fix(board): serialize per-card move and delete settlements

[Chris0Jeky]

Stack and scope

Stacked on review-ready PR #3300 (codex/3299-delete-card-race) so the delete-only race fix remains independently reviewable. Refs #3307. Retarget to main only after #3300 lands, then requalify the resulting exact head.

Change

Defines one per-card settlement lane for move/delete mutations:

• the first mutation starts transport immediately; later same-card mutations serialize in user-intent order;
• queued work is bound to the initiating board-visit generation and cannot start after logout or A→B→A navigation;
• move count deltas derive from the card committed after the await, never a pre-request snapshot;
• a move response older than the current card's updatedAt is ignored;
• a move cannot reinsert a card removed by a later delete or authoritative refresh;
• if the later serialized move fails, the earlier confirmed move remains the committed state.

Unrelated cards remain concurrent. No API/DTO/schema change is introduced.

Tests

The test-first commit 1fab6da adds deferred-promise regressions for:

1. A→B response arriving after authoritative A→C state;
2. two same-card moves preserving intent order;
3. move followed by delete without resurrection;
4. failure of the later move preserving the earlier confirmed result.

Corrective implementation head: 435a3258a0d8dcabc7013821e3913be9a57c228b.

Verification

Hosted exact-head CI and independent review are pending. Keep draft until the complete child matrix passes; parent CI is not substituted for child qualification.

Closes #3307

[Chris0Jeky]

@codex address the exact-head frontend failures without changing cardStore.ts production behavior.

The uploaded Ubuntu JUnit artifact shows exactly two stale legacy assertions in cardStore.spec.ts:

1. Rename/update re-resolves the card by id after the await, so a shifted array cannot splice the wrong card. The simulated in-flight removal is now authoritative: assert only card-2 remains, assert no column-count mutation, and update the comments to state that an absent card must not be resurrected by an older move response.
2. Rename/update removes from old position and pushes updated card. The hardened settlement replaces the current card by stable id and preserves array position; assert currentBoardCards.value[0] equals movedCard and currentBoardCards.value[1].id remains card-2, rather than expecting the moved card at the end.

Keep the new cardStoreMoveMutationOrdering.spec.ts unchanged. Run the focused two files, frontend typecheck/build/full tests, and preserve the per-card serialization/freshness/count logic. Do not restore append/resurrection behavior merely to satisfy the old tests.

[chatgpt-codex-connector]

Summary

• Updated the legacy in-flight move test to treat concurrent removal as authoritative, asserting that only card-2 remains and that no column-count mutation occurs. The comments now explicitly prohibit resurrection by an older move response. frontend/taskdeck-web/src/tests/store/board/cardStore.spec.tsL438-L462
• Updated the standard move test to assert stable-ID replacement at the original array position while preserving card-2 in the second position. frontend/taskdeck-web/src/tests/store/board/cardStore.spec.tsL492-L522
• Preserved production behavior and left cardStoreMoveMutationOrdering.spec.ts unchanged. The follow-up commit is a39a473a (test(board): align move settlement assertions).
• Created the requested follow-up PR metadata with title “test(board): align legacy move assertions with hardened settlement.”
• No canonical documentation changes were needed because this is a test-only correction.
• Outstanding human-action items remain open in OUTSTANDING_TASKS.md, including signing identity/acceptance, private-instance decisions, maintainer review checkpoints, and other explicitly human-owned actions.

Testing

• ✅ cd frontend/taskdeck-web && npx vitest --run --maxWorkers=2 src/tests/store/board/cardStore.spec.ts src/tests/store/board/cardStoreMoveMutationOrdering.spec.ts — 2 files and 35 tests passed.
• ✅ cd frontend/taskdeck-web && npm run typecheck — passed.
• ✅ cd frontend/taskdeck-web && npm run build — production build completed successfully.
• ✅ cd frontend/taskdeck-web && npx vitest --run --maxWorkers=2 — 498 files passed; 7,154 tests passed and 3 skipped.
• ✅ git diff --check — no whitespace errors.
• ✅ git diff --name-only 435a3258a0d8dcabc7013821e3913be9a57c228b..HEAD — confirmed the follow-up changes only cardStore.spec.ts.
• ✅ git status --short --branch — clean working tree after commit.

View task →

[Chris0Jeky]

@codex publish the already-verified a39a473a test-only commit onto this PR's existing head branch codex/3307-card-mutation-ordering. Do not open a follow-up PR or leave it only in the task worktree. Preserve the patch exactly: only cardStore.spec.ts, no production changes. After pushing, report the resulting GitHub head SHA so hosted exact-head CI can qualify it.

[chatgpt-codex-connector]

Summary

• Updated only frontend/taskdeck-web/src/tests/store/board/cardStore.spec.ts, covering authoritative in-flight removal without card resurrection or count mutation. frontend/taskdeck-web/src/tests/store/board/cardStore.spec.tsL438-L458
• Updated the legacy move assertion to require stable-ID replacement while preserving array position. frontend/taskdeck-web/src/tests/store/board/cardStore.spec.tsL488-L518
• Committed the test-only patch locally as 3726a6cf3d3c35b33440b9661932672afda96c40.
• Publishing is blocked by missing GitHub credentials in this environment. Both HTTPS and SSH pushes failed. Consequently, the GitHub branch remains at 435a3258a0d8dcabc7013821e3913be9a57c228b; I cannot truthfully report a new hosted exact-head SHA.
• The supplied checkout did not contain commit object a39a473a, and GitHub does not currently expose that commit or contain it on the target branch. I reconstructed the requested one-file correction from the review instructions, but could not publish it.
• No production files, documentation, or cardStoreMoveMutationOrdering.spec.ts were changed.
• Outstanding human-owned items remain open in OUTSTANDING_TASKS.md, including signing identity/acceptance, private-instance actions, legal decisions, and real-device verification.

Testing

• ✅ git diff --check
• ✅ cd frontend/taskdeck-web && npx vitest --run --maxWorkers=2 src/tests/store/board/cardStore.spec.ts src/tests/store/board/cardStoreMoveMutationOrdering.spec.ts — 2 files and 35 tests passed.
• ✅ git diff-tree --no-commit-id --name-only -r HEAD — confirmed only frontend/taskdeck-web/src/tests/store/board/cardStore.spec.ts.
• ✅ git status --short --branch — clean working tree.
• ❌ git push origin HEAD:refs/heads/codex/3307-card-mutation-ordering — failed because no GitHub HTTPS credentials are available.
• ⚠️ git push git@github.com:Chris0Jeky/Taskdeck.git HEAD:refs/heads/codex/3307-card-mutation-ordering — SSH port 22 is unavailable in the environment.
• ✅ git ls-remote origin refs/heads/codex/3307-card-mutation-ordering — verified that the hosted branch still points to 435a3258a0d8dcabc7013821e3913be9a57c228b.

View task →