter @agent-native/dispatch typecheck
• corepack pnpm --filter clips-desktop typecheck
• Core launcher and scaffold suites: 55/55 passed
• auth-page suite: 11/11 passed
• Dispatch identity suite: 32/32 passed
• security-header regression: 10/10 passed
• pending-migration share-list regression: 1/1 passed
• Clips media fallback suite: 7/7 passed
• Netlify prebuilt workflow suite: 32/32 passed
• Core deployment and provider-settings suites: 185/185 passed
• PGlite client suite: 69/69 passed, including a fresh-realm reload regression
• generated standalone Chat smoke passed through scaffold, install, dev startup, local auth, and browser navigation with clean server/browser logs
• standalone scaffold native-build configuration suite: 15/15 selected tests passed
• real Chat Cloudflare-module build passed; generated _headers contains 7 rules with required static security headers intact
• modified source formatting and git diff --check passed

Live headset hardware, authenticated browser flows, beta deployment, and production migration were not exercised locally.

[github-actions]

Here's a visual recap of what changed:

Open the full interactive recap

[steve8708]

Addressed the review summary in 1ea2170: NotReadableError and legacy TrackStartError now trigger fallback only in audio acquisition, so camera failures keep their existing classification. The CORP concern is intentionally unchanged for the framing contract explained in the inline reply.

[builder-io-integration]

Builder reviewed your changes — looks good ✅

Review Details

Incremental Code Review Summary

The latest PR expands the earlier fixes with first-run setup and CLI guidance, deployment/documentation updates, provider validation and save-error handling, Cloudflare static-header rule changes, and local PGlite reload persistence. The prior security-header iframe/CORP comment remains an existing open issue and was not reposted. The parallel review workers were interrupted before returning findings, so this review records no newly confirmed issues rather than speculating from incomplete results. The PR remains high risk because it spans setup, deployment, security headers, persistence, and provider configuration.

🧪 Browser testing: Not completed in this interrupted review; the latest changes include user-facing setup/settings and documentation flows that require follow-up browser verification.